@m8t-stack/cli 0.2.22 → 0.2.24

package/README.md

@@ -17,10 +17,10 @@ It's the operator's day-2 tool for the cloud platform — the successor to the o
 npm install -g @m8t-stack/cli
 
 # Homebrew (macOS / Linux)
-brew install m8t-run/tap/m8t
+brew install m8t-labs/tap/m8t
 
 # Scoop (Windows)
-scoop bucket add m8t https://github.com/m8t-run/scoop-bucket
+scoop bucket add m8t https://github.com/m8t-labs/scoop-bucket
 scoop install m8t
 
 # Verify
@@ -115,7 +115,7 @@ Provisions (or updates) the gateway/webapp stack via Bicep — the successor to
 m8t deploy --client-id <appId> --image-ref <acr-or-ghcr-ref> --location <region>
 ```
 
-Key flags: `--client-id <appId>` (reuse an existing app reg + skip **all** Microsoft Graph writes), `--image-ref <ref>` (full image ref; default `ghcr.io/m8t-run/m8t:latest` — pass an `*.azurecr.io/...` ref for ACR images), `--resource-group` (default `rg-m8t-stack`), `--location`, `--suffix`, `--foundry-endpoint`, `--foundry-resource-id`.
+Key flags: `--client-id <appId>` (reuse an existing app reg + skip **all** Microsoft Graph writes), `--image-ref <ref>` (full image ref; default `ghcr.io/m8t-labs/m8t:latest` — pass an `*.azurecr.io/...` ref for ACR images), `--resource-group` (default `rg-m8t-stack`), `--location`, `--suffix`, `--foundry-endpoint`, `--foundry-resource-id`.
 
 > ⚠️ `m8t deploy` is **declarative** — it makes the live stack match the Bicep template. If a deployment was hand-modified after provisioning (e.g. switched to a private-ACR image with a UserAssigned pull identity), re-running the bicep can revert those changes. **Preview with `az deployment group create --what-if` before applying against a live stack.**
 

package/dist/cli.js

@@ -1231,7 +1231,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.22";
+var CLI_VERSION = "0.2.24";
 
 // src/lib/render-error.ts
 init_errors();
@@ -11481,6 +11481,31 @@ import { DefaultAzureCredential } from "@azure/identity";
 // src/lib/az.ts
 init_errors();
 import { spawn } from "child_process";
+var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
+var SECRET_KEY_RE = /(pem|secret|token|password|passwd|pwd|credential|private[-_]?key)/i;
+function redactAzArgs(args) {
+  const out = [];
+  let secretFlagActive = false;
+  for (const arg of args) {
+    if (arg.startsWith("-")) {
+      secretFlagActive = SECRET_VALUE_FLAGS.has(arg);
+      out.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const key2 = eq > 0 ? arg.slice(0, eq) : "";
+    if (secretFlagActive) {
+      out.push(key2 ? `${key2}=[REDACTED]` : "[REDACTED]");
+      continue;
+    }
+    if (key2 && SECRET_KEY_RE.test(key2)) {
+      out.push(`${key2}=[REDACTED]`);
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
 function runAz(args) {
   return new Promise((resolve3, reject) => {
     const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -11517,7 +11542,7 @@ function runAz(args) {
         reject(
           new LocalCliError({
             code: "AZ_COMMAND_FAILED",
-            message: `'az ${args.join(" ")}' failed: ${errString.trim()}`
+            message: `'az ${redactAzArgs(args).join(" ")}' failed: ${errString.trim()}`
           })
         );
         return;
@@ -14272,6 +14297,14 @@ function run(cmd, cmdArgs, cwd, env) {
     c.stderr.on("data", (d) => {
       err += d.toString();
     });
+    c.on("error", (e) => {
+      reject(
+        new LocalCliError({
+          code: "GH_APP_PUSH_FAILED",
+          message: `${cmd} ${cmdArgs.join(" ")} could not run: ${e.message}`
+        })
+      );
+    });
     c.on("close", (code) => {
       if (code === 0) {
         resolve3();
@@ -14602,6 +14635,19 @@ async function promptCollision(ctx, info) {
     rl.close();
   }
 }
+function resolveScaffoldCommit(repoRoot, env) {
+  const baked = env.M8T_BUILD_SHA?.trim();
+  if (baked) return baked;
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || "(scaffold)";
+  } catch {
+    return "(scaffold)";
+  }
+}
 function stageAsGitRepo(dir) {
   const steps = [
     { args: ["init", "-b", "main"], label: "git init" },
@@ -14745,7 +14791,7 @@ var BrainCreateCommand = class extends M8tCommand {
       if (needsPush) {
         materializeBrainTree({ templateSrc, destDir: tmpDir, seedDir });
         if (seedName && seedDir) {
-          const headSha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: repoRoot, encoding: "utf8" }).trim();
+          const headSha = resolveScaffoldCommit(repoRoot, env);
           writeSeedMarker({ destDir: tmpDir, seedName, seedDir, refreshedToCommit: headSha, version: "(scaffold)" });
         }
         this.context.stdout.write(
@@ -16900,7 +16946,7 @@ var SIZE_PRESETS = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_REGISTRY = "ghcr.io/m8t-run";
+var DEFAULT_REGISTRY = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE = "m8t-coding-agent";
 var DEFAULT_TAG = "v0.1.0";
 var DEFAULT_MODEL = "gpt-4.1-mini";
@@ -16909,7 +16955,7 @@ var CoderDeployCommand = class extends M8tCommand {
   static paths = [["coder", "deploy"]];
   static usage = Command28.Usage({
     description: "Deploy the curated coding agent as a hosted Foundry worker.",
-    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
     examples: [
       ["Deploy a coder with defaults", "$0 coder deploy my-coder"],
       ["Larger sandbox + a custom model", "$0 coder deploy my-coder --size large --model-deployment gpt-4.1"],
@@ -17296,7 +17342,7 @@ var SIZE_PRESETS2 = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_REGISTRY2 = "ghcr.io/m8t-run";
+var DEFAULT_REGISTRY2 = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE2 = "m8t-azure-executor";
 var DEFAULT_TAG2 = "v0.1.0";
 var DEFAULT_MODEL2 = "gpt-5-mini";
@@ -17305,11 +17351,11 @@ var AzureExecDeployCommand = class extends M8tCommand {
   static paths = [["azure-exec", "deploy"]];
   static usage = Command30.Usage({
     description: "Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).",
-    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-run/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-labs/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
     examples: [
       [
         "Deploy scoped to a resource group",
-        "$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-run/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp"
+        "$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-labs/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp"
       ]
     ]
   });
@@ -17341,7 +17387,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       throw new LocalCliError({
         code: "USAGE",
         message: "--brain owner/repo is required (the executor delivers proof to a brain).",
-        hint: "Example: --brain m8t-run/azure-exec-smoke-brain"
+        hint: "Example: --brain m8t-labs/azure-exec-smoke-brain"
       });
     }
     const size = (this.size ?? "large").toLowerCase();
@@ -17573,7 +17619,7 @@ import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/ident
 
 // src/lib/platform-update.ts
 init_errors();
-var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-run/m8t";
+var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-labs/m8t";
 function parseImageRef2(ref) {
   const lastColon = ref.lastIndexOf(":");
   const lastSlash = ref.lastIndexOf("/");
@@ -17806,13 +17852,13 @@ function entityToStamp(e) {
 }
 
 // ../../packages/platform-release/dist/esm/channel-url.js
-var CHANNEL_LATEST_URL = "https://github.com/m8t-run/m8t/releases/latest/download/manifest.json";
+var CHANNEL_LATEST_URL = "https://github.com/m8t-labs/m8t/releases/latest/download/manifest.json";
 function platformTag(version) {
   const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
   return `platform-v${bare}`;
 }
 function channelUrlForVersion(version) {
-  return `https://github.com/m8t-run/m8t/releases/download/${platformTag(version)}/manifest.json`;
+  return `https://github.com/m8t-labs/m8t/releases/download/${platformTag(version)}/manifest.json`;
 }
 
 // ../../packages/platform-release/dist/esm/apply-request.js
@@ -17902,7 +17948,7 @@ import * as os8 from "os";
 import * as path19 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 init_errors();
-var OWNER_REPO = "m8t-run/m8t";
+var OWNER_REPO = "m8t-labs/m8t";
 function parseTreeResponse(body) {
   const map = /* @__PURE__ */ new Map();
   for (const e of body.tree ?? []) if (e.type === "tree") map.set(e.path, e.sha);
@@ -20750,7 +20796,7 @@ function classifyWhatIf(changes) {
 }
 
 // src/commands/deploy.ts
-var DEFAULT_IMAGE_REF = "ghcr.io/m8t-run/m8t:latest";
+var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
   static usage = Command36.Usage({
@@ -21151,7 +21197,7 @@ function resolveJudgeDeployment(flag, env) {
     warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run (DESIGN \xA75.5)."
   };
 }
-var BRAIN_REPO_MARKERS = ["m8t-run/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
+var BRAIN_REPO_MARKERS = ["m8t-labs/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
 function assertOutNotInBrainRepo(out) {
   if (BRAIN_REPO_MARKERS.some((m) => out.includes(m))) {
     throw new LocalCliError({
@@ -25363,6 +25409,7 @@ init_errors();
 
 // src/lib/bootstrap-mi.ts
 var INSTALLER_GRANT_DESCRIPTION = "m8t-installer auto-reap (bootstrap)";
+var GATEWAY_SUBSCOPE_GRANT_DESCRIPTION = "m8t-gateway auto-reap (bootstrap)";
 async function ensureResourceGroup2(opts) {
   const existing = (await runAz(["group", "show", "--name", opts.name, "--subscription", opts.subscriptionId, "-o", "json"]).catch(() => "")).trim();
   if (existing) return;
@@ -25605,8 +25652,8 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
-var DEFAULT_INSTALLER = "ghcr.io/m8t-run/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.0";
+var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
+var DEFAULT_INSTALLER_TAG = "v0.1.31";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25617,7 +25664,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.0"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.31"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.31"]
     ]
   });
   location = Option46.String("--location");
@@ -25625,6 +25673,10 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   clientId = Option46.String("--client-id");
   subscription = Option46.String("--subscription");
   installerTag = Option46.String("--installer-tag");
+  // Full image ref override (registry + repo + tag) — an escape hatch when the
+  // default org/tag is wrong for the current CLI (e.g. a stale published build).
+  // Wins over --installer-tag / the pinned default.
+  installerImage = Option46.String("--installer-image");
   gatewayImageRef = Option46.String("--gateway-image-ref");
   githubAppCreds = Option46.String("--github-app-creds");
   async executeCommand() {
@@ -25635,6 +25687,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? DEFAULT_RG;
     const clientIdOpt = typeof this.clientId === "string" ? this.clientId : void 0;
     const installerTag = (typeof this.installerTag === "string" ? this.installerTag : void 0) ?? DEFAULT_INSTALLER_TAG;
+    const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
+    const installerImage = installerImageOverride ?? `${DEFAULT_INSTALLER}:${installerTag}`;
     const gatewayImageRef = typeof this.gatewayImageRef === "string" ? this.gatewayImageRef : void 0;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -25685,10 +25739,24 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     out("granting Owner at subscription scope\u2026");
     await grantOwnerAtSubscription({ principalId: mi.principalId, subscriptionId });
     const roleAssignmentIds = await listAssignmentIds({ principalId: mi.principalId, subscriptionId });
+    const saName = deriveStatusSaName(resourceGroup, subscriptionId);
+    await writeBootstrapState({
+      subscriptionId,
+      resourceGroup,
+      location,
+      aciName: ACI_NAME,
+      miName: MI_NAME,
+      miClientId: mi.clientId,
+      miPrincipalId: mi.principalId,
+      roleAssignmentIds,
+      appRegClientId: appReg.clientId,
+      statusSaName: saName,
+      statusBlobUrl: statusBlobUrl(saName),
+      installerTag
+    });
     out("waiting for the installer identity to be usable (role propagation)\u2026");
     const miReady = await waitForMiToken({ clientId: mi.clientId, subscriptionId, onProgress: out });
     if (!miReady) out("identity not confirmed yet \u2014 launching anyway (the installer retries its own login)");
-    const saName = deriveStatusSaName(resourceGroup, subscriptionId);
     out("launching the cloud installer (ACI)\u2026");
     await kickInstaller({
       aciName: ACI_NAME,
@@ -25698,25 +25766,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       miResourceId: mi.resourceId,
       miClientId: mi.clientId,
       appRegClientId: appReg.clientId,
-      image: `${DEFAULT_INSTALLER}:${installerTag}`,
+      image: installerImage,
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp
     });
-    await writeBootstrapState({
-      subscriptionId,
-      resourceGroup,
-      location,
-      aciName: ACI_NAME,
-      miName: MI_NAME,
-      miClientId: mi.clientId,
-      miPrincipalId: mi.principalId,
-      roleAssignmentIds,
-      appRegClientId: appReg.clientId,
-      statusSaName: saName,
-      statusBlobUrl: statusBlobUrl(saName),
-      installerTag
-    });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
   ${colors.hint("next:")} m8t bootstrap status --watch   ${colors.dim("# watch the install to done")}
@@ -25837,35 +25891,53 @@ init_errors();
 
 // src/lib/bootstrap-reap.ts
 var ROLE_ASSIGNMENT_API = "2022-04-01";
-async function sweepOrphanOwnerAssignments(opts) {
-  const subScope = `/subscriptions/${opts.subscriptionId}`;
-  const all = JSON.parse(
+var GATEWAY_SUBSCOPE_ROLES = ["Cost Management Reader", "Monitoring Reader"];
+async function listSubscriptionAssignments(subscriptionId) {
+  return JSON.parse(
     await runAz([
       "role",
       "assignment",
       "list",
       "--all",
       "--subscription",
-      opts.subscriptionId,
+      subscriptionId,
       "-o",
       "json"
     ]).catch(() => "[]") || "[]"
   );
+}
+async function deleteAssignmentsById(ids) {
+  for (const id of ids) {
+    await runAz([
+      "rest",
+      "--method",
+      "delete",
+      "--url",
+      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
+    ]).catch(() => void 0);
+  }
+}
+async function sweepOrphanGatewaySubRoles(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
+  const matched = all.filter((r) => {
+    if (r.principalName) return false;
+    if (r.principalType !== "ServicePrincipal") return false;
+    if (r.scope !== subScope) return false;
+    if (r.description === GATEWAY_SUBSCOPE_GRANT_DESCRIPTION) return true;
+    return GATEWAY_SUBSCOPE_ROLES.includes(r.roleDefinitionName ?? "");
+  });
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
+  return matched.map((r) => ({ id: r.id, description: r.description, roleDefinitionName: r.roleDefinitionName, createdOn: r.createdOn }));
+}
+async function sweepOrphanOwnerAssignments(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
   const matched = all.filter((r) => {
     if (r.description === INSTALLER_GRANT_DESCRIPTION) return true;
     return !r.principalName && r.principalType === "ServicePrincipal" && r.roleDefinitionName === "Owner" && r.scope === subScope;
   });
-  if (opts.execute) {
-    for (const r of matched) {
-      await runAz([
-        "rest",
-        "--method",
-        "delete",
-        "--url",
-        `https://management.azure.com${r.id}?api-version=${ROLE_ASSIGNMENT_API}`
-      ]).catch(() => void 0);
-    }
-  }
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
   return matched.map((r) => ({ id: r.id, description: r.description, createdOn: r.createdOn }));
 }
 async function reapInstaller(opts) {
@@ -25922,46 +25994,75 @@ var BootstrapReapCommand = class extends M8tCommand {
       if (!sub) {
         throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
       }
-      const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: this.yes === true });
-      if (found.length === 0) {
-        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub assignments found.
+      const execute = this.yes === true;
+      const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute });
+      const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute });
+      const total = owner.length + gateway.length;
+      if (total === 0) {
+        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub or gateway sub-scope assignments found.
 `);
         return 0;
       }
-      for (const f of found) {
-        this.context.stdout.write(`  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+      for (const f of owner) {
+        this.context.stdout.write(`  ${colors.dim("Owner@sub")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+`);
+      }
+      for (const f of gateway) {
+        this.context.stdout.write(`  ${colors.dim(f.roleDefinitionName ?? "gateway sub-scope")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
 `);
       }
-      if (this.yes === true) {
-        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(found.length)} orphaned Owner@sub assignment(s).
+      const breakdown = `${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope`;
+      if (execute) {
+        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(total)} orphaned assignment(s) (${breakdown}).
 `);
       } else {
         this.context.stdout.write(`
-Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
+Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
 `);
       }
       return 0;
     }
     const state = await readBootstrapState();
     if (!state) {
-      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state to reap.", hint: "Nothing to do." });
+      if (this.force === true) {
+        const { subscriptionId: sub } = await getAzAccount();
+        if (!sub) {
+          throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
+        }
+        const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute: true });
+        const total = owner.length + gateway.length;
+        this.context.stdout.write(
+          total === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub or gateway sub-scope assignments. Nothing to reap.
+` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(total)} orphaned assignment(s) (${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope).
+`
+        );
+        return 0;
+      }
+      throw new LocalCliError({
+        code: "BOOTSTRAP_NO_STATE",
+        message: "No bootstrap state to reap.",
+        hint: "Nothing to do. If a launch failed and its RG was deleted it may have orphaned an installer Owner@sub grant or the gateway's sub-scope reader roles \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean them."
+      });
     }
-    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-    if (doc.status !== "done" && !(this.force === true)) {
-      if (doc.status === "failed") {
+    if (this.force !== true) {
+      const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+      if (doc.status !== "done") {
+        if (doc.status === "failed") {
+          throw new LocalCliError({
+            code: "BOOTSTRAP_REAP_FAILED_INSTALL",
+            message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
+            hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          });
+        }
+        const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
+        const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
         throw new LocalCliError({
-          code: "BOOTSTRAP_REAP_FAILED_INSTALL",
-          message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
-          hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          code: "BOOTSTRAP_REAP_NOT_DONE",
+          message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
+          hint: deadHint
         });
       }
-      const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
-      const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
-      throw new LocalCliError({
-        code: "BOOTSTRAP_REAP_NOT_DONE",
-        message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
-        hint: deadHint
-      });
     }
     await reapInstaller({
       subscriptionId: state.subscriptionId,