@m8t-stack/cli 0.2.21 → 0.2.23

package/dist/cli.js

@@ -1231,7 +1231,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.21";
+var CLI_VERSION = "0.2.23";
 
 // src/lib/render-error.ts
 init_errors();
@@ -11481,6 +11481,31 @@ import { DefaultAzureCredential } from "@azure/identity";
 // src/lib/az.ts
 init_errors();
 import { spawn } from "child_process";
+var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
+var SECRET_KEY_RE = /(pem|secret|token|password|passwd|pwd|credential|private[-_]?key)/i;
+function redactAzArgs(args) {
+  const out = [];
+  let secretFlagActive = false;
+  for (const arg of args) {
+    if (arg.startsWith("-")) {
+      secretFlagActive = SECRET_VALUE_FLAGS.has(arg);
+      out.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const key2 = eq > 0 ? arg.slice(0, eq) : "";
+    if (secretFlagActive) {
+      out.push(key2 ? `${key2}=[REDACTED]` : "[REDACTED]");
+      continue;
+    }
+    if (key2 && SECRET_KEY_RE.test(key2)) {
+      out.push(`${key2}=[REDACTED]`);
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
 function runAz(args) {
   return new Promise((resolve3, reject) => {
     const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -11517,7 +11542,7 @@ function runAz(args) {
         reject(
           new LocalCliError({
             code: "AZ_COMMAND_FAILED",
-            message: `'az ${args.join(" ")}' failed: ${errString.trim()}`
+            message: `'az ${redactAzArgs(args).join(" ")}' failed: ${errString.trim()}`
           })
         );
         return;
@@ -15653,7 +15678,7 @@ async function awaitDataPlaneReady(opts) {
   const consecutive = opts.consecutive ?? 3;
   const attempts = opts.attempts ?? 60;
   const intervalMs = opts.intervalMs ?? 5e3;
-  const sleep3 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let streak = 0;
   for (let i = 1; i <= attempts; i++) {
     const r = await opts.probe();
@@ -15675,7 +15700,7 @@ async function awaitDataPlaneReady(opts) {
       streak = 0;
       opts.onProgress?.(`data-plane not ready (${forcedRetryable ? `status ${(r.status ?? 0).toString()}` : cls.category}), waiting\u2026`);
     }
-    if (i < attempts) await sleep3(intervalMs);
+    if (i < attempts) await sleep4(intervalMs);
   }
   return { ready: false, attempts };
 }
@@ -16703,7 +16728,7 @@ init_errors();
 async function deployHostedWorker(args) {
   const onProgress = args.onProgress ?? ((_m) => {
   });
-  const sleep3 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const timeout = args.pollTimeoutMs ?? 8 * 60 * 1e3;
   const interval = args.pollIntervalMs ?? 1e4;
@@ -16755,7 +16780,7 @@ async function deployHostedWorker(args) {
         hint: "Provisioning can take 2\u20135 min; re-run with the same name to resume, or check the version status in the Foundry portal."
       });
     }
-    await sleep3(interval);
+    await sleep4(interval);
   }
 }
 
@@ -16900,7 +16925,7 @@ var SIZE_PRESETS = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_REGISTRY = "ghcr.io/m8t-run";
+var DEFAULT_REGISTRY = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE = "m8t-coding-agent";
 var DEFAULT_TAG = "v0.1.0";
 var DEFAULT_MODEL = "gpt-4.1-mini";
@@ -16909,7 +16934,7 @@ var CoderDeployCommand = class extends M8tCommand {
   static paths = [["coder", "deploy"]];
   static usage = Command28.Usage({
     description: "Deploy the curated coding agent as a hosted Foundry worker.",
-    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
     examples: [
       ["Deploy a coder with defaults", "$0 coder deploy my-coder"],
       ["Larger sandbox + a custom model", "$0 coder deploy my-coder --size large --model-deployment gpt-4.1"],
@@ -17296,7 +17321,7 @@ var SIZE_PRESETS2 = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_REGISTRY2 = "ghcr.io/m8t-run";
+var DEFAULT_REGISTRY2 = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE2 = "m8t-azure-executor";
 var DEFAULT_TAG2 = "v0.1.0";
 var DEFAULT_MODEL2 = "gpt-5-mini";
@@ -17305,11 +17330,11 @@ var AzureExecDeployCommand = class extends M8tCommand {
   static paths = [["azure-exec", "deploy"]];
   static usage = Command30.Usage({
     description: "Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).",
-    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-run/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-labs/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
     examples: [
       [
         "Deploy scoped to a resource group",
-        "$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-run/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp"
+        "$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-labs/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp"
       ]
     ]
   });
@@ -17341,7 +17366,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       throw new LocalCliError({
         code: "USAGE",
         message: "--brain owner/repo is required (the executor delivers proof to a brain).",
-        hint: "Example: --brain m8t-run/azure-exec-smoke-brain"
+        hint: "Example: --brain m8t-labs/azure-exec-smoke-brain"
       });
     }
     const size = (this.size ?? "large").toLowerCase();
@@ -17573,7 +17598,7 @@ import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/ident
 
 // src/lib/platform-update.ts
 init_errors();
-var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-run/m8t";
+var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-labs/m8t";
 function parseImageRef2(ref) {
   const lastColon = ref.lastIndexOf(":");
   const lastSlash = ref.lastIndexOf("/");
@@ -17806,13 +17831,13 @@ function entityToStamp(e) {
 }
 
 // ../../packages/platform-release/dist/esm/channel-url.js
-var CHANNEL_LATEST_URL = "https://github.com/m8t-run/m8t/releases/latest/download/manifest.json";
+var CHANNEL_LATEST_URL = "https://github.com/m8t-labs/m8t/releases/latest/download/manifest.json";
 function platformTag(version) {
   const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
   return `platform-v${bare}`;
 }
 function channelUrlForVersion(version) {
-  return `https://github.com/m8t-run/m8t/releases/download/${platformTag(version)}/manifest.json`;
+  return `https://github.com/m8t-labs/m8t/releases/download/${platformTag(version)}/manifest.json`;
 }
 
 // ../../packages/platform-release/dist/esm/apply-request.js
@@ -17902,7 +17927,7 @@ import * as os8 from "os";
 import * as path19 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 init_errors();
-var OWNER_REPO = "m8t-run/m8t";
+var OWNER_REPO = "m8t-labs/m8t";
 function parseTreeResponse(body) {
   const map = /* @__PURE__ */ new Map();
   for (const e of body.tree ?? []) if (e.type === "tree") map.set(e.path, e.sha);
@@ -20750,7 +20775,7 @@ function classifyWhatIf(changes) {
 }
 
 // src/commands/deploy.ts
-var DEFAULT_IMAGE_REF = "ghcr.io/m8t-run/m8t:latest";
+var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
   static usage = Command36.Usage({
@@ -21151,7 +21176,7 @@ function resolveJudgeDeployment(flag, env) {
     warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run (DESIGN \xA75.5)."
   };
 }
-var BRAIN_REPO_MARKERS = ["m8t-run/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
+var BRAIN_REPO_MARKERS = ["m8t-labs/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
 function assertOutNotInBrainRepo(out) {
   if (BRAIN_REPO_MARKERS.some((m) => out.includes(m))) {
     throw new LocalCliError({
@@ -22805,7 +22830,7 @@ function mapItems(raw) {
   return acc.reverse();
 }
 function makeConversationSource(client, opts = {}) {
-  const sleep3 = opts.sleep ?? defaultSleep;
+  const sleep4 = opts.sleep ?? defaultSleep;
   return {
     async items(conversationId) {
       for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
@@ -22823,7 +22848,7 @@ function makeConversationSource(client, opts = {}) {
             throw new ConvFetchError("auth", `auth failed reading ${conversationId}`);
           const retryable = status === void 0 || status === TRANSIENT;
           if (retryable && attempt < MAX_ATTEMPTS - 1) {
-            await sleep3(attempt);
+            await sleep4(attempt);
             continue;
           }
           throw new ConvFetchError("terminal", `exhausted ${String(MAX_ATTEMPTS)} retries reading ${conversationId}: ${e?.message ?? String(e)}`);
@@ -23625,7 +23650,7 @@ function extractJson(text) {
   return JSON.parse(candidate2.slice(start, end + 1));
 }
 async function propose(model, system, user, opts = {}) {
-  const sleep3 = opts.sleep ?? defaultSleep2;
+  const sleep4 = opts.sleep ?? defaultSleep2;
   const modelName = opts.model ?? MODEL_NAME_FALLBACK;
   let inputTokens = 0;
   let outputTokens = 0;
@@ -23641,7 +23666,7 @@ async function propose(model, system, user, opts = {}) {
     } catch (e) {
       lastErr = `parse: ${e.message}`;
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep3(attempt);
+        await sleep4(attempt);
         continue;
       }
       break;
@@ -23650,7 +23675,7 @@ async function propose(model, system, user, opts = {}) {
     if (!Array.isArray(rawDeltas)) {
       lastErr = "schema: top-level { deltas: [] } missing";
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep3(attempt);
+        await sleep4(attempt);
         continue;
       }
       break;
@@ -25605,8 +25630,8 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
-var DEFAULT_INSTALLER = "ghcr.io/m8t-run/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.0";
+var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
+var DEFAULT_INSTALLER_TAG = "v0.1.30";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25617,7 +25642,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.0"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.30"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.30"]
     ]
   });
   location = Option46.String("--location");
@@ -25625,6 +25651,10 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   clientId = Option46.String("--client-id");
   subscription = Option46.String("--subscription");
   installerTag = Option46.String("--installer-tag");
+  // Full image ref override (registry + repo + tag) — an escape hatch when the
+  // default org/tag is wrong for the current CLI (e.g. a stale published build).
+  // Wins over --installer-tag / the pinned default.
+  installerImage = Option46.String("--installer-image");
   gatewayImageRef = Option46.String("--gateway-image-ref");
   githubAppCreds = Option46.String("--github-app-creds");
   async executeCommand() {
@@ -25635,6 +25665,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? DEFAULT_RG;
     const clientIdOpt = typeof this.clientId === "string" ? this.clientId : void 0;
     const installerTag = (typeof this.installerTag === "string" ? this.installerTag : void 0) ?? DEFAULT_INSTALLER_TAG;
+    const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
+    const installerImage = installerImageOverride ?? `${DEFAULT_INSTALLER}:${installerTag}`;
     const gatewayImageRef = typeof this.gatewayImageRef === "string" ? this.gatewayImageRef : void 0;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -25685,10 +25717,24 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     out("granting Owner at subscription scope\u2026");
     await grantOwnerAtSubscription({ principalId: mi.principalId, subscriptionId });
     const roleAssignmentIds = await listAssignmentIds({ principalId: mi.principalId, subscriptionId });
+    const saName = deriveStatusSaName(resourceGroup, subscriptionId);
+    await writeBootstrapState({
+      subscriptionId,
+      resourceGroup,
+      location,
+      aciName: ACI_NAME,
+      miName: MI_NAME,
+      miClientId: mi.clientId,
+      miPrincipalId: mi.principalId,
+      roleAssignmentIds,
+      appRegClientId: appReg.clientId,
+      statusSaName: saName,
+      statusBlobUrl: statusBlobUrl(saName),
+      installerTag
+    });
     out("waiting for the installer identity to be usable (role propagation)\u2026");
     const miReady = await waitForMiToken({ clientId: mi.clientId, subscriptionId, onProgress: out });
     if (!miReady) out("identity not confirmed yet \u2014 launching anyway (the installer retries its own login)");
-    const saName = deriveStatusSaName(resourceGroup, subscriptionId);
     out("launching the cloud installer (ACI)\u2026");
     await kickInstaller({
       aciName: ACI_NAME,
@@ -25698,25 +25744,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       miResourceId: mi.resourceId,
       miClientId: mi.clientId,
       appRegClientId: appReg.clientId,
-      image: `${DEFAULT_INSTALLER}:${installerTag}`,
+      image: installerImage,
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp
     });
-    await writeBootstrapState({
-      subscriptionId,
-      resourceGroup,
-      location,
-      aciName: ACI_NAME,
-      miName: MI_NAME,
-      miClientId: mi.clientId,
-      miPrincipalId: mi.principalId,
-      roleAssignmentIds,
-      appRegClientId: appReg.clientId,
-      statusSaName: saName,
-      statusBlobUrl: statusBlobUrl(saName),
-      installerTag
-    });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
   ${colors.hint("next:")} m8t bootstrap status --watch   ${colors.dim("# watch the install to done")}
@@ -25775,7 +25807,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
       typeof this.output === "string" ? this.output : void 0,
       this.context.stdout
     );
-    const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
     const watch = this.watch === true;
     for (; ; ) {
       let doc;
@@ -25785,7 +25817,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
           if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
 `);
-          await sleep3(1e4);
+          await sleep4(1e4);
           continue;
         }
         throw e;
@@ -25810,7 +25842,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         );
         return 1;
       }
-      await sleep3(1e4);
+      await sleep4(1e4);
     }
   }
 };
@@ -25944,24 +25976,43 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
     }
     const state = await readBootstrapState();
     if (!state) {
-      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state to reap.", hint: "Nothing to do." });
+      if (this.force === true) {
+        const { subscriptionId: sub } = await getAzAccount();
+        if (!sub) {
+          throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
+        }
+        const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        this.context.stdout.write(
+          found.length === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub assignments. Nothing to reap.
+` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(found.length)} orphaned installer Owner@sub assignment(s).
+`
+        );
+        return 0;
+      }
+      throw new LocalCliError({
+        code: "BOOTSTRAP_NO_STATE",
+        message: "No bootstrap state to reap.",
+        hint: "Nothing to do. If a launch failed early it may have orphaned an installer Owner@sub grant \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean it."
+      });
     }
-    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-    if (doc.status !== "done" && !(this.force === true)) {
-      if (doc.status === "failed") {
+    if (this.force !== true) {
+      const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+      if (doc.status !== "done") {
+        if (doc.status === "failed") {
+          throw new LocalCliError({
+            code: "BOOTSTRAP_REAP_FAILED_INSTALL",
+            message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
+            hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          });
+        }
+        const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
+        const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
         throw new LocalCliError({
-          code: "BOOTSTRAP_REAP_FAILED_INSTALL",
-          message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
-          hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          code: "BOOTSTRAP_REAP_NOT_DONE",
+          message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
+          hint: deadHint
         });
       }
-      const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
-      const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
-      throw new LocalCliError({
-        code: "BOOTSTRAP_REAP_NOT_DONE",
-        message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
-        hint: deadHint
-      });
     }
     await reapInstaller({
       subscriptionId: state.subscriptionId,
@@ -26419,11 +26470,108 @@ import * as path35 from "path";
 import { spawn as spawn7 } from "child_process";
 init_errors();
 init_rbac();
+
+// src/lib/simple-stacey.ts
+var SIMPLE_STACEY_PERSONA = "startup-advisor-intake";
+var SIMPLE_STACEY_AGENT = "stacey-intake";
+async function deploySimpleStacey(args) {
+  try {
+    return await deployPromptAdvisor({
+      credential: args.credential,
+      endpoint: args.endpoint,
+      repoRoot: args.repoRoot,
+      persona: SIMPLE_STACEY_PERSONA,
+      agentName: SIMPLE_STACEY_AGENT,
+      fieldOverrides: args.fieldOverrides
+    });
+  } catch (e) {
+    if (e && typeof e === "object" && "code" in e) {
+      const err = e;
+      if (err.code === "ADVISOR_PERSONA_MISSING") {
+        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new LocalCliError2({
+          code: "SIMPLE_STACEY_PERSONA_MISSING",
+          message: err.message,
+          hint: err.hint,
+          cause: err.cause
+        });
+      }
+      if (err.code === "ADVISOR_NO_MODEL") {
+        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new LocalCliError2({
+          code: "SIMPLE_STACEY_NO_MODEL",
+          message: err.message,
+          hint: err.hint,
+          cause: err.cause
+        });
+      }
+      if (err.code === "ADVISOR_BAD_EFFORT") {
+        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new LocalCliError2({
+          code: "SIMPLE_STACEY_BAD_EFFORT",
+          message: err.message,
+          hint: err.hint,
+          cause: err.cause
+        });
+      }
+    }
+    throw e;
+  }
+}
+
+// src/lib/bootstrap-ui.ts
+function sleep3(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+function isAuthorizationShapedError(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current != null && !seen.has(current)) {
+    seen.add(current);
+    if (typeof current === "object") {
+      const record = current;
+      if (record.statusCode === 403) return true;
+      if (typeof record.message === "string" && /403|Forbidden|PermissionDenied|not authorized/i.test(record.message)) return true;
+      current = record.cause;
+      continue;
+    }
+    if (typeof current === "string" && /403|Forbidden|PermissionDenied|not authorized/i.test(current)) return true;
+    break;
+  }
+  return false;
+}
+async function deploySimpleStaceyWithRetry(args) {
+  const maxWaitMs = args.maxWaitMs ?? 3e5;
+  const intervalMs = args.intervalMs ?? 1e4;
+  const deadline = Date.now() + maxWaitMs;
+  for (; ; ) {
+    try {
+      return await deploySimpleStacey({
+        credential: args.credential,
+        endpoint: args.endpoint,
+        repoRoot: args.repoRoot,
+        fieldOverrides: args.fieldOverrides
+      });
+    } catch (error) {
+      if (!isAuthorizationShapedError(error)) throw error;
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) {
+        throw new LocalCliError({
+          code: "BOOTSTRAP_UI_ROLE_PROPAGATION_TIMEOUT",
+          message: "Timed out waiting for Azure role propagation before deploying Simple Stacey.",
+          hint: "Azure role propagation can take a few minutes - re-run 'm8t bootstrap ui' (idempotent).",
+          cause: error
+        });
+      }
+      args.onWait?.("waiting for Azure role propagation...");
+      await sleep3(Math.min(intervalMs, remainingMs));
+    }
+  }
+}
 async function resolveFoundryEndpointWithWait(args, opts = {}) {
   const pollMs = opts.pollMs ?? 1e4;
   const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
   const deadline = Date.now() + timeoutMs;
-  const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
   for (; ; ) {
     try {
       const p = await resolveFoundryProject({
@@ -26598,9 +26746,9 @@ async function serveOnboardingUiDetached(args) {
   child.unref();
   fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep3(500);
+    await sleep4(500);
     if (await isPortOpen()) break;
   }
   return { alreadyRunning: false, logPath };
@@ -26638,9 +26786,9 @@ async function serveOnboardingRelayDetached(args) {
   child.unref();
   fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep3(500);
+    await sleep4(500);
     if (await isLocalPortOpen(portNum)) break;
   }
   return { alreadyRunning: false, logPath };
@@ -26682,55 +26830,21 @@ function stopOnboardingUi(home = os17.homedir()) {
   return uiStopped || relayStopped;
 }
 
-// src/lib/simple-stacey.ts
-var SIMPLE_STACEY_PERSONA = "startup-advisor-intake";
-var SIMPLE_STACEY_AGENT = "stacey-intake";
-async function deploySimpleStacey(args) {
-  try {
-    return await deployPromptAdvisor({
-      credential: args.credential,
-      endpoint: args.endpoint,
-      repoRoot: args.repoRoot,
-      persona: SIMPLE_STACEY_PERSONA,
-      agentName: SIMPLE_STACEY_AGENT,
-      fieldOverrides: args.fieldOverrides
-    });
-  } catch (e) {
-    if (e && typeof e === "object" && "code" in e) {
-      const err = e;
-      if (err.code === "ADVISOR_PERSONA_MISSING") {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: "SIMPLE_STACEY_PERSONA_MISSING",
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
-      if (err.code === "ADVISOR_NO_MODEL") {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: "SIMPLE_STACEY_NO_MODEL",
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
-      if (err.code === "ADVISOR_BAD_EFFORT") {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: "SIMPLE_STACEY_BAD_EFFORT",
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
-    }
-    throw e;
-  }
-}
-
 // src/commands/bootstrap/ui.ts
+function renderDeploySuccess(version, envPath) {
+  return `${colors.success("\u2713")} Simple Stacey is live (stacey-intake v${version}).
+  env: ${envPath}
+  Opening ${colors.field("http://localhost:3000")} in your browser \u2192 Sign in with Microsoft \u2192 chat with Stacey.
+  ${colors.dim("(If it doesn't open, browse to http://localhost:3000 yourself.)")}
+  ${colors.dim("First turn may say 'warming up' for a few minutes while access propagates \u2014 that's expected.")}
+`;
+}
+function renderDeployFailure(error) {
+  const hint = error instanceof LocalCliError && error.hint ? error.hint : "Re-run 'm8t bootstrap ui' (idempotent).";
+  return `${colors.error("\u2717")} Simple Stacey deploy failed: ${error.message}
+  ${colors.hint(hint)}
+`;
+}
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
   static usage = Command53.Usage({
@@ -26810,14 +26924,18 @@ var BootstrapUiCommand = class extends M8tCommand {
     out("granting you Foundry data-plane access\u2026");
     const oid = await getSignedInUserOid();
     await ensureFounderFoundryRole({ credential: credential2, subscriptionId: state.subscriptionId, principalId: oid, accountScope });
-    out("deploying Simple Stacey (stacey-intake)\u2026");
     const identity = await getSignedInUserIdentity();
-    const version = await deploySimpleStacey({
+    out("deploying Simple Stacey (stacey-intake) in the background...");
+    const deployOutcome = deploySimpleStaceyWithRetry({
       credential: credential2,
       endpoint,
       repoRoot,
-      fieldOverrides: { founder_identity_note: composeFounderIdentityNote(identity) }
-    });
+      fieldOverrides: { founder_identity_note: composeFounderIdentityNote(identity) },
+      onWait: out
+    }).then(
+      (version) => ({ ok: true, version }),
+      (error) => ({ ok: false, error: error instanceof Error ? error : new Error(String(error)) })
+    );
     const envPath = writeWebEnvLocal({
       repoRoot,
       tenantId: account.tenantId,
@@ -26828,15 +26946,10 @@ var BootstrapUiCommand = class extends M8tCommand {
       out("installing apps/web dependencies (pnpm)\u2026");
       await installWebDeps(repoRoot);
     }
-    this.context.stdout.write(
-      `${colors.success("\u2713")} Simple Stacey is live (stacey-intake v${version}).
-  env: ${envPath}
-  Opening ${colors.field("http://localhost:3000")} in your browser \u2192 Sign in with Microsoft \u2192 chat with Stacey.
-  ${colors.dim("(If it doesn't open, browse to http://localhost:3000 yourself.)")}
-  ${colors.dim("First turn may say 'warming up' for a few minutes while access propagates \u2014 that's expected.")}
-`
-    );
     if (this.prepOnly === true) {
+      const outcome2 = await deployOutcome;
+      if (!outcome2.ok) throw outcome2.error;
+      this.context.stdout.write(renderDeploySuccess(outcome2.version, envPath));
       this.context.stdout.write(`  ${colors.hint("serve it yourself:")} pnpm --filter web dev
 `);
       return 0;
@@ -26850,6 +26963,12 @@ var BootstrapUiCommand = class extends M8tCommand {
         clientId: state.appRegClientId
       });
       out("voice relay on :8790");
+      const outcome2 = await deployOutcome;
+      if (!outcome2.ok) {
+        this.context.stderr.write(renderDeployFailure(outcome2.error));
+        return 1;
+      }
+      this.context.stdout.write(renderDeploySuccess(outcome2.version, envPath));
       out("starting the webapp on :3000 (Ctrl-C to stop)\u2026");
       await runInherit("pnpm", ["--filter", "web", "dev"], repoRoot, "BOOTSTRAP_UI_DEV_FAILED");
       return 0;
@@ -26877,6 +26996,12 @@ var BootstrapUiCommand = class extends M8tCommand {
       );
     }
     autoOpenOnboardingUi(`http://localhost:${this.port}`);
+    const outcome = await deployOutcome;
+    if (!outcome.ok) {
+      this.context.stderr.write(renderDeployFailure(outcome.error));
+      return 1;
+    }
+    this.context.stdout.write(renderDeploySuccess(outcome.version, envPath));
     return 0;
   }
 };
@@ -26914,7 +27039,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
     const parsedTimeout = Number(rawTimeout);
     const timeoutMin = rawTimeout !== "" && Number.isFinite(parsedTimeout) ? parsedTimeout : 20;
     const deadline = Date.now() + timeoutMin * 6e4;
-    const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
     for (; ; ) {
       const token = await getFoundryToken();
       const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
@@ -26937,7 +27062,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       }
       this.context.stderr.write(`  ${colors.dim("waiting for the questionnaire to complete\u2026")}
 `);
-      await sleep3(2e4);
+      await sleep4(2e4);
     }
   }
 };