@m8t-stack/cli 0.2.4 → 0.2.5

package/dist/cli.js

@@ -1139,7 +1139,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.4";
+var CLI_VERSION = "0.2.5";
 
 // src/lib/render-error.ts
 init_errors();
@@ -2219,10 +2219,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path27 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path28 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path27 },
+      { method: "GET", path: path28 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -4039,6 +4039,7 @@ function materializeBrainTree(opts) {
 
 // src/lib/github-app-repo.ts
 init_errors();
+init_esm2();
 import { spawn as spawn3 } from "child_process";
 async function createBlankRepo(args) {
   const res = await fetch(`https://api.github.com/orgs/${args.org}/repos`, {
@@ -4097,6 +4098,79 @@ async function pushSeed(args) {
   await run("git", ["remote", "add", "origin", remote], args.sourceDir, env);
   await run("git", ["push", "-q", "origin", args.branch], args.sourceDir, env);
 }
+var GH_API = "https://api.github.com";
+var GH_REQUEST_TIMEOUT_MS = 3e4;
+function ghHeaders(token, scheme = "token") {
+  return {
+    Authorization: `${scheme} ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "m8t",
+    "Content-Type": "application/json"
+  };
+}
+async function mintInstallationTokenFromPem(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const jwt = signAppJwt({ appId: args.appId, privateKeyPem: args.privateKeyPem });
+  const res = await doFetch(`${GH_API}/app/installations/${args.installationId}/access_tokens`, {
+    method: "POST",
+    headers: ghHeaders(jwt, "Bearer"),
+    signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS)
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new LocalCliError({
+      code: "GH_APP_TOKEN_MINT_FAILED",
+      message: `POST /app/installations/${args.installationId}/access_tokens HTTP ${res.status.toString()}: ${text.slice(0, 300)}`
+    });
+  }
+  return JSON.parse(text).token;
+}
+async function readRepoFileViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/contents/${args.path}`, { headers: ghHeaders(args.token), signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+  if (res.status === 404) return null;
+  const text = await res.text();
+  if (!res.ok) {
+    throw new LocalCliError({
+      code: "GH_APP_FILE_READ_FAILED",
+      message: `GET /repos/${args.repo}/contents/${args.path} HTTP ${res.status.toString()}: ${text.slice(0, 300)}`
+    });
+  }
+  const data = JSON.parse(text);
+  return Buffer.from(data.content ?? "", "base64").toString("utf8");
+}
+async function commitFilesViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const H = ghHeaders(args.token);
+  const api = async (p, init) => {
+    const res = await doFetch(`${GH_API}/repos/${args.repo}${p}`, init ? { ...init, headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) } : { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+    const text = await res.text();
+    if (!res.ok) {
+      throw new LocalCliError({
+        code: "GH_APP_COMMIT_FAILED",
+        message: `${init?.method ?? "GET"} ${p} HTTP ${res.status.toString()}: ${text.slice(0, 300)}`
+      });
+    }
+    return text ? JSON.parse(text) : {};
+  };
+  const ref = await api(`/git/ref/heads/${args.branch}`);
+  const baseCommitSha = ref.object.sha;
+  const baseCommit = await api(`/git/commits/${baseCommitSha}`);
+  const blobs = await Promise.all(args.files.map((f) => api(`/git/blobs`, { method: "POST", body: JSON.stringify({ content: f.content, encoding: "utf-8" }) })));
+  const tree = await api(`/git/trees`, {
+    method: "POST",
+    body: JSON.stringify({
+      base_tree: baseCommit.tree.sha,
+      tree: args.files.map((f, i) => ({ path: f.path, mode: "100644", type: "blob", sha: blobs[i].sha }))
+    })
+  });
+  const commit = await api(`/git/commits`, {
+    method: "POST",
+    body: JSON.stringify({ message: args.message, tree: tree.sha, parents: [baseCommitSha] })
+  });
+  await api(`/git/refs/heads/${args.branch}`, { method: "PATCH", body: JSON.stringify({ sha: commit.sha }) });
+}
 
 // src/commands/brain/create.ts
 function stageAsGitRepo(dir) {
@@ -7035,8 +7109,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path27 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path27}:pull`);
+  const path28 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path28}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -7052,7 +7126,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path27}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path28}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -7717,9 +7791,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path27 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path27));
-    else out.push({ ...d, path: path27 });
+    const path28 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path28));
+    else out.push({ ...d, path: path28 });
   }
   return out;
 }
@@ -10149,7 +10223,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path27) => WRITER_ALLOWED_PREFIX.test(path27) && !path27.split("/").includes("..");
+var isAllowedWritePath = (path28) => WRITER_ALLOWED_PREFIX.test(path28) && !path28.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\n([\s\S]*?)\n---/.exec(content);
@@ -10188,8 +10262,8 @@ function parseFrontmatter(content) {
 function makeGitDataWriter(args) {
   const doFetch = args.fetchImpl ?? fetch;
   const repoPath = args.repository;
-  async function gh(token, method, path27, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path27}`, {
+  async function gh(token, method, path28, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path28}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -10202,8 +10276,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path27) {
-    const encodedPath = path27.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path28) {
+    const encodedPath = path28.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -10219,9 +10293,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path27) {
+    async readFile(path28) {
       const token = await args.mintToken();
-      return readFileWith(token, path27);
+      return readFileWith(token, path28);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -10230,9 +10304,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path27 of paths) {
-        const content = await readFileWith(token, path27);
-        out.push({ path: path27, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path28 of paths) {
+        const content = await readFileWith(token, path28);
+        out.push({ path: path28, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -10669,7 +10743,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path27) => originByPath.get(path27) ?? "worker"
+    originOf: (path28) => originByPath.get(path28) ?? "worker"
   };
 }
 
@@ -10690,14 +10764,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path27, message) {
+  constructor(path28, message) {
     super(message);
-    this.path = path27;
+    this.path = path28;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path27) => /(^|\/)[^/]*_index\.md$/.test(path27);
-var isMemoryIndex = (path27) => path27 === "memory/MEMORY.md";
+var isIndexFile = (path28) => /(^|\/)[^/]*_index\.md$/.test(path28);
+var isMemoryIndex = (path28) => path28 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -10714,29 +10788,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path27 = targetPath(delta);
-  if (path27 === null)
+  const path28 = targetPath(delta);
+  if (path28 === null)
     return { ok: true };
-  if (isIndexFile(path27) && !isMemoryIndex(path27)) {
-    return { ok: false, flagged: { kind: "flagged", path: path27, tension: `refused: ${path27} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path28) && !isMemoryIndex(path28)) {
+    return { ok: false, flagged: { kind: "flagged", path: path28, tension: `refused: ${path28} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path27);
-  const isStructural = path27.startsWith("references/");
+  const target = await lookup(path28);
+  const isStructural = path28.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path27, `supersede/retract OLD target ${path27} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path28, `supersede/retract OLD target ${path28} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path27, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path28, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path27) => path27.split("/").includes("..");
+var hasTraversal = (path28) => path28.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -10843,7 +10917,7 @@ ${inject}
 ---
 `);
 }
-var indexLine = (path27, title, date, tags) => `- \`${path27}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path28, title, date, tags) => `- \`${path28}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -11016,16 +11090,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path27) => Promise.resolve(mem.files.find((f) => f.path === path27) ?? null);
+      const lookup = (path28) => Promise.resolve(mem.files.find((f) => f.path === path28) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path27 = checkPathAllowed(delta);
-          if (!path27.ok) {
-            digest.push(path27.rejected);
+          const path28 = checkPathAllowed(delta);
+          if (!path28.ok) {
+            digest.push(path28.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -12686,10 +12760,189 @@ var BootstrapReapCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/finish.ts
 import * as fs24 from "fs/promises";
+import * as os14 from "os";
+import * as path25 from "path";
+import { Command as Command48, Option as Option46 } from "clipanion";
+init_errors();
+
+// src/lib/company-profile-seed.ts
+import { spawn as spawn6 } from "child_process";
+import { closeSync, openSync, readFileSync as readFileSync16 } from "fs";
 import * as os13 from "os";
 import * as path24 from "path";
-import { Command as Command48, Option as Option46 } from "clipanion";
 init_errors();
+
+// src/lib/onboarding-profile.ts
+var COMPANY_PROFILE_PATH = "memory/company-profile.md";
+var DEFAULT_MEMORY_INDEX_HEADER = [
+  `# Memory index`,
+  ``,
+  `> Your memories, newest first. The summary on each line is usually enough to answer \u2014 open the linked file only when you need full detail. Each path is repo-root; copy it verbatim, never invent one.`,
+  ``
+].join("\n");
+function parseOnboardingBlock(text) {
+  const candidates = [
+    ...[...text.matchAll(/```(?:json)?\s*([\s\S]*?)```/g)].map((m) => m[1]),
+    text
+  ].reverse();
+  for (const c of candidates) {
+    try {
+      const o = JSON.parse(c.trim()).m8t_onboarding;
+      if (o?.company_stage && o.context) return o;
+    } catch {
+    }
+  }
+  return null;
+}
+async function safeJson(res) {
+  try {
+    const t = await res.text();
+    return t ? JSON.parse(t) : null;
+  } catch {
+    return null;
+  }
+}
+async function findOnboardingProfile(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const H = { Authorization: `Bearer ${args.token}` };
+  const listRes = await doFetch(`${args.endpoint}/conversations?api-version=v1&order=desc&limit=20`, { headers: H });
+  const list = await safeJson(listRes);
+  const convs = (list?.data ?? []).filter((c) => c.metadata?.agent === "stacey-intake");
+  for (const conv of convs) {
+    const itemsRes = await doFetch(`${args.endpoint}/conversations/${conv.id}/items?api-version=v1`, { headers: H });
+    const items = await safeJson(itemsRes);
+    const text = (items?.data ?? []).flatMap((m) => (m.content ?? []).map((c) => c.text ?? "")).join("\n");
+    const block = parseOnboardingBlock(text);
+    if (block) return { hadIntake: true, block };
+  }
+  return { hadIntake: convs.length > 0, block: null };
+}
+function renderCompanyProfile(block, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  const dash = (v) => v?.trim() ? v.trim() : "\u2014";
+  const profileMd = [
+    `---`,
+    `type: memory`,
+    `title: Company profile`,
+    `created: ${now}`,
+    `updated: ${now}`,
+    `tags: [company-profile, onboarding, founder]`,
+    `origin: operator`,
+    `---`,
+    ``,
+    `# Company profile`,
+    ``,
+    `_Seeded from the onboarding questionnaire._`,
+    ``,
+    `- **Stage:** ${dash(block.company_stage)}`,
+    `- **ICP:** ${dash(block.icp)}`,
+    `- **Industry:** ${dash(block.industry)}`,
+    `- **Team size:** ${dash(block.team_size)}`,
+    ``,
+    `## Context`,
+    ``,
+    block.context.trim(),
+    ``
+  ].join("\n");
+  const bits = [block.company_stage.trim(), block.industry?.trim(), block.icp?.trim() ? `ICP ${block.icp.trim()}` : void 0].filter(Boolean).join(" \xB7 ");
+  const memoryIndexLine = `- \`${COMPANY_PROFILE_PATH}\` \u2014 **Company profile**: ${bits}. (seeded from onboarding)`;
+  return { profileMd, memoryIndexLine };
+}
+function upsertMemoryIndex(existing, line2) {
+  const lines = existing.split("\n");
+  const existingIdx = lines.findIndex((l) => l.includes(`\`${COMPANY_PROFILE_PATH}\``));
+  if (existingIdx >= 0) {
+    lines[existingIdx] = line2;
+    return lines.join("\n");
+  }
+  const firstItemIdx = lines.findIndex((l) => /^-\s+`memory\//.test(l));
+  if (firstItemIdx >= 0) {
+    lines.splice(firstItemIdx, 0, line2);
+    return lines.join("\n");
+  }
+  return existing.replace(/\s*$/, "\n\n") + line2 + "\n";
+}
+
+// src/lib/company-profile-seed.ts
+function readGithubAppCreds(credsPath) {
+  const p = credsPath ?? path24.join(os13.homedir(), ".m8t-stack", "github-app.json");
+  try {
+    return JSON.parse(readFileSync16(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function resolveSeedContext(opts) {
+  const appCreds = opts.appCredsOverride ?? readGithubAppCreds(opts.credsPath);
+  if (!appCreds) return null;
+  let endpoint = opts.endpointOverride;
+  if (!endpoint) {
+    const state = await readBootstrapState();
+    if (!state) {
+      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state found.", hint: "Run 'm8t bootstrap launch' first, or pass --endpoint." });
+    }
+    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+    endpoint = doc.result?.foundryEndpoint;
+    if (!endpoint) {
+      throw new LocalCliError({ code: "SEED_NO_ENDPOINT", message: "Could not resolve the Foundry endpoint from the install status.", hint: "Pass --endpoint <foundryEndpoint>." });
+    }
+  }
+  return { endpoint, brainRepo: opts.brainOverride ?? `${appCreds.org}/stacey-brain`, appCreds };
+}
+async function applyProfileToBrain(args) {
+  const token = await mintInstallationTokenFromPem({
+    appId: args.appCreds.appId,
+    privateKeyPem: readFileSync16(args.appCreds.pemPath, "utf8"),
+    installationId: args.appCreds.installationId,
+    fetchImpl: args.fetchImpl
+  });
+  const { profileMd, memoryIndexLine } = renderCompanyProfile(args.block, args.now);
+  const existingIndex = await readRepoFileViaApp({ token, repo: args.brainRepo, path: "memory/MEMORY.md", fetchImpl: args.fetchImpl }) ?? DEFAULT_MEMORY_INDEX_HEADER;
+  await commitFilesViaApp({
+    token,
+    repo: args.brainRepo,
+    branch: args.branch,
+    message: "seed(brain): company profile from onboarding questionnaire",
+    files: [
+      { path: COMPANY_PROFILE_PATH, content: profileMd },
+      { path: "memory/MEMORY.md", content: upsertMemoryIndex(existingIndex, memoryIndexLine) }
+    ],
+    fetchImpl: args.fetchImpl
+  });
+}
+function spawnDetachedSeedWatch() {
+  const logPath = path24.join(os13.homedir(), ".m8t-stack", "seed-profile.log");
+  const fd = openSync(logPath, "a");
+  try {
+    const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
+      detached: true,
+      stdio: ["ignore", fd, fd]
+    });
+    child.unref();
+  } finally {
+    closeSync(fd);
+  }
+}
+async function reactiveSeedOnFinish(args) {
+  const ctx = await resolveSeedContext({ endpointOverride: args.endpoint, appCredsOverride: args.appCredsOverride });
+  if (!ctx) return;
+  const token = await (args.getFoundryTokenImpl ?? getFoundryToken)();
+  const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token, fetchImpl: args.fetchImpl });
+  if (block) {
+    await applyProfileToBrain({ block, brainRepo: ctx.brainRepo, branch: "main", appCreds: ctx.appCreds, fetchImpl: args.fetchImpl });
+    args.stdout(`${colors.success("\u2713")} Clever Stacey now knows your company (seeded ${ctx.brainRepo}).
+`);
+    return;
+  }
+  if (!hadIntake) return;
+  (args.spawnWatch ?? spawnDetachedSeedWatch)();
+  args.stdout(
+    `${colors.dim("\u2139 Stacey will pick up your company profile when you finish the questionnaire (watching in the background).")}
+  ${colors.hint("or run:")} m8t bootstrap seed-profile
+`
+  );
+}
+
+// src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
   static usage = Command48.Usage({
@@ -12713,9 +12966,9 @@ var BootstrapFinishCommand = class extends M8tCommand {
       });
     }
     const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
-    const markerDir = path24.join(os13.homedir(), ".m8t-stack");
+    const markerDir = path25.join(os14.homedir(), ".m8t-stack");
     await fs24.mkdir(markerDir, { recursive: true });
-    await fs24.writeFile(path24.join(markerDir, "repo-root"), `${repoRoot}
+    await fs24.writeFile(path25.join(markerDir, "repo-root"), `${repoRoot}
 `, "utf8");
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? state.subscriptionId;
     const d = await discoverGateway({ subscriptionId, interactive: false });
@@ -12739,14 +12992,25 @@ ${colors.field("Finish wiring your coding agent:")}
 ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP servers load only on a fresh start.
 `
     );
+    try {
+      await reactiveSeedOnFinish({
+        endpoint: doc.result?.foundryEndpoint,
+        stdout: (s) => this.context.stdout.write(s)
+      });
+    } catch (e) {
+      this.context.stderr.write(
+        `  ${colors.dim(`(company-profile seed deferred: ${e instanceof Error ? e.message : String(e)} \u2014 run 'm8t bootstrap seed-profile' later)`)}
+`
+      );
+    }
     return 0;
   }
 };
 
 // src/commands/bootstrap/ui.ts
 import * as fs26 from "fs";
-import * as os15 from "os";
-import * as path26 from "path";
+import * as os16 from "os";
+import * as path27 from "path";
 import { Command as Command49, Option as Option47 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
 init_errors();
@@ -12754,9 +13018,9 @@ init_errors();
 // src/lib/bootstrap-ui.ts
 import * as fs25 from "fs";
 import * as net from "net";
-import * as os14 from "os";
-import * as path25 from "path";
-import { spawn as spawn6 } from "child_process";
+import * as os15 from "os";
+import * as path26 from "path";
+import { spawn as spawn7 } from "child_process";
 init_errors();
 init_rbac();
 async function resolveFoundryEndpointWithWait(args, opts = {}) {
@@ -12814,7 +13078,7 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path25.join(args.repoRoot, "apps", "web", ".env.local");
+  const envPath = path26.join(args.repoRoot, "apps", "web", ".env.local");
   if (fs25.existsSync(envPath)) {
     fs25.copyFileSync(envPath, envPath + ".bak");
   }
@@ -12845,7 +13109,7 @@ function assertNodeVersion(versionString = process.version) {
 }
 function runInherit(cmd, cmdArgs, cwd, failCode) {
   return new Promise((resolve3, reject) => {
-    const child = spawn6(cmd, cmdArgs, { cwd, stdio: "inherit", shell: process.platform === "win32" });
+    const child = spawn7(cmd, cmdArgs, { cwd, stdio: "inherit", shell: process.platform === "win32" });
     child.on("error", (e) => {
       reject(new LocalCliError({ code: failCode, message: `Failed to start '${cmd}': ${e.message}` }));
     });
@@ -12871,11 +13135,11 @@ async function installWebDeps(repoRoot) {
   });
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
-function onboardingUiPaths(home = os14.homedir()) {
-  const dir = path25.join(home, ".m8t-stack");
+function onboardingUiPaths(home = os15.homedir()) {
+  const dir = path26.join(home, ".m8t-stack");
   return {
-    logPath: path25.join(dir, "onboarding-ui.log"),
-    pidPath: path25.join(dir, "onboarding-ui.pid")
+    logPath: path26.join(dir, "onboarding-ui.log"),
+    pidPath: path26.join(dir, "onboarding-ui.pid")
   };
 }
 async function serveOnboardingUiDetached(args) {
@@ -12899,9 +13163,9 @@ async function serveOnboardingUiDetached(args) {
   if (await isPortOpen()) {
     return { alreadyRunning: true, logPath };
   }
-  fs25.mkdirSync(path25.dirname(logPath), { recursive: true });
+  fs25.mkdirSync(path26.dirname(logPath), { recursive: true });
   const fd = fs25.openSync(logPath, "a");
-  const child = spawn6("pnpm", ["--filter", "web", "dev"], {
+  const child = spawn7("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
     stdio: ["ignore", fd, fd],
@@ -12926,7 +13190,7 @@ async function serveOnboardingUiDetached(args) {
   }
   return { alreadyRunning: false, logPath };
 }
-function stopOnboardingUi(home = os14.homedir()) {
+function stopOnboardingUi(home = os15.homedir()) {
   const { pidPath } = onboardingUiPaths(home);
   let pidStr;
   try {
@@ -13058,7 +13322,7 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs26.existsSync(path26.join(os15.homedir(), ".m8t-stack", "config.yaml"))) {
+    if (fs26.existsSync(path27.join(os16.homedir(), ".m8t-stack", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t-stack/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
     const credential2 = new DefaultAzureCredential17();
@@ -13123,6 +13387,64 @@ var BootstrapUiCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/bootstrap/seed-profile.ts
+import { Command as Command50, Option as Option48 } from "clipanion";
+var BootstrapSeedProfileCommand = class extends M8tCommand {
+  static paths = [["bootstrap", "seed-profile"]];
+  static usage = Command50.Usage({
+    description: "Seed Clever Stacey's brain with the company profile from the onboarding questionnaire.",
+    details: "Reads the latest stacey-intake conversation, renders memory/company-profile.md (+ its MEMORY.md index line), and commits both to <org>/stacey-brain via the GitHub App. Idempotent. --watch polls until the founder completes the questionnaire.",
+    examples: [
+      ["Seed now (idempotent)", "$0 bootstrap seed-profile"],
+      ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
+    ]
+  });
+  endpoint = Option48.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option48.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
+  watch = Option48.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
+  timeout = Option48.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option48.String("--github-app-creds");
+  async executeCommand() {
+    const ctx = await resolveSeedContext({
+      endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
+      brainOverride: typeof this.brain === "string" ? this.brain : void 0,
+      credsPath: typeof this.githubAppCreds === "string" ? this.githubAppCreds : void 0
+    });
+    if (!ctx) {
+      this.context.stderr.write(`  ${colors.dim("no GitHub App creds (~/.m8t-stack/github-app.json) \u2014 no brain to seed; skipping.")}
+`);
+      return 0;
+    }
+    const watch = this.watch === true;
+    const rawTimeout = typeof this.timeout === "string" ? this.timeout.trim() : "";
+    const parsedTimeout = Number(rawTimeout);
+    const timeoutMin = rawTimeout !== "" && Number.isFinite(parsedTimeout) ? parsedTimeout : 20;
+    const deadline = Date.now() + timeoutMin * 6e4;
+    const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    for (; ; ) {
+      const token = await getFoundryToken();
+      const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
+      if (block) {
+        await applyProfileToBrain({ block, brainRepo: ctx.brainRepo, branch: "main", appCreds: ctx.appCreds });
+        this.context.stdout.write(`${colors.success("\u2713")} seeded Clever Stacey's brain (${ctx.brainRepo}) from your questionnaire.
+`);
+        return 0;
+      }
+      if (!watch || Date.now() >= deadline) {
+        this.context.stderr.write(
+          `  ${colors.dim(hadIntake ? "questionnaire not complete yet \u2014 no m8t_onboarding block found." : "no onboarding questionnaire found.")}
+  ${colors.hint("retry:")} m8t bootstrap seed-profile
+`
+        );
+        return 3;
+      }
+      this.context.stderr.write(`  ${colors.dim("waiting for the questionnaire to complete\u2026")}
+`);
+      await sleep(2e4);
+    }
+  }
+};
+
 // src/cli.ts
 var cli = new Cli({
   binaryName: "m8t",
@@ -13178,6 +13500,7 @@ cli.register(BootstrapStatusCommand);
 cli.register(BootstrapReapCommand);
 cli.register(BootstrapFinishCommand);
 cli.register(BootstrapUiCommand);
+cli.register(BootstrapSeedProfileCommand);
 async function main() {
   try {
     return await cli.run(process.argv.slice(2));