@m8t-stack/cli 0.2.53 → 0.2.55

package/dist/cli.js

@@ -1364,7 +1364,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.53";
+var CLI_VERSION = "0.2.55";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1911,7 +1911,7 @@ var safeJSON = (text) => {
 };
 
 // ../../node_modules/.pnpm/openai@6.48.0_ws@8.21.1_zod@4.4.3/node_modules/openai/internal/utils/sleep.mjs
-var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var sleep = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 
 // ../../node_modules/.pnpm/openai@6.48.0_ws@8.21.1_zod@4.4.3/node_modules/openai/version.mjs
 var VERSION = "6.48.0";
@@ -3022,8 +3022,8 @@ function addRequestID(value, response) {
 var _APIPromise_client;
 var APIPromise = class _APIPromise extends Promise {
   constructor(client, responsePromise, parseResponse2 = defaultParseResponse) {
-    super((resolve3) => {
-      resolve3(null);
+    super((resolve4) => {
+      resolve4(null);
     });
     this.responsePromise = responsePromise;
     this.parseResponse = parseResponse2;
@@ -3698,12 +3698,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path38(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path42(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path39 = statics.reduce((previousValue, currentValue, index) => {
+  const path43 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3720,7 +3720,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path38(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path39.split(/[?#]/, 1)[0];
+  const pathOnly = path43.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3741,10 +3741,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path38(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path39}
+${path43}
 ${underline}`);
   }
-  return path39;
+  return path43;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -3920,12 +3920,12 @@ var EventStream = class {
     _EventStream_errored.set(this, false);
     _EventStream_aborted.set(this, false);
     _EventStream_catchingPromiseCreated.set(this, false);
-    __classPrivateFieldSet(this, _EventStream_connectedPromise, new Promise((resolve3, reject) => {
-      __classPrivateFieldSet(this, _EventStream_resolveConnectedPromise, resolve3, "f");
+    __classPrivateFieldSet(this, _EventStream_connectedPromise, new Promise((resolve4, reject) => {
+      __classPrivateFieldSet(this, _EventStream_resolveConnectedPromise, resolve4, "f");
       __classPrivateFieldSet(this, _EventStream_rejectConnectedPromise, reject, "f");
     }), "f");
-    __classPrivateFieldSet(this, _EventStream_endPromise, new Promise((resolve3, reject) => {
-      __classPrivateFieldSet(this, _EventStream_resolveEndPromise, resolve3, "f");
+    __classPrivateFieldSet(this, _EventStream_endPromise, new Promise((resolve4, reject) => {
+      __classPrivateFieldSet(this, _EventStream_resolveEndPromise, resolve4, "f");
       __classPrivateFieldSet(this, _EventStream_rejectEndPromise, reject, "f");
     }), "f");
     __classPrivateFieldGet(this, _EventStream_connectedPromise, "f").catch(() => {
@@ -4025,11 +4025,11 @@ var EventStream = class {
    *   const message = await stream.emitted('message') // rejects if the stream errors
    */
   emitted(event) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       __classPrivateFieldSet(this, _EventStream_catchingPromiseCreated, true, "f");
       if (event !== "error")
         this.once("error", reject);
-      this.once(event, resolve3);
+      this.once(event, resolve4);
     });
   }
   /**
@@ -4112,8 +4112,8 @@ var EventStream = class {
         }
         if (ended)
           return Promise.resolve(doneResult());
-        return new Promise((resolve3, reject) => {
-          readQueue.push({ resolve: resolve3, reject });
+        return new Promise((resolve4, reject) => {
+          readQueue.push({ resolve: resolve4, reject });
         });
       },
       return: () => {
@@ -5144,7 +5144,7 @@ var ChatCompletionStream = class _ChatCompletionStream extends AbstractChatCompl
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve3, reject) => readQueue.push({ resolve: resolve3, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -5319,7 +5319,7 @@ var ChatCompletionStreamingRunner = class _ChatCompletionStreamingRunner extends
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve3, reject) => readQueue.push({ resolve: resolve3, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
         }
         const event = pushQueue.shift();
         if (!event) {
@@ -8482,7 +8482,7 @@ var AssistantStream = class extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve3, reject) => readQueue.push({ resolve: resolve3, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -10862,7 +10862,7 @@ var ResponseStream = class _ResponseStream extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve3, reject) => readQueue.push({ resolve: resolve3, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
         }
         const event = pushQueue.shift();
         return { value: event, done: false };
@@ -12012,9 +12012,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path38, query, defaultBaseURL) {
+  buildURL(path42, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path38) ? new URL(path38) : new URL(baseURL + (baseURL.endsWith("/") && path38.startsWith("/") ? path38.slice(1) : path38));
+    const url = isAbsoluteURL(path42) ? new URL(path42) : new URL(baseURL + (baseURL.endsWith("/") && path42.startsWith("/") ? path42.slice(1) : path42));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -12044,24 +12044,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path38, opts) {
-    return this.methodRequest("get", path38, opts);
+  get(path42, opts) {
+    return this.methodRequest("get", path42, opts);
   }
-  post(path38, opts) {
-    return this.methodRequest("post", path38, opts);
+  post(path42, opts) {
+    return this.methodRequest("post", path42, opts);
   }
-  patch(path38, opts) {
-    return this.methodRequest("patch", path38, opts);
+  patch(path42, opts) {
+    return this.methodRequest("patch", path42, opts);
   }
-  put(path38, opts) {
-    return this.methodRequest("put", path38, opts);
+  put(path42, opts) {
+    return this.methodRequest("put", path42, opts);
   }
-  delete(path38, opts) {
-    return this.methodRequest("delete", path38, opts);
+  delete(path42, opts) {
+    return this.methodRequest("delete", path42, opts);
   }
-  methodRequest(method, path38, opts) {
+  methodRequest(method, path42, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path38, ...opts2 };
+      return { method, path: path42, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -12186,8 +12186,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path38, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path38, ...opts2 })) : { method: "get", path: path38, ...opts });
+  getAPIList(path42, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path42, ...opts2 })) : { method: "get", path: path42, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -12281,8 +12281,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path38, query, defaultBaseURL } = options;
-    const url = this.buildURL(path38, query, defaultBaseURL);
+    const { method, path: path42, query, defaultBaseURL } = options;
+    const url = this.buildURL(path42, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12647,7 +12647,7 @@ function redactAzArgs(args) {
   return out;
 }
 function runAz(args) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
@@ -12687,7 +12687,7 @@ function runAz(args) {
         );
         return;
       }
-      resolve3(Buffer.concat(out).toString("utf8"));
+      resolve4(Buffer.concat(out).toString("utf8"));
     });
   });
 }
@@ -13325,10 +13325,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path38 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path42 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path38 },
+      { method: "GET", path: path42 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -14242,13 +14242,13 @@ async function createGitHubApp(args) {
   const setupUrl = `${base}/setup`;
   let createdApp = null;
   let polledInstallationId = null;
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let settled = false;
     let server;
     const complete = (installationId) => {
       if (settled || !createdApp) return;
       settled = true;
-      resolve3({ app: createdApp, installationId });
+      resolve4({ app: createdApp, installationId });
       setTimeout(() => {
         server.close();
       }, 2500);
@@ -14362,7 +14362,7 @@ async function findValidBrainApp(credsPath, org, deps = {}) {
 // src/lib/gh-helpers.ts
 init_errors();
 import { spawn as spawn2 } from "child_process";
-var defaultGhExec = (cmd, args) => new Promise((resolve3) => {
+var defaultGhExec = (cmd, args) => new Promise((resolve4) => {
   const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
@@ -14370,7 +14370,7 @@ var defaultGhExec = (cmd, args) => new Promise((resolve3) => {
   const done = (r) => {
     if (!settled) {
       settled = true;
-      resolve3(r);
+      resolve4(r);
     }
   };
   child.stdout.on("data", (d) => {
@@ -14539,8 +14539,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path38) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path38}`]);
+    getFile: async (path42) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path42}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -15407,7 +15407,7 @@ async function createBlankRepo(args) {
   return { cloneUrl: j.clone_url, defaultBranch: j.default_branch ?? "main" };
 }
 function run(cmd, cmdArgs, cwd, env) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const c = spawn3(cmd, cmdArgs, { cwd, env: { ...process.env, ...env }, stdio: ["ignore", "pipe", "pipe"] });
     let err = "";
     c.stderr.on("data", (d) => {
@@ -15423,7 +15423,7 @@ function run(cmd, cmdArgs, cwd, env) {
     });
     c.on("close", (code) => {
       if (code === 0) {
-        resolve3();
+        resolve4();
       } else {
         reject(
           new LocalCliError({
@@ -15607,7 +15607,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path38) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path38, fetchImpl: args.fetchImpl }),
+    getFile: (path42) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path42, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -19008,8 +19008,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path38 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path38}:pull`);
+  const path42 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path42}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -19025,7 +19025,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path38}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path42}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -19044,6 +19044,16 @@ import * as fs19 from "fs";
 // ../../packages/platform-release/dist/esm/manifest.js
 var SEVERITIES = ["critical", "recommended", "optional"];
 var IMAGE_KEYS = ["gateway", "codingAgent", "azureExecutor", "installer"];
+var COMPANION_TARGETS = [
+  "darwin-arm64",
+  "darwin-x64",
+  "win32-arm64",
+  "win32-x64"
+];
+function companionTargetFor(platform, architecture) {
+  const target = `${platform}-${architecture}`;
+  return COMPANION_TARGETS.includes(target) ? target : null;
+}
 function isObj2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -19132,6 +19142,34 @@ function validateManifest(m) {
       errors.push("components.infra.treeSha is required");
     }
   }
+  const companion = c.companion;
+  if (companion !== void 0) {
+    if (!isObj2(companion) || companion.kind !== "desktop") {
+      errors.push('components.companion.kind must be "desktop"');
+    } else {
+      for (const f of ["version", "tag"]) {
+        if (typeof companion[f] !== "string" || companion[f].length === 0) {
+          errors.push(`components.companion.${f} is required`);
+        }
+      }
+      if (!isObj2(companion.targets) || Object.keys(companion.targets).length === 0) {
+        errors.push("components.companion.targets must name at least one target");
+      } else {
+        for (const [name, target] of Object.entries(companion.targets)) {
+          if (!COMPANION_TARGETS.includes(name)) {
+            errors.push(`components.companion.targets.${name} is not a known target`);
+            continue;
+          }
+          if (!isObj2(target) || typeof target.asset !== "string" || target.asset.length === 0) {
+            errors.push(`components.companion.targets.${name}.asset is required`);
+          }
+          if (!isObj2(target) || typeof target.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(target.sha256)) {
+            errors.push(`components.companion.targets.${name}.sha256 must be a sha256 hex digest`);
+          }
+        }
+      }
+    }
+  }
   return errors;
 }
 
@@ -19169,6 +19207,9 @@ function platformTag(version) {
 function channelUrlForVersion(version) {
   return `https://github.com/m8t-labs/m8t/releases/download/${platformTag(version)}/manifest.json`;
 }
+function releaseAssetUrl(tag, asset) {
+  return `https://github.com/m8t-labs/m8t/releases/download/${tag}/${asset}`;
+}
 
 // ../../packages/platform-release/dist/esm/apply-request.js
 var APPLY_REQUEST_PK = "system";
@@ -19221,13 +19262,13 @@ function manifestSourceForVersionTag(channelUrl, version) {
   return { url: custom };
 }
 async function fetchManifest(source, deps = {}) {
-  const readFile8 = deps.readFile ?? ((p) => fs19.readFileSync(p, "utf8"));
+  const readFile9 = deps.readFile ?? ((p) => fs19.readFileSync(p, "utf8"));
   const fetchImpl = deps.fetchImpl ?? fetch;
   const ghToken = deps.ghToken ?? getGhToken;
   let raw;
   if ("file" in source) {
     try {
-      raw = readFile8(source.file);
+      raw = readFile9(source.file);
     } catch (e) {
       throw new LocalCliError({ code: "PLATFORM_MANIFEST_READ_FAILED", message: `Could not read manifest file '${source.file}': ${e.message}` });
     }
@@ -20404,25 +20445,25 @@ function mergeThreeWay(ours, base, theirs) {
     fs23.rmSync(dir, { recursive: true, force: true });
   }
 }
-var skip = (path38, skipReason) => ({ path: path38, kind: "skip", skipReason });
+var skip = (path42, skipReason) => ({ path: path42, kind: "skip", skipReason });
 function classifyCandidate(c) {
-  const { path: path38, base, ours, theirs } = c;
-  if (theirs === base) return { path: path38, kind: "noop" };
+  const { path: path42, base, ours, theirs } = c;
+  if (theirs === base) return { path: path42, kind: "noop" };
   if (base === null) {
-    if (theirs === null) return { path: path38, kind: "noop" };
-    if (ours === null) return { path: path38, kind: "add", content: theirs };
-    if (ours === theirs) return { path: path38, kind: "noop" };
-    return skip(path38, "you already have a file at this path");
+    if (theirs === null) return { path: path42, kind: "noop" };
+    if (ours === null) return { path: path42, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path42, kind: "noop" };
+    return skip(path42, "you already have a file at this path");
   }
   if (ours === null) {
-    return theirs === null ? { path: path38, kind: "noop" } : skip(path38, "you removed this file; upstream changed it");
+    return theirs === null ? { path: path42, kind: "noop" } : skip(path42, "you removed this file; upstream changed it");
   }
   if (theirs === null) {
-    return ours === base ? { path: path38, kind: "delete" } : skip(path38, "you edited this file; upstream removed it");
+    return ours === base ? { path: path42, kind: "delete" } : skip(path42, "you edited this file; upstream removed it");
   }
-  if (ours === base) return { path: path38, kind: "update", content: theirs };
+  if (ours === base) return { path: path42, kind: "update", content: theirs };
   const m = mergeThreeWay(ours, base, theirs);
-  return m.ok ? { path: path38, kind: "update", content: m.merged } : skip(path38, "your edits conflict with the update");
+  return m.ok ? { path: path42, kind: "update", content: m.merged } : skip(path42, "your edits conflict with the update");
 }
 
 // src/lib/seed-pr-body.ts
@@ -20607,7 +20648,7 @@ function bindRepoApi(token, repo) {
     openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
     updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
     closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
-    readFileAtRef: (path38, ref) => readRepoFileViaApp({ token, repo, path: path38, ref })
+    readFileAtRef: (path42, ref) => readRepoFileViaApp({ token, repo, path: path42, ref })
   };
 }
 async function runSeedRefresh(args) {
@@ -22683,9 +22724,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path38 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path38));
-    else out.push({ ...d, path: path38 });
+    const path42 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path42));
+    else out.push({ ...d, path: path42 });
   }
   return out;
 }
@@ -23537,7 +23578,7 @@ import { Command as Command45, Option as Option42 } from "clipanion";
 init_errors();
 import { spawn as spawn4 } from "child_process";
 function runAzd(args) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
@@ -23566,7 +23607,7 @@ function runAzd(args) {
         );
         return;
       }
-      resolve3(Buffer.concat(out).toString("utf8"));
+      resolve4(Buffer.concat(out).toString("utf8"));
     });
   });
 }
@@ -26243,7 +26284,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path38, allowedPrefix) => allowedPrefix.test(path38) && !path38.split("/").includes("..");
+var isAllowedWritePath = (path42, allowedPrefix) => allowedPrefix.test(path42) && !path42.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
@@ -26286,8 +26327,8 @@ function makeGitDataWriter(args) {
   if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
     throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
   }
-  async function gh(token, method, path38, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path38}`, {
+  async function gh(token, method, path42, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path42}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -26300,8 +26341,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path38) {
-    const encodedPath = path38.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path42) {
+    const encodedPath = path42.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -26317,9 +26358,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path38) {
+    async readFile(path42) {
       const token = await args.mintToken();
-      return readFileWith(token, path38);
+      return readFileWith(token, path42);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -26328,9 +26369,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path38 of paths) {
-        const content = await readFileWith(token, path38);
-        out.push({ path: path38, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path42 of paths) {
+        const content = await readFileWith(token, path42);
+        out.push({ path: path42, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -26769,7 +26810,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path38) => originByPath.get(path38) ?? "worker"
+    originOf: (path42) => originByPath.get(path42) ?? "worker"
   };
 }
 
@@ -26790,14 +26831,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path38, message) {
+  constructor(path42, message) {
     super(message);
-    this.path = path38;
+    this.path = path42;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path38) => /(^|\/)[^/]*_index\.md$/.test(path38);
-var isMemoryIndex = (path38) => path38 === "memory/MEMORY.md";
+var isIndexFile = (path42) => /(^|\/)[^/]*_index\.md$/.test(path42);
+var isMemoryIndex = (path42) => path42 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -26814,29 +26855,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path38 = targetPath(delta);
-  if (path38 === null)
+  const path42 = targetPath(delta);
+  if (path42 === null)
     return { ok: true };
-  if (isIndexFile(path38) && !isMemoryIndex(path38)) {
-    return { ok: false, flagged: { kind: "flagged", path: path38, tension: `refused: ${path38} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path42) && !isMemoryIndex(path42)) {
+    return { ok: false, flagged: { kind: "flagged", path: path42, tension: `refused: ${path42} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path38);
-  const isStructural = path38.startsWith("references/");
+  const target = await lookup(path42);
+  const isStructural = path42.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path38, `supersede/retract OLD target ${path38} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path42, `supersede/retract OLD target ${path42} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path38, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path42, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path38) => path38.split("/").includes("..");
+var hasTraversal = (path42) => path42.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -26943,7 +26984,7 @@ ${inject}
 ---
 ` + body.slice(m[0].length);
 }
-var indexLine = (path38, title, date, tags) => `- \`${path38}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path42, title, date, tags) => `- \`${path42}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -27116,16 +27157,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path38) => Promise.resolve(mem.files.find((f) => f.path === path38) ?? null);
+      const lookup = (path42) => Promise.resolve(mem.files.find((f) => f.path === path42) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path38 = checkPathAllowed(delta);
-          if (!path38.ok) {
-            digest.push(path38.rejected);
+          const path42 = checkPathAllowed(delta);
+          if (!path42.ok) {
+            digest.push(path42.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -27914,8 +27955,8 @@ async function ensureAccount(args) {
     );
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    const sep = "' failed: ";
-    const stderr = msg.includes(sep) ? msg.slice(msg.indexOf(sep) + sep.length) : msg;
+    const sep3 = "' failed: ";
+    const stderr = msg.includes(sep3) ? msg.slice(msg.indexOf(sep3) + sep3.length) : msg;
     if (/CustomDomainInUse|subdomain name .* is not available|already used by a resource/i.test(stderr)) {
       throw new LocalCliError({
         code: "FOUNDRY_ACCOUNT_SUBDOMAIN_CONFLICT",
@@ -28248,9 +28289,9 @@ var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t rece
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
-function ingestUrl(path38) {
+function ingestUrl(path42) {
   const base = INGEST_BASE_URL.replace(/\/+$/, "");
-  return `${base}${path38.startsWith("/") ? path38 : `/${path38}`}`;
+  return `${base}${path42.startsWith("/") ? path42 : `/${path42}`}`;
 }
 
 // src/commands/bootstrap/preflight.ts
@@ -28735,7 +28776,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.48";
+var DEFAULT_INSTALLER_TAG = "v0.1.49";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -29238,10 +29279,10 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/finish.ts
-import * as fs31 from "fs/promises";
-import * as os16 from "os";
-import * as path34 from "path";
-import { Command as Command57, Option as Option54 } from "clipanion";
+import * as fs34 from "fs/promises";
+import * as os18 from "os";
+import * as path38 from "path";
+import { Command as Command58, Option as Option55 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
@@ -30178,10 +30219,10 @@ var DEFAULT_WORKERS = [
   { name: "azzy", label: "Azzy   \u2014 Azure Advisor", brain: "azzy-brain", executor: "azure-executor" }
 ];
 function renderInstallSummary(args) {
-  const open = args.webappUrl ? `${args.webappUrl}        (or run: m8t open)` : "run: m8t open";
+  const open3 = args.webappUrl ? `${args.webappUrl}        (or run: m8t open)` : "run: m8t open";
   const lines = [
     "\u2705 Your m8t platform is ready to use.",
-    `   Open it:  ${open}`,
+    `   Open it:  ${open3}`,
     ""
   ];
   if (args.brainOrg) {
@@ -30203,216 +30244,1309 @@ function renderInstallSummary(args) {
   return lines.join("\n") + "\n";
 }
 
-// src/commands/bootstrap/finish.ts
-var BootstrapFinishCommand = class extends M8tCommand {
-  static paths = [["bootstrap", "finish"]];
-  static usage = Command57.Usage({
-    description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
-    details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding intake \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
-    examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
-  });
-  repoRoot = Option54.String("--repo-root");
-  subscription = Option54.String("--subscription");
-  resourceGroup = Option54.String("--resource-group");
-  async executeCommand() {
-    const state = await readBootstrapState();
-    if (!state) {
-      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state.", hint: "Run 'm8t bootstrap launch' first." });
+// src/lib/companion-install.ts
+import { constants as constants2 } from "fs";
+import * as fs32 from "fs/promises";
+import * as path35 from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+import { execFile, spawn as spawn7 } from "child_process";
+
+// src/lib/companion-artifact.ts
+import { createHash as createHash5 } from "crypto";
+import { constants } from "fs";
+import * as fs31 from "fs/promises";
+import * as path34 from "path";
+var SHA256 = /^[a-f0-9]{64}$/u;
+var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u;
+function exactKeys(value, expected) {
+  const actual = Object.keys(value).sort();
+  return actual.length === expected.length && actual.every((key2, index) => key2 === [...expected].sort()[index]);
+}
+function normalizedRelative(value) {
+  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path34.posix.isAbsolute(value)) {
+    throw new Error("Artifact path must be a normalized relative POSIX path");
+  }
+  const normalized = path34.posix.normalize(value);
+  if (normalized !== value || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
+    throw new Error("Artifact path escapes the payload root");
+  }
+  return value;
+}
+function validateLink(entryPath, target) {
+  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path34.posix.isAbsolute(target)) {
+    throw new Error("Artifact symlink target must be relative");
+  }
+  const resolved = path34.posix.normalize(
+    path34.posix.join(path34.posix.dirname(entryPath), target)
+  );
+  if (resolved === ".." || resolved.startsWith("../") || path34.posix.isAbsolute(resolved)) {
+    throw new Error("Artifact symlink target escapes the payload root");
+  }
+  return target;
+}
+function canonicalEntry(entry) {
+  return entry.type === "file" ? `file\0${entry.path}\0${String(entry.mode)}\0${String(entry.size)}\0${entry.sha256}
+` : `symlink\0${entry.path}\0${entry.target}
+`;
+}
+function artifactTreeSha256(entries) {
+  const hash = createHash5("sha256");
+  for (const entry of entries) hash.update(canonicalEntry(entry), "utf8");
+  return hash.digest("hex");
+}
+function parseEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Artifact manifest entry schema is invalid");
+  }
+  const record = value;
+  if (record.type === "file") {
+    if (!exactKeys(record, ["type", "path", "mode", "size", "sha256"]) || typeof record.path !== "string" || typeof record.mode !== "number" || !Number.isSafeInteger(record.mode) || record.mode < 0 || record.mode > 511 || typeof record.size !== "number" || !Number.isSafeInteger(record.size) || record.size < 0 || typeof record.sha256 !== "string" || !SHA256.test(record.sha256)) {
+      throw new Error("Artifact file entry schema is invalid");
     }
-    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-    if (doc.status !== "done") {
-      throw new LocalCliError({
-        code: "BOOTSTRAP_FINISH_NOT_DONE",
-        message: `The platform is not live yet (status: ${doc.status}, phase: ${doc.phase}).`,
-        hint: "Wait for 'm8t bootstrap status --watch' to reach done."
+    return {
+      type: "file",
+      path: normalizedRelative(record.path),
+      mode: record.mode,
+      size: record.size,
+      sha256: record.sha256
+    };
+  }
+  if (record.type === "symlink" && exactKeys(record, ["type", "path", "target"]) && typeof record.path === "string" && typeof record.target === "string") {
+    const entryPath = normalizedRelative(record.path);
+    return {
+      type: "symlink",
+      path: entryPath,
+      target: validateLink(entryPath, record.target)
+    };
+  }
+  throw new Error("Artifact symlink entry schema is invalid");
+}
+function parseArtifactManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Artifact manifest schema is invalid");
+  }
+  const record = value;
+  if (!exactKeys(record, [
+    "schemaVersion",
+    "platform",
+    "architecture",
+    "version",
+    "entryRelativePath",
+    "treeSha256",
+    "entries"
+  ]) || record.schemaVersion !== 1 || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.version !== "string" || !VERSION2.test(record.version) || typeof record.entryRelativePath !== "string" || typeof record.treeSha256 !== "string" || !SHA256.test(record.treeSha256) || !Array.isArray(record.entries)) {
+    throw new Error("Artifact manifest schema is invalid");
+  }
+  const entries = record.entries.map(parseEntry);
+  const paths = entries.map((entry) => entry.path);
+  const sorted = [...paths].sort((left, right) => left.localeCompare(right));
+  if (paths.some((entryPath, index) => entryPath !== sorted[index]) || new Set(paths).size !== paths.length) {
+    throw new Error("Artifact entries must be unique and sorted");
+  }
+  if (artifactTreeSha256(entries) !== record.treeSha256) {
+    throw new Error("Artifact tree digest does not match entries");
+  }
+  return {
+    schemaVersion: 1,
+    platform: record.platform,
+    architecture: record.architecture,
+    version: record.version,
+    entryRelativePath: normalizedRelative(record.entryRelativePath),
+    treeSha256: record.treeSha256,
+    entries
+  };
+}
+async function sha256File2(filePath) {
+  return createHash5("sha256").update(await fs31.readFile(filePath)).digest("hex");
+}
+async function walk(root, relative3 = "") {
+  const directory = path34.join(root, ...relative3.split("/").filter(Boolean));
+  const children = await fs31.readdir(directory, { withFileTypes: true });
+  const entries = [];
+  for (const child of children.sort((left, right) => left.name.localeCompare(right.name))) {
+    const childRelative = relative3 ? `${relative3}/${child.name}` : child.name;
+    normalizedRelative(childRelative);
+    const childPath = path34.join(directory, child.name);
+    const stat4 = await fs31.lstat(childPath);
+    if (stat4.isDirectory()) {
+      entries.push(...await walk(root, childRelative));
+    } else if (stat4.isFile()) {
+      entries.push({
+        type: "file",
+        path: childRelative,
+        mode: stat4.mode & 511,
+        size: stat4.size,
+        sha256: await sha256File2(childPath)
       });
+    } else if (stat4.isSymbolicLink()) {
+      const target = await fs31.readlink(childPath);
+      entries.push({
+        type: "symlink",
+        path: childRelative,
+        target: validateLink(childRelative, target)
+      });
+    } else {
+      throw new Error(`Unsupported artifact entry: ${childRelative}`);
     }
-    const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
-    const markerDir = path34.join(os16.homedir(), ".m8t");
-    await fs31.mkdir(markerDir, { recursive: true });
-    await fs31.writeFile(path34.join(markerDir, "repo-root"), `${repoRoot}
-`, "utf8");
-    const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? state.subscriptionId;
-    const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? state.resourceGroup;
-    let webappUrl;
+  }
+  return entries;
+}
+async function ensureRealDirectory(root) {
+  const stat4 = await fs31.lstat(root);
+  if (stat4.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
+  if (!stat4.isDirectory()) throw new Error("Artifact root is not a directory");
+}
+async function validateResolvedLinks(root, entries) {
+  const realRoot = await fs31.realpath(root);
+  for (const entry of entries) {
+    if (entry.type !== "symlink") continue;
     try {
-      const d = await discoverGateway({ subscriptionId, interactive: false, resourceGroup });
-      await writeConfig({
-        gatewayUrl: d.gatewayUrl,
-        gatewayClientId: d.gatewayClientId,
-        gatewayTenantId: d.gatewayTenantId,
-        subscriptionId: d.subscriptionId,
-        containerAppResourceId: d.containerAppResourceId,
-        cachedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      webappUrl = d.gatewayUrl;
-      this.context.stdout.write(
-        `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")}
-  gateway:  ${d.gatewayUrl}
-  foundry:  ${doc.result?.foundryEndpoint ?? "-"}
-
-`
-      );
-      try {
-        await ensureGatewayRedirectUri(d.gatewayClientId, new URL(d.gatewayUrl).host);
-      } catch (e) {
-        const err = e;
-        this.context.stderr.write(
-          `  ${colors.error("\u26A0 could not authorize sign-in for your webapp:")} ${err.message}
-  ${colors.hint(`Until this is fixed, opening ${d.gatewayUrl} will fail with AADSTS50011 (redirect URI mismatch).`)}
-  ${colors.hint("Ask a directory admin to run:")}
-  ${colors.hint(`    m8t bootstrap finish --repo-root ${repoRoot}   # (as an admin), or by hand:`)}
-  ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
-
-`
-        );
+      const linkPath = path34.join(root, ...entry.path.split("/"));
+      const resolved = await fs31.realpath(linkPath);
+      const relative3 = path34.relative(realRoot, resolved);
+      if (relative3 === ".." || relative3.startsWith(`..${path34.sep}`) || path34.isAbsolute(relative3)) {
+        throw new Error("Artifact symlink chain escapes the payload root");
       }
-      try {
-        const verdict = await runUsagePhase(
-          buildPrereqDeps({ subscription: subscriptionId, resourceGroup }),
-          { fix: true, onProgress: (m) => {
-            this.context.stdout.write(colors.dim(`  ${m}
-`));
-          } }
-        );
-        const rows = verdict.results.filter((r) => r.slug !== "signin-redirect-uri");
-        const unresolved = rows.filter((r) => r.status === "fail");
-        if (unresolved.length === 0) {
-          this.context.stdout.write(`  ${colors.success("\u2713 your account can reach Foundry and read the platform Key Vault")}
-
-`);
-        }
-        for (const r of unresolved) {
-          this.context.stderr.write(
-            `  ${colors.error("\u26A0 could not grant you access:")} ${r.detail}
-` + (r.remedy ? `  ${colors.hint(`Fix it with: ${r.remedy}`)}
-` : "") + "\n"
-          );
-        }
-      } catch (e) {
-        this.context.stderr.write(
-          `  ${colors.error("\u26A0 could not check or grant your platform access:")} ${e.message}
-  ${colors.hint("Run 'm8t prereqs --fix' when you can \u2014 until then your AI team will not load and worker deploys will fail.")}
-
-`
-        );
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("Artifact symlink chain")) {
+        throw error;
       }
-    } catch (e) {
-      const err = e;
-      this.context.stdout.write(`${colors.success("\u2705 The platform is live.")}
-
-`);
-      this.context.stderr.write(
-        `  ${colors.hint(`\u26A0 couldn't auto-point your local tools at the gateway: ${err.message}`)}
-` + (err.hint ? `  ${colors.hint(err.hint)}
-` : "") + "\n"
-      );
+      throw new Error(`Artifact symlink does not resolve inside payload: ${entry.path}`);
     }
-    let brainOrg = null;
-    try {
-      const credsRaw = await fs31.readFile(path34.join(markerDir, "github-app.json"), "utf8");
-      const creds = JSON.parse(credsRaw);
-      brainOrg = typeof creds.org === "string" ? creds.org : null;
-    } catch {
+  }
+}
+async function buildArtifactManifest(payloadRoot, input) {
+  await ensureRealDirectory(payloadRoot);
+  const entries = await walk(payloadRoot);
+  await validateResolvedLinks(payloadRoot, entries);
+  const manifest = {
+    schemaVersion: 1,
+    platform: input.platform,
+    architecture: input.architecture,
+    version: input.version,
+    entryRelativePath: normalizedRelative(input.entryRelativePath),
+    treeSha256: artifactTreeSha256(entries),
+    entries
+  };
+  if (!entries.some((entry) => entry.path === manifest.entryRelativePath && entry.type === "file")) {
+    throw new Error("Artifact executable is missing from the payload");
+  }
+  return manifest;
+}
+async function readArtifactManifest(manifestPath) {
+  const before = await fs31.lstat(manifestPath);
+  if (before.isSymbolicLink() || !before.isFile()) {
+    throw new Error("Artifact manifest is a symbolic link or non-file");
+  }
+  let handle;
+  try {
+    handle = await fs31.open(
+      manifestPath,
+      constants.O_RDONLY | constants.O_NOFOLLOW
+    );
+    const opened = await handle.stat();
+    const sameFile = before.ino === 0 && opened.ino === 0 || before.dev === opened.dev && before.ino === opened.ino;
+    if (!opened.isFile() || !sameFile || opened.size > 4 * 1024 * 1024) {
+      throw new Error("Artifact manifest is not a bounded regular file");
     }
-    this.context.stdout.write(renderInstallSummary({ webappUrl, brainOrg }) + "\n");
-    this.context.stdout.write(
-      `${colors.field("Optional local tooling for your coding agent:")}
-  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
-  \u2022 Azure-capable MCP servers (microsoft/azure-skills, Microsoft Learn) \u2014 see the optional steps in guides/install.md.
-  \u2022 Deploy workers conversationally with the opt-in persona skills \u2014 see guides/workers.md.
-  \u2022 Make sure your m8t CLI is current: npm i -g @m8t-stack/cli@latest
-
-${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP servers load only on a fresh start.
-`
+    return parseArtifactManifest(
+      JSON.parse(await handle.readFile("utf8"))
     );
-    try {
-      await reactiveSeedOnFinish({
-        endpoint: doc.result?.foundryEndpoint,
-        subscriptionId,
-        stdout: (s) => this.context.stdout.write(s)
-      });
-    } catch (e) {
-      this.context.stderr.write(
-        `  ${colors.dim(`(company-profile seed deferred: ${e instanceof Error ? e.message : String(e)} \u2014 run 'm8t bootstrap seed-profile' later)`)}
-`
-      );
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+function ensureContainedEntry(root, entryPath) {
+  const absolute = path34.join(root, ...entryPath.split("/"));
+  const relative3 = path34.relative(root, absolute);
+  if (relative3.startsWith("..") || path34.isAbsolute(relative3)) {
+    throw new Error("Artifact entry escapes payload root");
+  }
+  return absolute;
+}
+async function verifyArtifactSource(payloadRoot, manifest) {
+  await ensureRealDirectory(payloadRoot);
+  const actual = await walk(payloadRoot);
+  await validateResolvedLinks(payloadRoot, actual);
+  const declared = new Map(manifest.entries.map((entry) => [entry.path, entry]));
+  for (const entry of actual) {
+    if (JSON.stringify(declared.get(entry.path)) !== JSON.stringify(entry)) {
+      throw new Error(`Artifact entry does not match manifest: ${entry.path}`);
     }
-    return 0;
   }
-};
-
-// src/commands/bootstrap/ui.ts
-import * as fs33 from "fs";
-import * as os18 from "os";
-import * as path36 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
-init_errors();
-
-// src/lib/bootstrap-ui.ts
-import * as fs32 from "fs";
-import * as net from "net";
-import * as os17 from "os";
-import * as path35 from "path";
-import { randomBytes as randomBytes3 } from "crypto";
-import { spawn as spawn7, spawnSync as spawnSync6 } from "child_process";
-init_errors();
-init_rbac();
-
-// src/lib/intake-agent.ts
-init_esm();
-var INTAKE_PERSONA = "azure-advisor-intake";
-var INTAKE_AGENT = INTAKE_AGENT_NAME;
-async function deployIntakeAgent(args) {
-  try {
-    return await deployPromptAdvisor({
-      credential: args.credential,
-      endpoint: args.endpoint,
-      repoRoot: args.repoRoot,
-      persona: INTAKE_PERSONA,
-      agentName: INTAKE_AGENT,
-      model: args.model,
-      fieldOverrides: args.fieldOverrides
-    });
-  } catch (e) {
-    if (e && typeof e === "object" && "code" in e) {
-      const err = e;
-      if (err.code === "ADVISOR_PERSONA_MISSING") {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: "INTAKE_PERSONA_MISSING",
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
-      if (err.code === "ADVISOR_NO_MODEL") {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: "INTAKE_NO_MODEL",
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
-      if (err.code === "ADVISOR_BAD_EFFORT") {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: "INTAKE_BAD_EFFORT",
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
+  const present = new Set(actual.map((entry) => entry.path));
+  for (const entry of manifest.entries) {
+    if (entry.type === "file" && !present.has(entry.path)) {
+      throw new Error(`Artifact file is missing from the payload: ${entry.path}`);
     }
-    throw e;
   }
 }
-
-// src/lib/bootstrap-ui.ts
+async function verifyArtifactPayload(payloadRoot, manifest) {
+  await ensureRealDirectory(payloadRoot);
+  const actual = await walk(payloadRoot);
+  await validateResolvedLinks(payloadRoot, actual);
+  if (actual.length !== manifest.entries.length || artifactTreeSha256(actual) !== manifest.treeSha256) {
+    throw new Error("Artifact payload digest or size does not match manifest");
+  }
+  for (const entry of manifest.entries) {
+    const actualEntry = actual.find((candidate2) => candidate2.path === entry.path);
+    if (JSON.stringify(actualEntry) !== JSON.stringify(entry)) {
+      throw new Error(`Artifact entry does not match manifest: ${entry.path}`);
+    }
+  }
+}
+async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
+  await verifyArtifactSource(sourceRoot, manifest);
+  try {
+    const targetStat = await fs31.lstat(targetRoot);
+    if (targetStat.isSymbolicLink()) {
+      throw new Error("Install target is a symbolic link");
+    }
+    if (!targetStat.isDirectory()) throw new Error("Install target is not a directory");
+    if ((await fs31.readdir(targetRoot)).length > 0) {
+      throw new Error("Install staging target is not empty");
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    await fs31.mkdir(targetRoot, { recursive: false, mode: 448 });
+  }
+  for (const entry of manifest.entries) {
+    const source = ensureContainedEntry(sourceRoot, entry.path);
+    const target = ensureContainedEntry(targetRoot, entry.path);
+    await fs31.mkdir(path34.dirname(target), { recursive: true, mode: 448 });
+    if (entry.type === "file") {
+      await fs31.copyFile(source, target);
+      await fs31.chmod(target, entry.mode);
+    } else {
+      await fs31.symlink(entry.target, target);
+    }
+  }
+  await verifyArtifactPayload(targetRoot, manifest);
+}
+
+// src/lib/companion-install.ts
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function commandError(error, message) {
+  const wrapped = new Error(message, { cause: error });
+  const code = error?.code;
+  if (code !== void 0) wrapped.code = code;
+  return wrapped;
+}
+function execFileAsync(file, args) {
+  return new Promise((resolve4, reject) => {
+    execFile(file, [...args], { windowsHide: true }, (error) => {
+      if (error) reject(commandError(error, "Login-item command failed"));
+      else resolve4();
+    });
+  });
+}
+function execFileOutput(file, args) {
+  return new Promise((resolve4, reject) => {
+    execFile(
+      file,
+      [...args],
+      { windowsHide: true },
+      (error, stdout) => {
+        if (error) reject(commandError(error, "Login-item query failed"));
+        else resolve4(stdout);
+      }
+    );
+  });
+}
+async function setCompanionStartAtLogin(input) {
+  if (input.platform === "darwin") {
+    const launchAgents = path35.join(input.homeDirectory, "Library", "LaunchAgents");
+    const registration = path35.join(
+      launchAgents,
+      "com.m8t.companion.plist"
+    );
+    await assertNotSymlink(registration, "Start-at-login registration");
+    if (!input.enabled) {
+      await fs32.rm(registration, { force: true });
+      return;
+    }
+    await fs32.mkdir(launchAgents, { recursive: true, mode: 448 });
+    const plist = '<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.m8t.companion</string><key>ProgramArguments</key><array><string>' + xmlEscape(input.executable) + "</string></array><key>RunAtLoad</key><true/></dict></plist>\n";
+    await atomicWriteText(registration, plist, 384);
+    return;
+  }
+  if (input.platform === "win32") {
+    const key2 = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+    const run2 = input.runCommand ?? (async (file, args) => {
+      await execFileAsync(file, args);
+      return "";
+    });
+    if (input.enabled) {
+      await run2(
+        "reg.exe",
+        [
+          "add",
+          key2,
+          "/v",
+          "m8t Companion",
+          "/t",
+          "REG_SZ",
+          "/d",
+          `"${input.executable}"`,
+          "/f"
+        ]
+      );
+    } else {
+      try {
+        await run2("reg.exe", [
+          "query",
+          key2,
+          "/v",
+          "m8t Companion"
+        ]);
+      } catch (error) {
+        if (error.code === 1) return;
+        throw error;
+      }
+      await run2("reg.exe", [
+        "delete",
+        key2,
+        "/v",
+        "m8t Companion",
+        "/f"
+      ]);
+    }
+    return;
+  }
+  throw new Error("Start-at-login is unsupported on this platform");
+}
+async function getCompanionStartAtLogin(input) {
+  if (input.platform === "darwin") {
+    const registration = path35.join(
+      input.homeDirectory,
+      "Library",
+      "LaunchAgents",
+      "com.m8t.companion.plist"
+    );
+    try {
+      const contents = await readRegularText(registration, 64 * 1024);
+      return contents.includes(`<string>${xmlEscape(input.executable)}</string>`);
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      return false;
+    }
+  }
+  if (input.platform === "win32") {
+    try {
+      const output = await execFileOutput("reg.exe", [
+        "query",
+        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "/v",
+        "m8t Companion"
+      ]);
+      return output.includes(`"${input.executable}"`);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+var INSTALL_KEYS = [
+  "schemaVersion",
+  "version",
+  "platform",
+  "architecture",
+  "entryRelativePath",
+  "artifactTreeSha256",
+  "ownedTargetRoot"
+];
+var RUNTIME_KEYS = [
+  "schemaVersion",
+  "nodeExecutable",
+  "cliEntry",
+  "gatewayOrigin"
+];
+function isSupportedPlatform(platform) {
+  return platform === "darwin" || platform === "win32";
+}
+function isSupportedArchitecture(architecture) {
+  return architecture === "arm64" || architecture === "x64";
+}
+function companionsSupportHost(platform = process.platform, architecture = process.arch) {
+  return isSupportedPlatform(platform) && isSupportedArchitecture(architecture);
+}
+function assertSupported(options) {
+  if (!isSupportedPlatform(options.platform) || !isSupportedArchitecture(options.architecture)) {
+    throw new Error(
+      "Desktop companions are supported on macOS and Windows arm64/x64. Run: m8t companion status"
+    );
+  }
+}
+function companionInstallPaths(options) {
+  assertSupported(options);
+  const companionState = path35.join(
+    options.homeDirectory,
+    ".m8t",
+    "companion"
+  );
+  const targetRoot = options.platform === "darwin" ? path35.join(
+    options.homeDirectory,
+    "Applications",
+    "m8t Companion.app"
+  ) : path35.join(
+    options.localAppData ?? path35.join(options.homeDirectory, "AppData", "Local"),
+    "m8t",
+    "companion",
+    "app"
+  );
+  return {
+    targetRoot,
+    installManifest: path35.join(companionState, "install-v1.json"),
+    runtimeBinding: path35.join(companionState, "runtime-v1.json"),
+    preferences: path35.join(companionState, "preferences-v1.json")
+  };
+}
+function exactKeys2(value, keys) {
+  return Object.keys(value).length === keys.length && keys.every((key2) => Object.hasOwn(value, key2));
+}
+function parseInstallManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Install manifest schema is invalid");
+  }
+  const record = value;
+  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path35.isAbsolute(record.ownedTargetRoot)) {
+    throw new Error("Install manifest schema is invalid");
+  }
+  return record;
+}
+function parseRuntimeBinding(value, platform) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Runtime binding schema is invalid");
+  }
+  const record = value;
+  const paths = platform === "win32" ? path35.win32 : path35.posix;
+  if (!exactKeys2(record, RUNTIME_KEYS) || record.schemaVersion !== 1 || typeof record.nodeExecutable !== "string" || !paths.isAbsolute(record.nodeExecutable) || typeof record.cliEntry !== "string" || !paths.isAbsolute(record.cliEntry) || typeof record.gatewayOrigin !== "string") {
+    throw new Error("Runtime binding schema is invalid");
+  }
+  return {
+    schemaVersion: 1,
+    nodeExecutable: record.nodeExecutable,
+    cliEntry: record.cliEntry,
+    gatewayOrigin: validateGatewayOrigin(record.gatewayOrigin)
+  };
+}
+function validateGatewayOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Companion gateway origin is invalid");
+  }
+  if (url.protocol !== "https:" || url.origin !== value || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    throw new Error("Companion gateway origin must be an HTTPS origin");
+  }
+  return url.origin;
+}
+async function assertNotSymlink(filePath, kind) {
+  try {
+    if ((await fs32.lstat(filePath)).isSymbolicLink()) {
+      throw new Error(`${kind} is a symbolic link`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+}
+async function assertOwnedDirectoryChain(anchor, targetDirectory) {
+  const relative3 = path35.relative(anchor, targetDirectory);
+  if (relative3 === ".." || relative3.startsWith(`..${path35.sep}`) || path35.isAbsolute(relative3)) {
+    throw new Error("Companion owned directory escapes its trusted anchor");
+  }
+  const segments = relative3.split(path35.sep).filter(Boolean);
+  let current = anchor;
+  const anchorStatus = await fs32.lstat(anchor);
+  if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
+    throw new Error("Companion owned directory anchor is unsafe");
+  }
+  for (const segment of segments) {
+    current = path35.join(current, segment);
+    try {
+      const status = await fs32.lstat(current);
+      if (status.isSymbolicLink() || !status.isDirectory()) {
+        throw new Error("Companion owned directory contains a symbolic link");
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+  }
+}
+async function assertOwnedParents(options, paths) {
+  await assertOwnedDirectoryChain(
+    options.homeDirectory,
+    path35.dirname(paths.installManifest)
+  );
+  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path35.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
+  await assertOwnedDirectoryChain(targetAnchor, path35.dirname(paths.targetRoot));
+}
+async function readRegularText(filePath, maxBytes) {
+  const before = await fs32.lstat(filePath);
+  if (before.isSymbolicLink() || !before.isFile()) {
+    throw new Error("Companion state file is not a regular file");
+  }
+  let handle;
+  try {
+    handle = await fs32.open(
+      filePath,
+      constants2.O_RDONLY | constants2.O_NOFOLLOW
+    );
+    const opened = await handle.stat();
+    const sameFile = before.ino === 0 && opened.ino === 0 || before.dev === opened.dev && before.ino === opened.ino;
+    if (!opened.isFile() || !sameFile || opened.size > maxBytes) {
+      throw new Error("Companion state file is not a bounded regular file");
+    }
+    return await handle.readFile("utf8");
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function readClosedJson(filePath) {
+  return JSON.parse(await readRegularText(filePath, 64 * 1024));
+}
+async function atomicWriteJson(filePath, value) {
+  await atomicWriteText(filePath, `${JSON.stringify(value)}
+`, 384);
+}
+async function atomicWriteText(filePath, contents, mode) {
+  await assertNotSymlink(filePath, "Companion state file");
+  await fs32.mkdir(path35.dirname(filePath), {
+    recursive: true,
+    mode: 448
+  });
+  const temporary = `${filePath}.${randomUUID3()}.tmp`;
+  try {
+    await fs32.writeFile(temporary, contents, {
+      mode,
+      flag: "wx"
+    });
+    await fs32.rename(temporary, filePath);
+    await fs32.chmod(filePath, mode).catch(() => void 0);
+  } finally {
+    await fs32.rm(temporary, { force: true }).catch(() => void 0);
+  }
+}
+async function realRegularFile(filePath, executable) {
+  const real = await fs32.realpath(filePath);
+  const stat4 = await fs32.stat(real);
+  if (!stat4.isFile()) throw new Error("Companion launch target is not a file");
+  await fs32.access(real, executable ? constants2.X_OK : constants2.R_OK);
+  return real;
+}
+function defaultLaunch(executable) {
+  const child = spawn7(executable, [], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  });
+  child.unref();
+  return Promise.resolve();
+}
+async function readInstalled(options) {
+  const paths = companionInstallPaths(options);
+  await assertNotSymlink(paths.installManifest, "Install manifest");
+  try {
+    return {
+      paths,
+      install: parseInstallManifest(
+        await readClosedJson(paths.installManifest)
+      )
+    };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function statusCompanion(options) {
+  assertSupported(options);
+  const resolvedPaths = companionInstallPaths(options);
+  try {
+    await assertOwnedParents(options, resolvedPaths);
+  } catch (error) {
+    return {
+      state: "needs-repair",
+      reason: error instanceof Error ? error.message : "Unsafe owned directory"
+    };
+  }
+  let installed;
+  try {
+    installed = await readInstalled(options);
+  } catch (error) {
+    return {
+      state: "needs-repair",
+      reason: error instanceof Error ? error.message : "Invalid install manifest"
+    };
+  }
+  if (!installed) return { state: "not-installed" };
+  const { paths, install } = installed;
+  if (install.platform !== options.platform || install.architecture !== options.architecture || install.ownedTargetRoot !== paths.targetRoot) {
+    return {
+      state: "needs-repair",
+      reason: "Install manifest does not own the fixed companion target"
+    };
+  }
+  try {
+    await assertNotSymlink(paths.targetRoot, "Install target");
+    const actual = await buildArtifactManifest(paths.targetRoot, {
+      platform: install.platform,
+      architecture: install.architecture,
+      version: install.version,
+      entryRelativePath: install.entryRelativePath
+    });
+    if (actual.treeSha256 !== install.artifactTreeSha256) {
+      throw new Error("Installed artifact digest does not match");
+    }
+    const runtime = parseRuntimeBinding(
+      await readClosedJson(paths.runtimeBinding),
+      options.platform
+    );
+    await Promise.all([
+      realRegularFile(runtime.nodeExecutable, options.platform !== "win32"),
+      realRegularFile(runtime.cliEntry, false)
+    ]);
+    const executable = path35.join(
+      paths.targetRoot,
+      ...install.entryRelativePath.split("/")
+    );
+    await realRegularFile(executable, options.platform !== "win32");
+    return {
+      state: "installed",
+      version: install.version,
+      executable,
+      startAtLogin: await (options.getStartAtLogin ?? ((ownedExecutable) => getCompanionStartAtLogin({
+        homeDirectory: options.homeDirectory,
+        platform: options.platform,
+        executable: ownedExecutable
+      })))(executable),
+      artifactTreeSha256: install.artifactTreeSha256
+    };
+  } catch (error) {
+    return {
+      state: "needs-repair",
+      reason: error instanceof Error ? error.message : "Installed artifact is invalid"
+    };
+  }
+}
+async function snapshotFile(filePath) {
+  try {
+    return Buffer.from(await readRegularText(filePath, 64 * 1024), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function restoreFile(filePath, bytes) {
+  if (bytes === null) {
+    await fs32.rm(filePath, { force: true });
+  } else {
+    await atomicWriteJson(filePath, JSON.parse(bytes.toString("utf8")));
+  }
+}
+async function converge(options, force) {
+  assertSupported(options);
+  const paths = companionInstallPaths(options);
+  await assertOwnedParents(options, paths);
+  const artifactManifest = await readArtifactManifest(
+    options.artifactManifestPath
+  );
+  if (artifactManifest.platform !== options.platform || artifactManifest.architecture !== options.architecture) {
+    throw new Error("Companion artifact does not match this OS and architecture");
+  }
+  const payloadRoot = path35.join(
+    path35.dirname(options.artifactManifestPath),
+    "payload"
+  );
+  await verifyArtifactSource(payloadRoot, artifactManifest);
+  for (const boundary of [
+    paths.targetRoot,
+    paths.installManifest,
+    paths.runtimeBinding,
+    paths.preferences
+  ]) {
+    await assertNotSymlink(boundary, "Companion owned boundary");
+  }
+  const current = await statusCompanion(options);
+  const priorInstalled = await readInstalled(options);
+  if (!force && current.state === "installed" && current.version === artifactManifest.version && current.artifactTreeSha256 === artifactManifest.treeSha256 && current.startAtLogin) {
+    return current;
+  }
+  if (current.state === "not-installed") {
+    try {
+      await fs32.lstat(paths.targetRoot);
+      throw new Error(
+        "The fixed companion target exists without an owned install manifest"
+      );
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  const stage = `${paths.targetRoot}.m8t-stage-${randomUUID3()}`;
+  const backup = `${paths.targetRoot}.m8t-backup-${randomUUID3()}`;
+  const copy = options.copyPayload ?? copyArtifactPayload;
+  await fs32.mkdir(path35.dirname(paths.targetRoot), {
+    recursive: true,
+    mode: 448
+  });
+  let movedPrior = false;
+  let installedStage = false;
+  let loginChanged = false;
+  let priorLoginState = false;
+  let priorLoginExecutable;
+  const snapshots = await Promise.all([
+    snapshotFile(paths.installManifest),
+    snapshotFile(paths.runtimeBinding),
+    snapshotFile(paths.preferences)
+  ]);
+  try {
+    await copy(payloadRoot, stage, artifactManifest);
+    try {
+      await fs32.rename(paths.targetRoot, backup);
+      movedPrior = true;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await fs32.rename(stage, paths.targetRoot);
+    installedStage = true;
+    const nodeExecutable = await realRegularFile(
+      options.nodeExecutable,
+      options.platform !== "win32"
+    );
+    const cliEntry = await realRegularFile(options.cliEntry, false);
+    if (options.gatewayOrigin === void 0) {
+      throw new Error("Companion gateway origin is required for installation");
+    }
+    const gatewayOrigin2 = validateGatewayOrigin(options.gatewayOrigin);
+    const install = {
+      schemaVersion: 1,
+      version: artifactManifest.version,
+      platform: artifactManifest.platform,
+      architecture: artifactManifest.architecture,
+      entryRelativePath: artifactManifest.entryRelativePath,
+      artifactTreeSha256: artifactManifest.treeSha256,
+      ownedTargetRoot: paths.targetRoot
+    };
+    const runtime = {
+      schemaVersion: 1,
+      nodeExecutable,
+      cliEntry,
+      gatewayOrigin: gatewayOrigin2
+    };
+    const preferences = {
+      geometry: { edge: "right", offset: 0.5 },
+      userHidden: false,
+      startAtLogin: true,
+      automaticInstall: false,
+      lastRelativeRoute: null,
+      gatewayOrigin: gatewayOrigin2
+    };
+    await atomicWriteJson(paths.installManifest, install);
+    await atomicWriteJson(paths.runtimeBinding, runtime);
+    await atomicWriteJson(paths.preferences, preferences);
+    parseInstallManifest(await readClosedJson(paths.installManifest));
+    parseRuntimeBinding(
+      await readClosedJson(paths.runtimeBinding),
+      options.platform
+    );
+    const executable = path35.join(
+      paths.targetRoot,
+      ...artifactManifest.entryRelativePath.split("/")
+    );
+    await realRegularFile(executable, options.platform !== "win32");
+    const getLogin = options.getStartAtLogin ?? ((ownedExecutable) => getCompanionStartAtLogin({
+      homeDirectory: options.homeDirectory,
+      platform: options.platform,
+      executable: ownedExecutable
+    }));
+    priorLoginExecutable = priorInstalled ? path35.join(
+      priorInstalled.paths.targetRoot,
+      ...priorInstalled.install.entryRelativePath.split("/")
+    ) : executable;
+    priorLoginState = await getLogin(priorLoginExecutable);
+    await (options.setStartAtLogin ?? (() => Promise.resolve()))(
+      executable,
+      true
+    );
+    loginChanged = true;
+    await (options.launch ?? defaultLaunch)(executable);
+    await fs32.rm(backup, { recursive: true, force: true });
+    return {
+      state: "installed",
+      version: artifactManifest.version,
+      executable,
+      startAtLogin: true,
+      artifactTreeSha256: artifactManifest.treeSha256
+    };
+  } catch (error) {
+    if (loginChanged) {
+      await (options.setStartAtLogin ?? (() => Promise.resolve()))(priorLoginExecutable ?? paths.targetRoot, priorLoginState).catch(
+        () => void 0
+      );
+    }
+    await fs32.rm(stage, { recursive: true, force: true }).catch(() => void 0);
+    if (installedStage) {
+      await fs32.rm(paths.targetRoot, {
+        recursive: true,
+        force: true
+      }).catch(() => void 0);
+    }
+    if (movedPrior) {
+      await fs32.rename(backup, paths.targetRoot).catch(() => void 0);
+    }
+    await Promise.all([
+      restoreFile(paths.installManifest, snapshots[0]),
+      restoreFile(paths.runtimeBinding, snapshots[1]),
+      restoreFile(paths.preferences, snapshots[2])
+    ]).catch(() => void 0);
+    throw error;
+  }
+}
+async function installCompanion(options) {
+  return converge(options, false);
+}
+async function repairCompanion(options) {
+  return converge(options, true);
+}
+async function uninstallCompanion(options) {
+  assertSupported(options);
+  const expectedPaths = companionInstallPaths(options);
+  await assertOwnedParents(options, expectedPaths);
+  const installed = await readInstalled(options);
+  if (!installed) return { state: "not-installed" };
+  const { paths, install } = installed;
+  if (install.ownedTargetRoot !== paths.targetRoot) {
+    throw new Error("Refusing to remove a non-owned companion target");
+  }
+  const executable = path35.join(
+    paths.targetRoot,
+    ...install.entryRelativePath.split("/")
+  );
+  await (options.setStartAtLogin ?? (() => Promise.resolve()))(executable, false);
+  const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
+    await fs32.rm(ownedPath, { recursive, force: true });
+  });
+  await remove(paths.targetRoot, true);
+  await remove(paths.installManifest, false);
+  await remove(paths.runtimeBinding, false);
+  await remove(paths.preferences, false);
+  return { state: "not-installed" };
+}
+
+// src/commands/companion/install.ts
+import * as os17 from "os";
+import * as path37 from "path";
+import { Command as Command57, Option as Option54 } from "clipanion";
+
+// src/lib/companion-channel.ts
+async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
+  const manifest = await fetchManifest(source, deps);
+  const component = manifest.components.companion;
+  if (!component) return null;
+  return {
+    component,
+    severity: manifest.platform.severity,
+    platformVersion: manifest.platform.version
+  };
+}
+
+// src/lib/companion-download.ts
+import { createHash as createHash6 } from "crypto";
+import { execFile as execFile2 } from "child_process";
+import * as fs33 from "fs/promises";
+import * as os16 from "os";
+import * as path36 from "path";
+init_errors();
+var MAX_ASSET_BYTES = 512 * 1024 * 1024;
+function extractArchive(archive, into) {
+  return new Promise((resolve4, reject) => {
+    execFile2("tar", ["-xzf", archive, "-C", into], { windowsHide: true }, (error) => {
+      if (error) reject(new Error(`Could not unpack the companion build: ${error.message}`));
+      else resolve4();
+    });
+  });
+}
+function companionAssetFor(component, platform = process.platform, architecture = process.arch) {
+  const target = companionTargetFor(platform, architecture);
+  if (target === null) return null;
+  const pinned = component.targets[target];
+  return pinned ? { target, asset: pinned.asset, sha256: pinned.sha256 } : null;
+}
+async function downloadCompanionArtifact(component, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const architecture = deps.architecture ?? process.arch;
+  const pinned = companionAssetFor(component, platform, architecture);
+  if (pinned === null) {
+    throw new LocalCliError({
+      code: "COMPANION_NO_BUILD_FOR_HOST",
+      message: `Release ${component.version} carries no desktop companion for ${platform}-${architecture}.`,
+      hint: "The companions are built for macOS and Windows on arm64 and x64."
+    });
+  }
+  const url = releaseAssetUrl(component.tag, pinned.asset);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const response = await fetchImpl(url);
+  if (!response.ok) {
+    throw new LocalCliError({
+      code: "COMPANION_ASSET_FETCH_FAILED",
+      message: `GET ${url} returned HTTP ${response.status.toString()}.`,
+      hint: "The release the platform is pinned to should carry this file. Try again, or run 'm8t companion repair' once the network is back."
+    });
+  }
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (bytes.byteLength > MAX_ASSET_BYTES) {
+    throw new LocalCliError({
+      code: "COMPANION_ASSET_TOO_LARGE",
+      message: `${pinned.asset} is larger than this command will accept.`
+    });
+  }
+  const digest = createHash6("sha256").update(bytes).digest("hex");
+  if (digest !== pinned.sha256) {
+    throw new LocalCliError({
+      code: "COMPANION_ASSET_DIGEST_MISMATCH",
+      message: `${pinned.asset} does not match the digest the release pins for it.`,
+      hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
+    });
+  }
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs33.mkdtemp(path36.join(os16.tmpdir(), "m8t-companion-"))))();
+  const dispose = async () => {
+    await fs33.rm(root, { recursive: true, force: true }).catch(() => void 0);
+  };
+  try {
+    const archive = path36.join(root, pinned.asset);
+    await fs33.writeFile(archive, bytes, { mode: 384 });
+    const unpacked = path36.join(root, "unpacked");
+    await fs33.mkdir(unpacked, { recursive: false, mode: 448 });
+    await (deps.extract ?? extractArchive)(archive, unpacked);
+    await fs33.rm(archive, { force: true });
+    return {
+      version: component.version,
+      artifactManifestPath: path36.join(unpacked, "artifact-v1.json"),
+      dispose
+    };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
+
+// src/commands/companion/install.ts
+function defaultLocalCompanionInstallOptions() {
+  const cliEntry = process.argv[1];
+  if (!cliEntry) throw new Error("Cannot resolve the installed CLI entry");
+  const homeDirectory = os17.homedir();
+  const platform = process.platform;
+  return {
+    homeDirectory,
+    platform,
+    architecture: process.arch,
+    localAppData: process.env.LOCALAPPDATA,
+    nodeExecutable: process.execPath,
+    cliEntry,
+    setStartAtLogin: (executable, enabled) => setCompanionStartAtLogin({ homeDirectory, platform, executable, enabled }),
+    getStartAtLogin: (executable) => getCompanionStartAtLogin({ homeDirectory, platform, executable })
+  };
+}
+async function convergeCompanionFromChannel(converge2, stagedDirectory) {
+  let artifactManifestPath;
+  let dispose = () => Promise.resolve();
+  if (stagedDirectory !== void 0) {
+    artifactManifestPath = path37.resolve(stagedDirectory, "artifact-v1.json");
+  } else {
+    const release = await readCompanionRelease();
+    if (release === null) return { state: "not-released" };
+    const build = await downloadCompanionArtifact(release.component);
+    artifactManifestPath = build.artifactManifestPath;
+    dispose = build.dispose;
+  }
+  const gateway = await resolveGatewayContext({ interactive: false });
+  try {
+    return await converge2({
+      ...defaultLocalCompanionInstallOptions(),
+      artifactManifestPath,
+      gatewayOrigin: new URL(gateway.gatewayUrl).origin
+    });
+  } finally {
+    await dispose();
+  }
+}
+async function runCompanionInstallCommand(stdout, install) {
+  const state = await install();
+  if (state.state === "not-released") {
+    stdout.write(
+      "The release this platform is pinned to carries no desktop companions.\nThey arrive with a platform release \u2014 run: m8t platform update\n"
+    );
+    return 1;
+  }
+  if (state.state !== "installed") {
+    stdout.write("Desktop companions need repair.\nRun: m8t companion repair\n");
+    return 1;
+  }
+  stdout.write(
+    `Desktop companions installed: Stacey and Azzy are ready.
+Version: ${state.version}
+`
+  );
+  return 0;
+}
+var CompanionInstallCommand = class extends M8tCommand {
+  static paths = [["companion", "install"]];
+  static usage = Command57.Usage({
+    description: "Install the desktop companions for this user from the release channel.",
+    examples: [
+      ["Install the released build", "$0 companion install"],
+      [
+        "Install one built from this clone",
+        "$0 companion install --from apps/companion/dist-artifacts/darwin-arm64"
+      ]
+    ]
+  });
+  from = Option54.String("--from", {
+    description: "A locally staged build directory instead of the released one."
+  });
+  async executeCommand() {
+    return runCompanionInstallCommand(
+      this.context.stdout,
+      () => convergeCompanionFromChannel(installCompanion, this.from)
+    );
+  }
+};
+
+// src/commands/bootstrap/finish.ts
+var BootstrapFinishCommand = class extends M8tCommand {
+  static paths = [["bootstrap", "finish"]];
+  static usage = Command58.Usage({
+    description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
+    details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding intake \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
+    examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
+  });
+  repoRoot = Option55.String("--repo-root");
+  subscription = Option55.String("--subscription");
+  resourceGroup = Option55.String("--resource-group");
+  async executeCommand() {
+    const state = await readBootstrapState();
+    if (!state) {
+      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state.", hint: "Run 'm8t bootstrap launch' first." });
+    }
+    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+    if (doc.status !== "done") {
+      throw new LocalCliError({
+        code: "BOOTSTRAP_FINISH_NOT_DONE",
+        message: `The platform is not live yet (status: ${doc.status}, phase: ${doc.phase}).`,
+        hint: "Wait for 'm8t bootstrap status --watch' to reach done."
+      });
+    }
+    const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
+    const markerDir = path38.join(os18.homedir(), ".m8t");
+    await fs34.mkdir(markerDir, { recursive: true });
+    await fs34.writeFile(path38.join(markerDir, "repo-root"), `${repoRoot}
+`, "utf8");
+    const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? state.subscriptionId;
+    const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? state.resourceGroup;
+    let webappUrl;
+    try {
+      const d = await discoverGateway({ subscriptionId, interactive: false, resourceGroup });
+      await writeConfig({
+        gatewayUrl: d.gatewayUrl,
+        gatewayClientId: d.gatewayClientId,
+        gatewayTenantId: d.gatewayTenantId,
+        subscriptionId: d.subscriptionId,
+        containerAppResourceId: d.containerAppResourceId,
+        cachedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      webappUrl = d.gatewayUrl;
+      this.context.stdout.write(
+        `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")}
+  gateway:  ${d.gatewayUrl}
+  foundry:  ${doc.result?.foundryEndpoint ?? "-"}
+
+`
+      );
+      try {
+        await ensureGatewayRedirectUri(d.gatewayClientId, new URL(d.gatewayUrl).host);
+      } catch (e) {
+        const err = e;
+        this.context.stderr.write(
+          `  ${colors.error("\u26A0 could not authorize sign-in for your webapp:")} ${err.message}
+  ${colors.hint(`Until this is fixed, opening ${d.gatewayUrl} will fail with AADSTS50011 (redirect URI mismatch).`)}
+  ${colors.hint("Ask a directory admin to run:")}
+  ${colors.hint(`    m8t bootstrap finish --repo-root ${repoRoot}   # (as an admin), or by hand:`)}
+  ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
+
+`
+        );
+      }
+      try {
+        const verdict = await runUsagePhase(
+          buildPrereqDeps({ subscription: subscriptionId, resourceGroup }),
+          { fix: true, onProgress: (m) => {
+            this.context.stdout.write(colors.dim(`  ${m}
+`));
+          } }
+        );
+        const rows = verdict.results.filter((r) => r.slug !== "signin-redirect-uri");
+        const unresolved = rows.filter((r) => r.status === "fail");
+        if (unresolved.length === 0) {
+          this.context.stdout.write(`  ${colors.success("\u2713 your account can reach Foundry and read the platform Key Vault")}
+
+`);
+        }
+        for (const r of unresolved) {
+          this.context.stderr.write(
+            `  ${colors.error("\u26A0 could not grant you access:")} ${r.detail}
+` + (r.remedy ? `  ${colors.hint(`Fix it with: ${r.remedy}`)}
+` : "") + "\n"
+          );
+        }
+      } catch (e) {
+        this.context.stderr.write(
+          `  ${colors.error("\u26A0 could not check or grant your platform access:")} ${e.message}
+  ${colors.hint("Run 'm8t prereqs --fix' when you can \u2014 until then your AI team will not load and worker deploys will fail.")}
+
+`
+        );
+      }
+    } catch (e) {
+      const err = e;
+      this.context.stdout.write(`${colors.success("\u2705 The platform is live.")}
+
+`);
+      this.context.stderr.write(
+        `  ${colors.hint(`\u26A0 couldn't auto-point your local tools at the gateway: ${err.message}`)}
+` + (err.hint ? `  ${colors.hint(err.hint)}
+` : "") + "\n"
+      );
+    }
+    if (webappUrl !== void 0 && companionsSupportHost()) {
+      try {
+        const companion = await convergeCompanionFromChannel(installCompanion);
+        if (companion.state === "installed") {
+          this.context.stdout.write(
+            "Desktop companions installed: Stacey and Azzy are ready.\n\n"
+          );
+        } else if (companion.state !== "not-released") {
+          throw new Error("companion installation is not verified");
+        }
+      } catch (e) {
+        const reason = e instanceof Error ? e.message : String(e);
+        this.context.stdout.write(
+          `Platform installation succeeded, but the desktop companions need repair.
+Run: m8t companion repair
+  ${colors.hint(reason)}
+
+`
+        );
+      }
+    }
+    let brainOrg = null;
+    try {
+      const credsRaw = await fs34.readFile(path38.join(markerDir, "github-app.json"), "utf8");
+      const creds = JSON.parse(credsRaw);
+      brainOrg = typeof creds.org === "string" ? creds.org : null;
+    } catch {
+    }
+    this.context.stdout.write(renderInstallSummary({ webappUrl, brainOrg }) + "\n");
+    this.context.stdout.write(
+      `${colors.field("Optional local tooling for your coding agent:")}
+  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
+  \u2022 Azure-capable MCP servers (microsoft/azure-skills, Microsoft Learn) \u2014 see the optional steps in guides/install.md.
+  \u2022 Deploy workers conversationally with the opt-in persona skills \u2014 see guides/workers.md.
+  \u2022 Make sure your m8t CLI is current: npm i -g @m8t-stack/cli@latest
+
+${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP servers load only on a fresh start.
+`
+    );
+    try {
+      await reactiveSeedOnFinish({
+        endpoint: doc.result?.foundryEndpoint,
+        subscriptionId,
+        stdout: (s) => this.context.stdout.write(s)
+      });
+    } catch (e) {
+      this.context.stderr.write(
+        `  ${colors.dim(`(company-profile seed deferred: ${e instanceof Error ? e.message : String(e)} \u2014 run 'm8t bootstrap seed-profile' later)`)}
+`
+      );
+    }
+    return 0;
+  }
+};
+
+// src/commands/bootstrap/ui.ts
+import * as fs36 from "fs";
+import * as os20 from "os";
+import * as path40 from "path";
+import { Command as Command59, Option as Option56 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
+init_errors();
+
+// src/lib/bootstrap-ui.ts
+import * as fs35 from "fs";
+import * as net from "net";
+import * as os19 from "os";
+import * as path39 from "path";
+import { randomBytes as randomBytes3 } from "crypto";
+import { spawn as spawn8, spawnSync as spawnSync6 } from "child_process";
+init_errors();
+init_rbac();
+
+// src/lib/intake-agent.ts
+init_esm();
+var INTAKE_PERSONA = "azure-advisor-intake";
+var INTAKE_AGENT = INTAKE_AGENT_NAME;
+async function deployIntakeAgent(args) {
+  try {
+    return await deployPromptAdvisor({
+      credential: args.credential,
+      endpoint: args.endpoint,
+      repoRoot: args.repoRoot,
+      persona: INTAKE_PERSONA,
+      agentName: INTAKE_AGENT,
+      model: args.model,
+      fieldOverrides: args.fieldOverrides
+    });
+  } catch (e) {
+    if (e && typeof e === "object" && "code" in e) {
+      const err = e;
+      if (err.code === "ADVISOR_PERSONA_MISSING") {
+        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new LocalCliError2({
+          code: "INTAKE_PERSONA_MISSING",
+          message: err.message,
+          hint: err.hint,
+          cause: err.cause
+        });
+      }
+      if (err.code === "ADVISOR_NO_MODEL") {
+        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new LocalCliError2({
+          code: "INTAKE_NO_MODEL",
+          message: err.message,
+          hint: err.hint,
+          cause: err.cause
+        });
+      }
+      if (err.code === "ADVISOR_BAD_EFFORT") {
+        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
+        throw new LocalCliError2({
+          code: "INTAKE_BAD_EFFORT",
+          message: err.message,
+          hint: err.hint,
+          cause: err.cause
+        });
+      }
+    }
+    throw e;
+  }
+}
+
+// src/lib/bootstrap-ui.ts
 function sleep3(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 function isAuthorizationShapedError(error) {
   const seen = /* @__PURE__ */ new Set();
@@ -30522,11 +31656,11 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path35.join(args.repoRoot, "apps", "web", ".env.local");
+  const envPath = path39.join(args.repoRoot, "apps", "web", ".env.local");
   let prior = "";
-  if (fs32.existsSync(envPath)) {
-    prior = fs32.readFileSync(envPath, "utf8");
-    fs32.copyFileSync(envPath, envPath + ".bak");
+  if (fs35.existsSync(envPath)) {
+    prior = fs35.readFileSync(envPath, "utf8");
+    fs35.copyFileSync(envPath, envPath + ".bak");
   }
   const priorSecret = readValidInternalSecret(prior);
   const internalSecret = priorSecret ?? (args.randomBytesImpl ?? randomBytes3)(32).toString("base64url");
@@ -30552,9 +31686,9 @@ function writeWebEnvLocal(args) {
     "NEXT_PUBLIC_M8T_ONBOARDING=1",
     ""
   ].join("\n");
-  fs32.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
+  fs35.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
   try {
-    fs32.chmodSync(envPath, 384);
+    fs35.chmodSync(envPath, 384);
   } catch {
   }
   return envPath;
@@ -30570,10 +31704,10 @@ function readValidInternalSecret(envText) {
   return isValidInternalSecret(values[0]) ? values[0] : void 0;
 }
 function readWebInternalSecret(repoRoot) {
-  const envPath = path35.join(repoRoot, "apps", "web", ".env.local");
+  const envPath = path39.join(repoRoot, "apps", "web", ".env.local");
   let secret;
   try {
-    secret = readValidInternalSecret(fs32.readFileSync(envPath, "utf8"));
+    secret = readValidInternalSecret(fs35.readFileSync(envPath, "utf8"));
   } catch {
     secret = void 0;
   }
@@ -30597,14 +31731,14 @@ function assertNodeVersion(versionString = process.version) {
   }
 }
 function runInherit(cmd, cmdArgs, cwd, failCode) {
-  return new Promise((resolve3, reject) => {
-    const child = spawn7(cmd, cmdArgs, { cwd, stdio: "inherit", shell: process.platform === "win32" });
+  return new Promise((resolve4, reject) => {
+    const child = spawn8(cmd, cmdArgs, { cwd, stdio: "inherit", shell: process.platform === "win32" });
     child.on("error", (e) => {
       reject(new LocalCliError({ code: failCode, message: `Failed to start '${cmd}': ${e.message}` }));
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve3();
+        resolve4();
       } else {
         const opts = {
           code: failCode,
@@ -30624,40 +31758,40 @@ async function installWebDeps(repoRoot) {
   });
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
-function onboardingUiPaths(home = os17.homedir()) {
-  const dir = path35.join(home, ".m8t");
+function onboardingUiPaths(home = os19.homedir()) {
+  const dir = path39.join(home, ".m8t");
   return {
-    logPath: path35.join(dir, "onboarding-ui.log"),
-    pidPath: path35.join(dir, "onboarding-ui.pid")
+    logPath: path39.join(dir, "onboarding-ui.log"),
+    pidPath: path39.join(dir, "onboarding-ui.pid")
   };
 }
-function onboardingRelayPaths(home = os17.homedir()) {
-  const dir = path35.join(home, ".m8t");
+function onboardingRelayPaths(home = os19.homedir()) {
+  const dir = path39.join(home, ".m8t");
   return {
-    logPath: path35.join(dir, "onboarding-relay.log"),
-    pidPath: path35.join(dir, "onboarding-relay.pid")
+    logPath: path39.join(dir, "onboarding-relay.log"),
+    pidPath: path39.join(dir, "onboarding-relay.pid")
   };
 }
 function isLocalPortOpen(port) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const s = net.createConnection({ host: "127.0.0.1", port });
     s.setTimeout(1e3);
     s.on("connect", () => {
       s.destroy();
-      resolve3(true);
+      resolve4(true);
     });
     s.on("error", () => {
-      resolve3(false);
+      resolve4(false);
     });
     s.on("timeout", () => {
       s.destroy();
-      resolve3(false);
+      resolve4(false);
     });
   });
 }
 function removePidFile(pidPath) {
   try {
-    fs32.unlinkSync(pidPath);
+    fs35.unlinkSync(pidPath);
   } catch {
   }
 }
@@ -30670,7 +31804,7 @@ function parseManagedPid(text) {
 function readLiveManagedPid(pidPath) {
   let text;
   try {
-    text = fs32.readFileSync(pidPath, "utf8").trim();
+    text = fs35.readFileSync(pidPath, "utf8").trim();
   } catch {
     return null;
   }
@@ -30709,9 +31843,9 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs32.mkdirSync(path35.dirname(logPath), { recursive: true });
-  const fd = fs32.openSync(logPath, "a");
-  const child = spawn7("pnpm", ["--filter", "web", "dev"], {
+  fs35.mkdirSync(path39.dirname(logPath), { recursive: true });
+  const fd = fs35.openSync(logPath, "a");
+  const child = spawn8("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
     stdio: ["ignore", fd, fd],
@@ -30719,7 +31853,7 @@ async function serveOnboardingUiDetached(args) {
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
-  fs32.closeSync(fd);
+  fs35.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_DEV_SPAWN_FAILED",
@@ -30728,7 +31862,7 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   child.unref();
-  fs32.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs35.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -30760,9 +31894,9 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs32.mkdirSync(path35.dirname(logPath), { recursive: true });
-  const fd = fs32.openSync(logPath, "a");
-  const child = spawn7("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
+  fs35.mkdirSync(path39.dirname(logPath), { recursive: true });
+  const fd = fs35.openSync(logPath, "a");
+  const child = spawn8("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
     cwd: args.repoRoot,
     detached: true,
     stdio: ["ignore", fd, fd],
@@ -30779,7 +31913,7 @@ async function serveOnboardingRelayDetached(args) {
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
-  fs32.closeSync(fd);
+  fs35.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_RELAY_SPAWN_FAILED",
@@ -30788,7 +31922,7 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   child.unref();
-  fs32.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs35.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -30797,9 +31931,9 @@ async function serveOnboardingRelayDetached(args) {
   }
   return { alreadyRunning: false, logPath };
 }
-function autoOpenOnboardingUi(url, open = tryOpenUrl) {
+function autoOpenOnboardingUi(url, open3 = tryOpenUrl) {
   try {
-    const result2 = open(url);
+    const result2 = open3(url);
     if (result2 instanceof Promise) {
       result2.catch(() => {
       });
@@ -30810,7 +31944,7 @@ function autoOpenOnboardingUi(url, open = tryOpenUrl) {
 function stopPidFile(pidPath) {
   let pidStr;
   try {
-    pidStr = fs32.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs35.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -30827,12 +31961,12 @@ function stopPidFile(pidPath) {
     }
   }
   try {
-    fs32.unlinkSync(pidPath);
+    fs35.unlinkSync(pidPath);
   } catch {
   }
   return true;
 }
-function stopOnboardingUi(home = os17.homedir()) {
+function stopOnboardingUi(home = os19.homedir()) {
   const uiStopped = stopPidFile(onboardingUiPaths(home).pidPath);
   const relayStopped = stopPidFile(onboardingRelayPaths(home).pidPath);
   return uiStopped || relayStopped;
@@ -31121,9 +32255,9 @@ async function resolveSubscriptionInventory(args) {
     const scan2 = scanFn(args.subscriptionId);
     void scan2.catch(() => {
     });
-    const timeout = new Promise((resolve3) => {
+    const timeout = new Promise((resolve4) => {
       timer = setTimeout(() => {
-        resolve3("timeout");
+        resolve4("timeout");
       }, deadlineMs);
     });
     const raced = await Promise.race([scan2, timeout]);
@@ -31154,7 +32288,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Deploy Azzy + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -31175,16 +32309,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option55.String("--repo-root");
-  port = Option55.String("--port", "3000");
-  endpoint = Option55.String("--endpoint", {
+  repoRoot = Option56.String("--repo-root");
+  port = Option56.String("--port", "3000");
+  endpoint = Option56.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option55.Boolean("--prep-only", false);
-  skipInstall = Option55.Boolean("--skip-install", false);
-  stop = Option55.Boolean("--stop", false);
-  foreground = Option55.Boolean("--foreground", false);
-  voice = Option55.Boolean("--voice", false, {
+  prepOnly = Option56.Boolean("--prep-only", false);
+  skipInstall = Option56.Boolean("--skip-install", false);
+  stop = Option56.Boolean("--stop", false);
+  foreground = Option56.Boolean("--foreground", false);
+  voice = Option56.Boolean("--voice", false, {
     description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
   });
   async executeCommand() {
@@ -31219,7 +32353,7 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs33.existsSync(path36.join(os18.homedir(), ".m8t", "config.yaml"))) {
+    if (fs36.existsSync(path40.join(os20.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
     const credential2 = new DefaultAzureCredential24();
@@ -31346,10 +32480,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
     details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
     examples: [
@@ -31357,11 +32491,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option56.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option56.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
-  watch = Option56.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option56.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option56.String("--github-app-creds");
+  endpoint = Option57.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option57.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
+  watch = Option57.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option57.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option57.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -31421,10 +32555,10 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/telemetry/enroll.ts
-import * as fs34 from "fs";
-import * as os19 from "os";
-import * as path37 from "path";
-import { Command as Command60, Option as Option57 } from "clipanion";
+import * as fs37 from "fs";
+import * as os21 from "os";
+import * as path41 from "path";
+import { Command as Command61, Option as Option58 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -31506,7 +32640,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command60.Usage({
+  static usage = Command61.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -31514,11 +32648,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option57.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option57.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option57.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option57.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option57.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option58.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option58.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option58.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option58.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option58.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -31551,13 +32685,13 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ...company ? { company } : {},
       ...contactEmail ? { contactEmail } : {}
     });
-    const keyDir = fs34.mkdtempSync(path37.join(os19.tmpdir(), "m8t-ingest-key-"));
-    const keyFile = path37.join(keyDir, "key");
+    const keyDir = fs37.mkdtempSync(path41.join(os21.tmpdir(), "m8t-ingest-key-"));
+    const keyFile = path41.join(keyDir, "key");
     try {
-      fs34.writeFileSync(keyFile, ingestKey, { mode: 384 });
+      fs37.writeFileSync(keyFile, ingestKey, { mode: 384 });
       await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);
     } finally {
-      fs34.rmSync(keyDir, { recursive: true, force: true });
+      fs37.rmSync(keyDir, { recursive: true, force: true });
     }
     this.context.stdout.write(
       `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
@@ -31567,6 +32701,775 @@ var TelemetryEnrollCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/companion/bridge.ts
+import { Command as Command62 } from "clipanion";
+
+// ../../packages/companion-bridge-contract/src/index.ts
+var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
+var COMPANION_REQUEST_ID_MAX_LENGTH = 128;
+var COMPANION_AGENT_NAME_MAX_LENGTH = 256;
+var COMPANION_DESKTOP_AFTER_MAX_LENGTH = 256;
+var COMPANION_BRIDGE_LINE_MAX_LENGTH = 14e4;
+var PERSONAS = /* @__PURE__ */ new Set([
+  "startup-advisor",
+  "azure-advisor"
+]);
+var FAILURE_REASONS = /* @__PURE__ */ new Set([
+  "not-connected",
+  "not-authorized",
+  "mate-unavailable",
+  "busy",
+  "bad-request"
+]);
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+var URL_SAFE_OPAQUE_ID = /^[A-Za-z0-9_-]+$/u;
+var SEVERITIES2 = /* @__PURE__ */ new Set(["critical", "recommended", "optional"]);
+var VERSION3 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/u;
+function isVersionOrNull(value) {
+  return value === null || typeof value === "string" && VERSION3.test(value);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value);
+  return actual.length === keys.length && keys.every((key2) => Object.hasOwn(value, key2));
+}
+function isPersonaKey(value) {
+  return typeof value === "string" && PERSONAS.has(value);
+}
+function isBoundedPlainString(value, maxLength) {
+  return typeof value === "string" && value.length > 0 && value.length <= maxLength && !CONTROL_CHARACTERS.test(value);
+}
+function isRequestId(value) {
+  return isBoundedPlainString(value, COMPANION_REQUEST_ID_MAX_LENGTH);
+}
+function isCanonicalInstant(value) {
+  if (typeof value !== "string") return false;
+  const time = Date.parse(value);
+  return Number.isFinite(time) && new Date(time).toISOString() === value && time <= Date.now();
+}
+function requestError() {
+  throw new Error("Invalid companion bridge request");
+}
+function eventError() {
+  throw new Error("Invalid companion bridge event");
+}
+function isGatewayOrigin(value) {
+  if (typeof value !== "string" || !value.startsWith("https://")) {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  return parsed.origin === value && parsed.protocol === "https:" && parsed.username === "" && parsed.password === "" && parsed.pathname === "/" && parsed.search === "" && parsed.hash === "";
+}
+function isValidMateRoute(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("#")) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value, "https://companion.invalid");
+    if (parsed.origin !== "https://companion.invalid" || !/^\/mates\/(?:startup-advisor|azure-advisor)$/u.test(parsed.pathname)) {
+      return false;
+    }
+    const entries = [...parsed.searchParams.entries()];
+    const keys = entries.map(([key2]) => key2);
+    if (new Set(keys).size !== keys.length || keys.some(
+      (key2) => key2 !== "desktopPending" && key2 !== "desktopAfter"
+    )) {
+      return false;
+    }
+    if (parsed.searchParams.has("desktopPending") && parsed.searchParams.get("desktopPending") !== "1") {
+      return false;
+    }
+    if (parsed.searchParams.has("desktopAfter")) {
+      const after = parsed.searchParams.get("desktopAfter");
+      if (after === null || after.length === 0 || after.length > COMPANION_DESKTOP_AFTER_MAX_LENGTH || !URL_SAFE_OPAQUE_ID.test(after)) {
+        return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parseRequest(value) {
+  if (!isRecord2(value)) return requestError();
+  if (value.type === "roster") {
+    if (!hasExactKeys(value, ["type"])) return requestError();
+    return { type: "roster" };
+  }
+  if (value.type === "update") {
+    if (!hasExactKeys(value, ["type"])) return requestError();
+    return { type: "update" };
+  }
+  if (value.type !== "send" || !hasExactKeys(value, [
+    "type",
+    "requestId",
+    "personaKey",
+    "draftRevision",
+    "text"
+  ]) || !isRequestId(value.requestId) || !isPersonaKey(value.personaKey) || !Number.isSafeInteger(value.draftRevision) || value.draftRevision < 0 || typeof value.text !== "string" || value.text.trim().length === 0 || [...value.text].length > COMPANION_MESSAGE_MAX_CODE_POINTS) {
+    return requestError();
+  }
+  return {
+    type: "send",
+    requestId: value.requestId,
+    personaKey: value.personaKey,
+    draftRevision: value.draftRevision,
+    text: value.text
+  };
+}
+function parseRequestLine(line2) {
+  if (typeof line2 !== "string" || line2.length > COMPANION_BRIDGE_LINE_MAX_LENGTH || /[\r\n]/u.test(line2)) {
+    return requestError();
+  }
+  try {
+    return parseRequest(JSON.parse(line2));
+  } catch {
+    return requestError();
+  }
+}
+function parseMate(value) {
+  if (!isRecord2(value) || !hasExactKeys(value, [
+    "personaKey",
+    "agentName",
+    "displayName",
+    "portraitKey",
+    "activeSince"
+  ]) || !isPersonaKey(value.personaKey) || !isBoundedPlainString(
+    value.agentName,
+    COMPANION_AGENT_NAME_MAX_LENGTH
+  ) || !isCanonicalInstant(value.activeSince)) {
+    return eventError();
+  }
+  const identity = value.personaKey === "startup-advisor" ? { displayName: "Stacey", portraitKey: "stacey" } : { displayName: "Azzy", portraitKey: "azzy" };
+  if (value.displayName !== identity.displayName || value.portraitKey !== identity.portraitKey) {
+    return eventError();
+  }
+  return {
+    personaKey: value.personaKey,
+    agentName: value.agentName,
+    displayName: identity.displayName,
+    portraitKey: identity.portraitKey,
+    activeSince: value.activeSince
+  };
+}
+function parseEvent(value) {
+  if (!isRecord2(value)) return eventError();
+  if (value.type === "update") {
+    if (!hasExactKeys(value, ["type", "installed", "available", "severity"]) || !isVersionOrNull(value.installed) || !isVersionOrNull(value.available) || !(value.severity === null || SEVERITIES2.has(value.severity))) {
+      return eventError();
+    }
+    return {
+      type: "update",
+      installed: value.installed,
+      available: value.available,
+      severity: value.severity
+    };
+  }
+  if (value.type === "roster") {
+    if (!hasExactKeys(value, ["type", "origin", "mates"]) || !isGatewayOrigin(value.origin) || !Array.isArray(value.mates) || value.mates.length !== 2) {
+      return eventError();
+    }
+    const mates = value.mates.map(parseMate);
+    if (new Set(mates.map(({ personaKey }) => personaKey)).size !== 2 || new Set(mates.map(({ agentName }) => agentName)).size !== 2) {
+      return eventError();
+    }
+    return { type: "roster", origin: value.origin, mates };
+  }
+  if (value.type === "failed") {
+    const keys = value.requestId === void 0 ? ["type", "reason"] : ["type", "requestId", "reason"];
+    if (!hasExactKeys(value, keys) || value.requestId !== void 0 && !isRequestId(value.requestId) || typeof value.reason !== "string" || !FAILURE_REASONS.has(value.reason)) {
+      return eventError();
+    }
+    return value.requestId === void 0 ? {
+      type: "failed",
+      reason: value.reason
+    } : {
+      type: "failed",
+      requestId: value.requestId,
+      reason: value.reason
+    };
+  }
+  if (value.type === "completed") {
+    if (!hasExactKeys(value, ["type", "requestId"]) || !isRequestId(value.requestId)) {
+      return eventError();
+    }
+    return { type: "completed", requestId: value.requestId };
+  }
+  if (value.type === "dispatching" || value.type === "accepted") {
+    if (!hasExactKeys(value, [
+      "type",
+      "requestId",
+      "personaKey",
+      "route"
+    ]) || !isRequestId(value.requestId) || !isPersonaKey(value.personaKey) || !isValidMateRoute(value.route) || !value.route.startsWith(`/mates/${value.personaKey}`)) {
+      return eventError();
+    }
+    return {
+      type: value.type,
+      requestId: value.requestId,
+      personaKey: value.personaKey,
+      route: value.route
+    };
+  }
+  if (value.type === "indeterminate") {
+    if (!hasExactKeys(value, ["type", "requestId", "stage", "route"]) || !isRequestId(value.requestId) || value.stage !== "dispatch" && value.stage !== "after-accept" || !isValidMateRoute(value.route)) {
+      return eventError();
+    }
+    return {
+      type: "indeterminate",
+      requestId: value.requestId,
+      stage: value.stage,
+      route: value.route
+    };
+  }
+  return eventError();
+}
+function serializeEvent(value) {
+  return JSON.stringify(parseEvent(value));
+}
+
+// src/lib/companion-chat-client.ts
+import { stat as stat3 } from "fs/promises";
+var RESPONSE_MAX_BYTES = 1e6;
+var REQUEST_DEADLINE_MS = 12e4;
+var OPAQUE_ID = /^[A-Za-z0-9_-]{1,256}$/u;
+var AGENT_NAME_MAX_LENGTH = 256;
+var PredispatchFailure = class extends Error {
+  constructor(reason) {
+    super("companion bridge pre-dispatch failure");
+    this.reason = reason;
+  }
+  reason;
+};
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+function isAgentName(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= AGENT_NAME_MAX_LENGTH && !hasControlCharacter(value);
+}
+function authenticatedHeaders(token) {
+  return {
+    accept: "application/json",
+    authorization: `Bearer ${token}`
+  };
+}
+function gatewayOrigin(gateway) {
+  let url;
+  try {
+    url = new URL(gateway.gatewayUrl);
+  } catch {
+    throw new PredispatchFailure("not-connected");
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    throw new PredispatchFailure("not-connected");
+  }
+  return url.origin;
+}
+async function readBoundedText(response, maxBytes = RESPONSE_MAX_BYTES) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null && Number(declared) > maxBytes) {
+    throw new Error("bounded response rejected");
+  }
+  if (!response.body) throw new Error("response body unavailable");
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let total = 0;
+  let text = "";
+  for (; ; ) {
+    const part = await reader.read();
+    if (part.done) break;
+    total += part.value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => void 0);
+      throw new Error("bounded response rejected");
+    }
+    text += decoder.decode(part.value, { stream: true });
+  }
+  text += decoder.decode();
+  return text;
+}
+async function readJsonEnvelope(response) {
+  if (!response.ok) {
+    const reason = response.status === 401 || response.status === 403 ? "not-authorized" : response.status === 409 ? "busy" : "not-connected";
+    throw new PredispatchFailure(reason);
+  }
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new PredispatchFailure("not-connected");
+  }
+  let envelope;
+  try {
+    envelope = JSON.parse(await readBoundedText(response));
+  } catch (error) {
+    if (error instanceof PredispatchFailure) throw error;
+    throw new PredispatchFailure("not-connected");
+  }
+  if (!isRecord3(envelope) || envelope.ok !== true || !("data" in envelope)) {
+    throw new PredispatchFailure("not-connected");
+  }
+  return envelope.data;
+}
+function decodeAgents(data) {
+  if (!isRecord3(data) || !Array.isArray(data.agents)) {
+    throw new PredispatchFailure("mate-unavailable");
+  }
+  return data.agents.filter(isRecord3);
+}
+function resolveAgentName(agents, personaKey) {
+  const matches = agents.filter(
+    (agent) => agent.personaKey === personaKey && isAgentName(agent.name)
+  );
+  if (matches.length !== 1) {
+    throw new PredispatchFailure("mate-unavailable");
+  }
+  const match = matches[0];
+  if (!isAgentName(match.name)) {
+    throw new PredispatchFailure("mate-unavailable");
+  }
+  return match.name;
+}
+function decodeConversationId(data) {
+  if (!isRecord3(data) || typeof data.id !== "string" || !OPAQUE_ID.test(data.id)) {
+    throw new PredispatchFailure("not-connected");
+  }
+  return data.id;
+}
+function decodeLastMessageId(data) {
+  if (!isRecord3(data) || !Array.isArray(data.messages)) {
+    throw new PredispatchFailure("not-connected");
+  }
+  const messages = data.messages;
+  const last = messages.at(-1);
+  if (!isRecord3(last) || typeof last.id !== "string" || !OPAQUE_ID.test(last.id)) {
+    return void 0;
+  }
+  return last.id;
+}
+function mateRoute(personaKey, desktopAfter) {
+  const marker = desktopAfter === void 0 ? "" : `&desktopAfter=${desktopAfter}`;
+  return `/mates/${personaKey}?desktopPending=1${marker}`;
+}
+function emitFailure(sink, reason, requestId) {
+  const event = parseEvent(
+    requestId === void 0 ? { type: "failed", reason } : { type: "failed", requestId, reason }
+  );
+  sink(event);
+  return event;
+}
+function classifyUnknownPredispatch(error) {
+  return error instanceof PredispatchFailure ? error.reason : "not-connected";
+}
+async function acquireContext(deps) {
+  let gateway;
+  let token;
+  try {
+    gateway = await (deps.resolveGatewayContext ?? resolveGatewayContext)({
+      interactive: false
+    });
+    token = await (deps.getFoundryToken ?? getFoundryToken)();
+  } catch {
+    throw new PredispatchFailure("not-authorized");
+  }
+  return { token, origin: gatewayOrigin(gateway) };
+}
+async function fetchAgents(fetchImpl, origin, token, signal) {
+  let response;
+  try {
+    response = await fetchImpl(`${origin}/api/agents`, {
+      headers: authenticatedHeaders(token),
+      signal
+    });
+  } catch {
+    throw new PredispatchFailure("not-connected");
+  }
+  return decodeAgents(await readJsonEnvelope(response));
+}
+function createDeadline(deps) {
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => {
+      controller.abort();
+    },
+    deps.deadlineMs ?? REQUEST_DEADLINE_MS
+  );
+  return { controller, timer };
+}
+async function readInstallEpoch() {
+  try {
+    const stats = await stat3(getConfigPath());
+    const candidates = [stats.birthtimeMs, stats.mtimeMs].filter(
+      (value) => Number.isFinite(value) && value > 0
+    );
+    if (candidates.length === 0) return null;
+    return Math.min(...candidates);
+  } catch {
+    return null;
+  }
+}
+async function rosterCompanions(sink, deps = {}) {
+  const { controller, timer } = createDeadline(deps);
+  try {
+    const { token, origin } = await acquireContext(deps);
+    const agents = await fetchAgents(
+      deps.fetch ?? fetch,
+      origin,
+      token,
+      controller.signal
+    );
+    const now = (deps.now ?? Date.now)();
+    const installed = await (deps.installEpoch ?? readInstallEpoch)();
+    const activeSince = new Date(
+      installed === null || installed > now ? now : installed
+    ).toISOString();
+    const mates = [
+      {
+        personaKey: "startup-advisor",
+        agentName: resolveAgentName(agents, "startup-advisor"),
+        displayName: "Stacey",
+        portraitKey: "stacey",
+        activeSince
+      },
+      {
+        personaKey: "azure-advisor",
+        agentName: resolveAgentName(agents, "azure-advisor"),
+        displayName: "Azzy",
+        portraitKey: "azzy",
+        activeSince
+      }
+    ];
+    const event = parseEvent({ type: "roster", origin, mates });
+    sink(event);
+    return event;
+  } catch (error) {
+    return emitFailure(sink, classifyUnknownPredispatch(error));
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function drainAcceptedSse(response) {
+  const text = await readBoundedText(response);
+  const frames = text.split(/\r?\n\r?\n/u);
+  let sawDone = false;
+  for (const frame of frames) {
+    if (frame.trim().length === 0) continue;
+    const dataLines = frame.split(/\r?\n/u).filter((line2) => line2.startsWith("data:")).map((line2) => line2.slice(5).trimStart());
+    if (dataLines.length === 0) continue;
+    const data = dataLines.join("\n");
+    if (sawDone) throw new Error("data after terminal stream marker");
+    if (data === "[DONE]") {
+      sawDone = true;
+      continue;
+    }
+    const parsed = JSON.parse(data);
+    if (!isRecord3(parsed) || typeof parsed.type !== "string" || parsed.type === "error") {
+      throw new Error("invalid stream event");
+    }
+  }
+  if (!sawDone) throw new Error("stream ended without terminal marker");
+}
+async function sendCompanionMessage(request, sink, deps = {}) {
+  const { controller, timer } = createDeadline(deps);
+  const fetchImpl = deps.fetch ?? fetch;
+  let route;
+  let dispatched = false;
+  let accepted = false;
+  try {
+    const { token, origin } = await acquireContext(deps);
+    const headers = authenticatedHeaders(token);
+    const agents = await fetchAgents(
+      fetchImpl,
+      origin,
+      token,
+      controller.signal
+    );
+    const agentName = resolveAgentName(agents, request.personaKey);
+    let conversationResponse;
+    try {
+      conversationResponse = await fetchImpl(`${origin}/api/conversations`, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({ agentName }),
+        signal: controller.signal
+      });
+    } catch {
+      throw new PredispatchFailure("not-connected");
+    }
+    const conversationId = decodeConversationId(
+      await readJsonEnvelope(conversationResponse)
+    );
+    let messagesResponse;
+    try {
+      messagesResponse = await fetchImpl(
+        `${origin}/api/conversations/${encodeURIComponent(conversationId)}/messages`,
+        { headers, signal: controller.signal }
+      );
+    } catch {
+      throw new PredispatchFailure("not-connected");
+    }
+    const desktopAfter = decodeLastMessageId(
+      await readJsonEnvelope(messagesResponse)
+    );
+    route = mateRoute(request.personaKey, desktopAfter);
+    const dispatching = parseEvent({
+      type: "dispatching",
+      requestId: request.requestId,
+      personaKey: request.personaKey,
+      route
+    });
+    sink(dispatching);
+    dispatched = true;
+    let chatResponse;
+    try {
+      chatResponse = await fetchImpl(`${origin}/api/chat`, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({
+          messages: [{ role: "user", content: request.text }],
+          agentName,
+          conversationId
+        }),
+        signal: controller.signal
+      });
+    } catch {
+      throw new Error("chat dispatch outcome unavailable");
+    }
+    if (!chatResponse.ok || !chatResponse.body || !(chatResponse.headers.get("content-type") ?? "").toLowerCase().includes("text/event-stream")) {
+      throw new Error("chat response not accepted");
+    }
+    const acceptedEvent = parseEvent({
+      type: "accepted",
+      requestId: request.requestId,
+      personaKey: request.personaKey,
+      route
+    });
+    sink(acceptedEvent);
+    accepted = true;
+    await drainAcceptedSse(chatResponse);
+    const completed = parseEvent({
+      type: "completed",
+      requestId: request.requestId
+    });
+    sink(completed);
+    return completed;
+  } catch (error) {
+    if (!dispatched) {
+      return emitFailure(
+        sink,
+        classifyUnknownPredispatch(error),
+        request.requestId
+      );
+    }
+    const indeterminate = parseEvent({
+      type: "indeterminate",
+      requestId: request.requestId,
+      stage: accepted ? "after-accept" : "dispatch",
+      route: route ?? mateRoute(request.personaKey)
+    });
+    sink(indeterminate);
+    return indeterminate;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/lib/companion-update-check.ts
+async function checkCompanionUpdate(options, deps = {}) {
+  const installed = await statusCompanion(options).then((state) => state.state === "installed" ? state.version : null).catch(() => null);
+  const release = await (deps.readRelease ?? readCompanionRelease)().catch(() => null);
+  return {
+    type: "update",
+    installed,
+    available: release?.component.version ?? null,
+    severity: release === null ? null : release.severity
+  };
+}
+function companionUpdateAvailable(update) {
+  return update.available !== null && update.available !== update.installed;
+}
+
+// src/commands/companion/bridge.ts
+var defaultDeps2 = {
+  roster: rosterCompanions,
+  send: sendCompanionMessage,
+  update: () => checkCompanionUpdate(defaultLocalCompanionInstallOptions())
+};
+async function readSingleRequest(stdin) {
+  let input = "";
+  for await (const chunk of stdin) {
+    input += String(chunk);
+    if (input.length > COMPANION_BRIDGE_LINE_MAX_LENGTH + 2) {
+      throw new Error("request exceeds bridge bound");
+    }
+  }
+  if (input.endsWith("\r\n")) {
+    input = input.slice(0, -2);
+  } else if (input.endsWith("\n")) {
+    input = input.slice(0, -1);
+  }
+  if (input.length === 0 || /[\r\n]/u.test(input)) {
+    throw new Error("bridge accepts exactly one request");
+  }
+  return input;
+}
+function exitFor(terminal) {
+  if (terminal.type === "roster" || terminal.type === "completed") return 0;
+  if (terminal.type === "update") return 0;
+  if (terminal.type === "indeterminate") return 4;
+  if (terminal.type === "failed" && terminal.reason !== "bad-request") {
+    return 3;
+  }
+  return 2;
+}
+async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps2) {
+  let request;
+  try {
+    request = parseRequestLine(await readSingleRequest(stdin));
+  } catch {
+    stderr.write("bridge request rejected\n");
+    return 2;
+  }
+  const sink = (event) => {
+    stdout.write(`${serializeEvent(event)}
+`);
+  };
+  try {
+    let terminal;
+    if (request.type === "roster") terminal = await deps.roster(sink);
+    else if (request.type === "update") {
+      terminal = await deps.update();
+      sink(terminal);
+    } else terminal = await deps.send(request, sink);
+    return exitFor(terminal);
+  } catch {
+    stderr.write("bridge request failed\n");
+    return 3;
+  }
+}
+var CompanionBridgeCommand = class extends Command62 {
+  static paths = [["companion", "_bridge"]];
+  async execute() {
+    return runCompanionBridge(
+      this.context.stdin,
+      this.context.stdout,
+      this.context.stderr
+    );
+  }
+};
+
+// src/commands/companion/status.ts
+import { Command as Command63 } from "clipanion";
+async function runCompanionStatusCommand(stdout, status, update) {
+  const state = await status();
+  if (state.state === "not-installed") {
+    stdout.write("Desktop companions are not installed.\n");
+    return 0;
+  }
+  if (state.state === "needs-repair") {
+    stdout.write(`Desktop companions need repair: ${state.reason}
+`);
+    return 1;
+  }
+  stdout.write(
+    `Desktop companions are installed (${state.version}); start at login: ${state.startAtLogin ? "on" : "off"}.
+`
+  );
+  if (update) {
+    const answer = await update().catch(() => null);
+    if (answer !== null && companionUpdateAvailable(answer)) {
+      stdout.write(
+        `A newer companion is available (${String(answer.available)}).
+Run: m8t companion install
+`
+      );
+    }
+  }
+  return 0;
+}
+var CompanionStatusCommand = class extends M8tCommand {
+  static paths = [["companion", "status"]];
+  static usage = Command63.Usage({
+    description: "Verify the installed desktop companion without launching it."
+  });
+  async executeCommand() {
+    const options = defaultLocalCompanionInstallOptions();
+    return runCompanionStatusCommand(
+      this.context.stdout,
+      () => statusCompanion(options),
+      () => checkCompanionUpdate(options)
+    );
+  }
+};
+
+// src/commands/companion/repair.ts
+import { Command as Command64 } from "clipanion";
+async function runCompanionRepairCommand(stdout, repair) {
+  const state = await repair();
+  if (state.state === "not-released") {
+    stdout.write(
+      "The release this platform is pinned to carries no desktop companions.\nThere is nothing to repair to \u2014 run: m8t platform update\n"
+    );
+    return 1;
+  }
+  if (state.state !== "installed") {
+    stdout.write("Desktop companions could not be repaired.\n");
+    return 1;
+  }
+  stdout.write(`Desktop companions repaired (${state.version}).
+`);
+  return 0;
+}
+var CompanionRepairCommand = class extends M8tCommand {
+  static paths = [["companion", "repair"]];
+  static usage = Command64.Usage({
+    description: "Restore the internal desktop companion and start-at-login state."
+  });
+  async executeCommand() {
+    return runCompanionRepairCommand(
+      this.context.stdout,
+      () => convergeCompanionFromChannel(repairCompanion)
+    );
+  }
+};
+
+// src/commands/companion/uninstall.ts
+import { Command as Command65 } from "clipanion";
+async function runCompanionUninstallCommand(stdout, uninstall) {
+  const state = await uninstall();
+  if (state.state !== "not-installed") {
+    stdout.write("Desktop companions were not completely removed.\n");
+    return 1;
+  }
+  stdout.write("Desktop companions removed for this user.\n");
+  return 0;
+}
+var CompanionUninstallCommand = class extends M8tCommand {
+  static paths = [["companion", "uninstall"]];
+  static usage = Command65.Usage({
+    description: "Remove only this user's desktop companion installation."
+  });
+  async executeCommand() {
+    const options = defaultLocalCompanionInstallOptions();
+    return runCompanionUninstallCommand(
+      this.context.stdout,
+      () => uninstallCompanion(options)
+    );
+  }
+};
+
 // src/cli.ts
 var cli = new Cli({
   binaryName: "m8t",
@@ -31633,6 +33536,11 @@ cli.register(BootstrapFinishCommand);
 cli.register(BootstrapUiCommand);
 cli.register(BootstrapSeedProfileCommand);
 cli.register(TelemetryEnrollCommand);
+cli.register(CompanionBridgeCommand);
+cli.register(CompanionInstallCommand);
+cli.register(CompanionStatusCommand);
+cli.register(CompanionRepairCommand);
+cli.register(CompanionUninstallCommand);
 async function main() {
   try {
     return await cli.run(process.argv.slice(2));