@m8t-stack/cli 0.2.57 → 0.2.59

package/dist/cli.js

@@ -1364,7 +1364,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.57";
+var CLI_VERSION = "0.2.59";
 
 // src/lib/render-error.ts
 init_errors();
@@ -15668,6 +15668,72 @@ async function closePullRequestViaApp(args) {
   if (!res.ok) throw new LocalCliError({ code: "GH_APP_PR_CLOSE_FAILED", message: `PATCH /pulls/${args.number.toString()} HTTP ${res.status.toString()}: ${(await res.text()).slice(0, 300)}` });
 }
 
+// src/lib/github-app-permissions.ts
+init_esm2();
+init_errors();
+var REQUIRED_INSTALLATION_PERMISSIONS = [
+  { key: "administration", level: "write", why: "create the brain repository (POST /orgs/<org>/repos)" },
+  { key: "contents", level: "write", why: "push the brain template and commit memory updates" },
+  { key: "workflows", level: "write", why: "push the brain template's .github/workflows/ files" },
+  { key: "metadata", level: "read", why: "read repository metadata" }
+];
+var LEVEL_RANK = { read: 1, write: 2, admin: 3 };
+function findPermissionGaps(granted) {
+  return REQUIRED_INSTALLATION_PERMISSIONS.flatMap((req2) => {
+    const have = granted[req2.key];
+    const haveRank = have ? LEVEL_RANK[have] ?? 0 : 0;
+    const needRank = LEVEL_RANK[req2.level] ?? 0;
+    return haveRank >= needRank ? [] : [{ key: req2.key, required: req2.level, granted: have ?? null, why: req2.why }];
+  });
+}
+function buildPermissionRefusal(args) {
+  const lines = args.gaps.map((g) => `  \u2022 ${g.key}: need ${g.required}, installation grants ${g.granted ?? "nothing"} \u2014 needed to ${g.why}`);
+  const appLabel = args.slug ? `'${args.slug}'` : "the m8t brain App";
+  return {
+    message: `The GitHub App installed on '${args.org}' is missing permissions the brain flow needs:
+${lines.join("\n")}`,
+    hint: `An App's permissions are not applied to an installation until an org owner approves them, so editing the App is not enough. Either approve the pending request at https://github.com/organizations/${args.org}/settings/installations (open ${appLabel} \u2192 Review request), or create a fresh App with the right set: m8t brain app-create --org ${args.org}`
+  };
+}
+async function readInstallationPermissions(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  let jwt;
+  try {
+    jwt = signAppJwt({ appId: args.appId, privateKeyPem: args.privateKeyPem });
+  } catch (e) {
+    return { granted: null, unreadable: `could not sign an App JWT: ${e.message}` };
+  }
+  try {
+    const res = await doFetch(`https://api.github.com/app/installations/${args.installationId}`, {
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": "m8t"
+      }
+    });
+    if (!res.ok) return { granted: null, unreadable: `GET /app/installations/${args.installationId} \u2192 HTTP ${String(res.status)}` };
+    const body = await res.json();
+    if (!body.permissions || typeof body.permissions !== "object") {
+      return { granted: null, unreadable: "the installation response carried no permissions object" };
+    }
+    return { granted: body.permissions, ...body.app_slug ? { slug: body.app_slug } : {} };
+  } catch (e) {
+    return { granted: null, unreadable: e.message };
+  }
+}
+async function assertInstallationPermissions(args) {
+  const check = await readInstallationPermissions(args);
+  if (!check.granted) {
+    args.onUnverified?.(`could not confirm the GitHub App's granted permissions (${check.unreadable ?? "unknown"}) \u2014 continuing`);
+    return;
+  }
+  const gaps = findPermissionGaps(check.granted);
+  if (gaps.length === 0) return;
+  const { message, hint } = buildPermissionRefusal({ org: args.org, ...check.slug ? { slug: check.slug } : {}, gaps });
+  throw new LocalCliError({ code: "GITHUB_APP_PERMISSIONS_INSUFFICIENT", message, hint });
+}
+
 // src/lib/brain-repo-collision.ts
 init_errors();
 var DEFAULT_MAX_ATTEMPTS = 20;
@@ -15835,6 +15901,16 @@ var BrainCreateCommand = class extends M8tCommand {
     const appPemOpt = typeof this.appPem === "string" ? this.appPem : void 0;
     const installationIdOpt = typeof this.installationId === "string" ? this.installationId : void 0;
     const useAppPath = appIdOpt !== void 0 && appPemOpt !== void 0 && installationIdOpt !== void 0;
+    if (useAppPath) {
+      await assertInstallationPermissions({
+        appId: appIdOpt,
+        privateKeyPem: readFileSync6(appPemOpt, "utf8"),
+        installationId: installationIdOpt,
+        org: owner,
+        onUnverified: (m) => this.context.stderr.write(`  ${colors.dim(`warning: ${m}`)}
+`)
+      });
+    }
     if (!useAppPath) {
       if (!await isGhAuthed()) {
         this.context.stdout.write(`${colors.hint("note:")} gh not authed \u2014 running gh auth login --device --scopes "repo,read:org"
@@ -24754,7 +24830,7 @@ function evaluateRedirectUri(p) {
     // Deliberately NOT "m8t prereqs --fix": this command reports it and does not
     // write it. The app registration is shared across every deployment in the
     // tenant, so the write belongs to the install, not to whoever is diagnosing.
-    `Re-run 'm8t bootstrap finish' (it registers this), or ask a directory admin to add it \u2014 MERGE, never overwrite:
+    `Re-run 'm8t bootstrap status --finalize' (it registers this), or ask a directory admin to add it \u2014 MERGE, never overwrite:
         az ad app update --id ${p.clientId ?? "<clientId>"} --set spa.redirectUris="['${want}']"`
   );
 }
@@ -27526,11 +27602,16 @@ function redactTranscripts(input) {
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
   static usage = Command50.Usage({
-    description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
-    details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
+    description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
+    details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
   worker = Option47.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option47.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  // Opting IN to the side effects, rather than opting out of them. This command's
+  // own help has always described a dry run, but the bare invocation used to take
+  // the live branch — a real model call and a commit to the brain repo — so anyone
+  // acting on `--help` got the opposite of what they read.
+  live = Option47.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option47.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
   since = Option47.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
   reset = Option47.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
   showTranscripts = Option47.Boolean("--show-transcripts", false, {
@@ -27550,7 +27631,7 @@ var DreamRunCommand = class extends M8tCommand {
     const reset = this.reset === true;
     const outputFlag = this.output === "json" || this.output === "auto" || this.output === "pretty" ? this.output : "pretty";
     const mode = resolveOutputMode(outputFlag, this.context.stdout);
-    if (this.dryRun !== true) {
+    if (this.live === true && this.dryRun !== true) {
       const liveDeps = this.deps ?? defaultDeps();
       const liveContext = await liveDeps.resolveContext({
         worker,
@@ -28517,6 +28598,7 @@ function buildAciCreateArgs(s) {
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
   if (s.skipBrains) env.push("SKIP_BRAINS=true");
+  if (s.founderObjectId) env.push(`FOUNDER_OBJECT_ID=${s.founderObjectId}`);
   if (s.updateChannelUrl) env.push(`M8T_UPDATE_CHANNEL_URL=${s.updateChannelUrl}`);
   if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
   if (s.enrollCompany) env.push(`M8T_ENROLL_COMPANY=${s.enrollCompany}`);
@@ -28776,14 +28858,14 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.50";
+var DEFAULT_INSTALLER_TAG = "v0.1.51";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
   static usage = Command54.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
-    details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
+    details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
@@ -28934,6 +29016,12 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     out("waiting for the installer identity to be usable (role propagation)\u2026");
     const miReady = await waitForMiToken({ clientId: mi.clientId, subscriptionId, onProgress: out });
     if (!miReady) out("identity not confirmed yet \u2014 launching anyway (the installer retries its own login)");
+    let founderObjectId;
+    try {
+      founderObjectId = await getCallerObjectId();
+    } catch (e) {
+      out(`warning: could not determine your Azure object id (${e.message}) \u2014 the install will not grant you data-plane access; run 'm8t prereqs --fix' afterwards`);
+    }
     out("launching the cloud installer (ACI)\u2026");
     await kickInstaller({
       aciName: ACI_NAME,
@@ -28947,6 +29035,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp,
+      ...founderObjectId ? { founderObjectId } : {},
       ...skipBrains ? { skipBrains: true } : {},
       // Opt-in only. The signed-in UPN was previously seeded here automatically;
       // an installation is identified by its random instance id, and contact
@@ -28965,7 +29054,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -28990,364 +29079,74 @@ async function getAciState(opts) {
   return { provisioningState: j.provisioningState, firstContainerState: state, exitCode: cs?.exitCode, terminated };
 }
 
-// src/commands/bootstrap/status.ts
-var BootstrapStatusCommand = class extends M8tCommand {
-  static paths = [["bootstrap", "status"]];
-  static usage = Command55.Usage({
-    description: "Show the cloud installer's live status (phase, progress, result).",
-    details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
-    examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
-  });
-  watch = Option52.Boolean("--watch", false);
-  output = Option52.String("--output");
-  async executeCommand() {
-    const state = await readBootstrapState();
-    if (!state) {
-      throw new LocalCliError({
-        code: "BOOTSTRAP_NO_STATE",
-        message: "No bootstrap is in flight (no ~/.m8t/bootstrap.json).",
-        hint: "Run 'm8t bootstrap launch --location <region>' first."
-      });
-    }
-    const mode = resolveOutputMode(
-      typeof this.output === "string" ? this.output : void 0,
-      this.context.stdout
-    );
-    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
-    const watch = this.watch === true;
-    for (; ; ) {
-      let doc;
-      try {
-        doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-      } catch (e) {
-        if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
-          const early = await getAciState({
-            aciName: state.aciName,
-            resourceGroup: state.resourceGroup,
-            subscriptionId: state.subscriptionId
-          }).catch(() => null);
-          if (early?.terminated) {
-            this.context.stderr.write(
-              `  ${colors.error("\u2717")} the installer container has terminated (exit ${String(early.exitCode ?? "?")}) and never reported a status.
-  ${colors.hint("inspect:")} az container logs -n ${state.aciName} -g ${state.resourceGroup}
-  ${colors.hint("reap:")} m8t bootstrap reap --force
-`
-            );
-            return 1;
-          }
-          if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
-`);
-          await sleep5(1e4);
-          continue;
-        }
-        throw e;
-      }
-      if (!watch || doc.status !== "running") {
-        if (mode === "json") {
-          this.context.stdout.write(renderJson(doc) + "\n");
-        } else {
-          this.context.stdout.write(formatStatus(doc));
-        }
-        return doc.status === "failed" ? 1 : 0;
-      }
-      if (mode === "pretty") this.context.stderr.write(`  ${colors.dim(`${doc.phase} (${String(doc.phaseIndex)}/${String(doc.phaseTotal)}) ${doc.detail ?? ""}`)}
-`);
-      const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
-      if (aci?.terminated) {
-        this.context.stderr.write(
-          `  ${colors.error("\u2717")} the installer container has terminated (exit ${String(aci.exitCode ?? "?")}) but the status is still '${doc.phase}'.
-  ${colors.hint("inspect:")} az container logs -n ${state.aciName} -g ${state.resourceGroup}
-  ${colors.hint("reap:")} m8t bootstrap reap --force
-`
-        );
-        return 1;
-      }
-      await sleep5(1e4);
-    }
-  }
-};
-function formatStatus(d) {
-  const head = `${d.status.toUpperCase()} \u2014 ${d.phase} (${String(d.phaseIndex)}/${String(d.phaseTotal)})${d.detail ? ` \u2014 ${d.detail}` : ""}
-`;
-  if (d.status === "done" && d.result) {
-    return colors.success("\u2713 ") + head + `  gateway:  ${d.result.gatewayUrl ?? "-"}
-  foundry:  ${d.result.foundryEndpoint ?? "-"}
-  ${colors.hint("next:")} m8t bootstrap reap && m8t bootstrap finish
-`;
-  }
-  if (d.status === "failed" && d.error) {
-    return colors.error("\u2717 ") + head + `  ${colors.error(`error in ${d.error.phase}: ${d.error.message}`)}
-  ${colors.hint("inspect:")} az container logs
-`;
-  }
-  return head;
-}
+// src/lib/bootstrap-finalize.ts
+import * as fs34 from "fs/promises";
+import * as os18 from "os";
+import * as path38 from "path";
 
-// src/commands/bootstrap/reap.ts
-import { Command as Command56, Option as Option53 } from "clipanion";
+// src/lib/company-profile-seed.ts
+import { spawn as spawn6 } from "child_process";
+import { closeSync, openSync, readFileSync as readFileSync21 } from "fs";
+import * as os15 from "os";
+import * as path33 from "path";
 init_errors();
 
-// src/lib/bootstrap-reap.ts
-var ROLE_ASSIGNMENT_API = "2022-04-01";
-var GATEWAY_SUBSCOPE_ROLES = ["Cost Management Reader", "Monitoring Reader"];
-async function listSubscriptionAssignments(subscriptionId) {
-  return JSON.parse(
-    await runAz([
-      "role",
-      "assignment",
-      "list",
-      "--all",
-      "--subscription",
-      subscriptionId,
-      "-o",
-      "json"
-    ]).catch(() => "[]") || "[]"
-  );
-}
-async function deleteAssignmentsById(ids) {
-  for (const id of ids) {
-    await runAz([
-      "rest",
-      "--method",
-      "delete",
-      "--url",
-      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
-    ]).catch(() => void 0);
+// src/lib/onboarding-profile.ts
+init_esm();
+function describeBlockRejection(reason) {
+  switch (reason) {
+    case "unknown-schema-version":
+      return "the onboarding block's schema_version was missing or unrecognized";
+    case "unexpected-key":
+      return "the onboarding JSON carried a field it shouldn't have";
+    case "missing-key":
+      return "the onboarding block was missing a required field";
+    case "non-string-value":
+      return "the onboarding block held a value of the wrong type";
+    case "disallowed-value":
+      return "an onboarding block field held a value outside its allowed set";
+    case "too-many-pending-requests":
+      return "the onboarding block listed more pending requests than the one allowed";
+    case "malformed-json":
+      return "the onboarding block's JSON could not be safely parsed \u2014 check for duplicate keys, excessive nesting, or a syntax error";
+    case "multiple-artifacts":
+      return "more than one onboarding block was found in your onboarding conversation";
+    case "unreadable-fences":
+      return "the message's code fences could not be reliably delimited, so any onboarding block inside them could not be safely read";
+    case "mistagged-fence":
+      return "the onboarding block was inside a code fence that wasn't tagged json, so it could not be safely read";
+    case "unfenced-artifact":
+      return "the onboarding block appeared outside of any code fence, so it could not be safely read";
+    case "no-artifact":
+      return "no onboarding block was found";
   }
 }
-async function sweepOrphanGatewaySubRoles(opts) {
-  const subScope = `/subscriptions/${opts.subscriptionId}`;
-  const all = await listSubscriptionAssignments(opts.subscriptionId);
-  const matched = all.filter((r) => {
-    if (r.principalName) return false;
-    if (r.principalType !== "ServicePrincipal") return false;
-    if (r.scope !== subScope) return false;
-    if (r.description === GATEWAY_SUBSCOPE_GRANT_DESCRIPTION) return true;
-    return GATEWAY_SUBSCOPE_ROLES.includes(r.roleDefinitionName ?? "");
-  });
-  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
-  return matched.map((r) => ({ id: r.id, description: r.description, roleDefinitionName: r.roleDefinitionName, createdOn: r.createdOn }));
-}
-async function sweepOrphanOwnerAssignments(opts) {
-  const subScope = `/subscriptions/${opts.subscriptionId}`;
-  const all = await listSubscriptionAssignments(opts.subscriptionId);
-  const matched = all.filter((r) => {
-    if (r.description === INSTALLER_GRANT_DESCRIPTION) return true;
-    return !r.principalName && r.principalType === "ServicePrincipal" && r.roleDefinitionName === "Owner" && r.scope === subScope;
-  });
-  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
-  return matched.map((r) => ({ id: r.id, description: r.description, createdOn: r.createdOn }));
+var COMPANY_PROFILE_PATH = "memory/company-profile.md";
+var DEFAULT_MEMORY_INDEX_HEADER = [
+  `# Memory index`,
+  ``,
+  `> Your memories, newest first. The summary on each line is usually enough to answer \u2014 open the linked file only when you need full detail. Each path is repo-root; copy it verbatim, never invent one.`,
+  ``
+].join("\n");
+var ONBOARDING_BLOCK_KEYS = [
+  "schema_version",
+  "company_stage",
+  "icp",
+  "industry",
+  "team_size",
+  "context",
+  "founder_name",
+  "founder_email",
+  "advisor_name",
+  "advisor_email"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function reapInstaller(opts) {
-  const swallow = async (p) => {
-    try {
-      await p;
-    } catch {
-    }
-  };
-  await swallow(runAz(["container", "delete", "--name", opts.aciName, "--resource-group", opts.resourceGroup, "--subscription", opts.subscriptionId, "--yes", "--only-show-errors"]));
-  await swallow(runAz(["identity", "delete", "--name", opts.miName, "--resource-group", opts.resourceGroup, "--subscription", opts.subscriptionId]));
-  for (const id of opts.roleAssignmentIds) {
-    await swallow(runAz([
-      "rest",
-      "--method",
-      "delete",
-      "--url",
-      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
-    ]));
-  }
-  const survivors = JSON.parse(
-    await runAz([
-      "role",
-      "assignment",
-      "list",
-      "--all",
-      "--subscription",
-      opts.subscriptionId,
-      "--query",
-      `[?principalId=='${opts.principalId}' && roleDefinitionName=='Owner'].id`,
-      "-o",
-      "json"
-    ]).catch(() => "[]") || "[]"
-  );
-  for (const id of survivors) {
-    await swallow(runAz(["rest", "--method", "delete", "--url", `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`]));
-  }
-}
-
-// src/commands/bootstrap/reap.ts
-var BootstrapReapCommand = class extends M8tCommand {
-  static paths = [["bootstrap", "reap"]];
-  static usage = Command56.Usage({
-    description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
-    details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
-    examples: [["Reap after done", "$0 bootstrap reap"]]
-  });
-  force = Option53.Boolean("--force", false);
-  sweepOrphans = Option53.Boolean("--sweep-orphans", false);
-  yes = Option53.Boolean("--yes", false);
-  async executeCommand() {
-    if (this.sweepOrphans === true) {
-      const { subscriptionId: sub } = await getAzAccount();
-      if (!sub) {
-        throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
-      }
-      const execute = this.yes === true;
-      const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute });
-      const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute });
-      const total = owner.length + gateway.length;
-      if (total === 0) {
-        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub or gateway sub-scope assignments found.
-`);
-        return 0;
-      }
-      for (const f of owner) {
-        this.context.stdout.write(`  ${colors.dim("Owner@sub")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
-`);
-      }
-      for (const f of gateway) {
-        this.context.stdout.write(`  ${colors.dim(f.roleDefinitionName ?? "gateway sub-scope")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
-`);
-      }
-      const breakdown = `${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope`;
-      if (execute) {
-        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(total)} orphaned assignment(s) (${breakdown}).
-`);
-      } else {
-        this.context.stdout.write(`
-Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
-`);
-      }
-      return 0;
-    }
-    const state = await readBootstrapState();
-    if (!state) {
-      if (this.force === true) {
-        const { subscriptionId: sub } = await getAzAccount();
-        if (!sub) {
-          throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
-        }
-        const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
-        const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute: true });
-        const total = owner.length + gateway.length;
-        this.context.stdout.write(
-          total === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub or gateway sub-scope assignments. Nothing to reap.
-` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(total)} orphaned assignment(s) (${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope).
-`
-        );
-        return 0;
-      }
-      throw new LocalCliError({
-        code: "BOOTSTRAP_NO_STATE",
-        message: "No bootstrap state to reap.",
-        hint: "Nothing to do. If a launch failed and its RG was deleted it may have orphaned an installer Owner@sub grant or the gateway's sub-scope reader roles \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean them."
-      });
-    }
-    if (this.force !== true) {
-      const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-      if (doc.status !== "done") {
-        if (doc.status === "failed") {
-          throw new LocalCliError({
-            code: "BOOTSTRAP_REAP_FAILED_INSTALL",
-            message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
-            hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
-          });
-        }
-        const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
-        const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
-        throw new LocalCliError({
-          code: "BOOTSTRAP_REAP_NOT_DONE",
-          message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
-          hint: deadHint
-        });
-      }
-    }
-    await reapInstaller({
-      subscriptionId: state.subscriptionId,
-      resourceGroup: state.resourceGroup,
-      aciName: state.aciName,
-      miName: state.miName,
-      roleAssignmentIds: state.roleAssignmentIds,
-      principalId: state.miPrincipalId
-    });
-    this.context.stdout.write(`${colors.success("\u2713")} reaped the installer (ACI + identity + its role assignments). The platform stays.
-`);
-    this.context.stdout.write(`  ${colors.hint("next:")} m8t bootstrap finish
-`);
-    return 0;
-  }
-};
-
-// src/commands/bootstrap/finish.ts
-import * as fs34 from "fs/promises";
-import * as os18 from "os";
-import * as path38 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
-init_errors();
-
-// src/lib/company-profile-seed.ts
-import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync21 } from "fs";
-import * as os15 from "os";
-import * as path33 from "path";
-init_errors();
-
-// src/lib/onboarding-profile.ts
-init_esm();
-function describeBlockRejection(reason) {
-  switch (reason) {
-    case "unknown-schema-version":
-      return "the onboarding block's schema_version was missing or unrecognized";
-    case "unexpected-key":
-      return "the onboarding JSON carried a field it shouldn't have";
-    case "missing-key":
-      return "the onboarding block was missing a required field";
-    case "non-string-value":
-      return "the onboarding block held a value of the wrong type";
-    case "disallowed-value":
-      return "an onboarding block field held a value outside its allowed set";
-    case "too-many-pending-requests":
-      return "the onboarding block listed more pending requests than the one allowed";
-    case "malformed-json":
-      return "the onboarding block's JSON could not be safely parsed \u2014 check for duplicate keys, excessive nesting, or a syntax error";
-    case "multiple-artifacts":
-      return "more than one onboarding block was found in your onboarding conversation";
-    case "unreadable-fences":
-      return "the message's code fences could not be reliably delimited, so any onboarding block inside them could not be safely read";
-    case "mistagged-fence":
-      return "the onboarding block was inside a code fence that wasn't tagged json, so it could not be safely read";
-    case "unfenced-artifact":
-      return "the onboarding block appeared outside of any code fence, so it could not be safely read";
-    case "no-artifact":
-      return "no onboarding block was found";
-  }
-}
-var COMPANY_PROFILE_PATH = "memory/company-profile.md";
-var DEFAULT_MEMORY_INDEX_HEADER = [
-  `# Memory index`,
-  ``,
-  `> Your memories, newest first. The summary on each line is usually enough to answer \u2014 open the linked file only when you need full detail. Each path is repo-root; copy it verbatim, never invent one.`,
-  ``
-].join("\n");
-var ONBOARDING_BLOCK_KEYS = [
-  "schema_version",
-  "company_stage",
-  "icp",
-  "industry",
-  "team_size",
-  "context",
-  "founder_name",
-  "founder_email",
-  "advisor_name",
-  "advisor_email"
-];
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasValidUniqueJsonKeys(source) {
-  let offset = 0;
-  const skipWhitespace = () => {
-    while (/\s/.test(source[offset] ?? "")) offset += 1;
+function hasValidUniqueJsonKeys(source) {
+  let offset = 0;
+  const skipWhitespace = () => {
+    while (/\s/.test(source[offset] ?? "")) offset += 1;
   };
   const parseString = () => {
     if (source[offset] !== '"') return null;
@@ -30184,7 +29983,7 @@ function spawnDetachedSeedWatch() {
     closeSync(fd);
   }
 }
-async function reactiveSeedOnFinish(args) {
+async function reactiveSeedOnInstallComplete(args) {
   const ctx = await resolveSeedContext({ endpointOverride: args.endpoint, appCredsOverride: args.appCredsOverride, subscriptionId: args.subscriptionId });
   if (!ctx) return;
   const token = await (args.getFoundryTokenImpl ?? getFoundryToken)();
@@ -30370,18 +30169,18 @@ async function walk(root, relative3 = "") {
     const childRelative = relative3 ? `${relative3}/${child.name}` : child.name;
     normalizedRelative(childRelative);
     const childPath = path34.join(directory, child.name);
-    const stat4 = await fs31.lstat(childPath);
-    if (stat4.isDirectory()) {
+    const stat5 = await fs31.lstat(childPath);
+    if (stat5.isDirectory()) {
       entries.push(...await walk(root, childRelative));
-    } else if (stat4.isFile()) {
+    } else if (stat5.isFile()) {
       entries.push({
         type: "file",
         path: childRelative,
-        mode: stat4.mode & 511,
-        size: stat4.size,
+        mode: stat5.mode & 511,
+        size: stat5.size,
         sha256: await sha256File2(childPath)
       });
-    } else if (stat4.isSymbolicLink()) {
+    } else if (stat5.isSymbolicLink()) {
       const target = await fs31.readlink(childPath);
       entries.push({
         type: "symlink",
@@ -30395,9 +30194,9 @@ async function walk(root, relative3 = "") {
   return entries;
 }
 async function ensureRealDirectory(root) {
-  const stat4 = await fs31.lstat(root);
-  if (stat4.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
-  if (!stat4.isDirectory()) throw new Error("Artifact root is not a directory");
+  const stat5 = await fs31.lstat(root);
+  if (stat5.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
+  if (!stat5.isDirectory()) throw new Error("Artifact root is not a directory");
 }
 async function validateResolvedLinks(root, entries) {
   const realRoot = await fs31.realpath(root);
@@ -30837,8 +30636,8 @@ async function atomicWriteText(filePath, contents, mode) {
 }
 async function realRegularFile(filePath, executable) {
   const real = await fs32.realpath(filePath);
-  const stat4 = await fs32.stat(real);
-  if (!stat4.isFile()) throw new Error("Companion launch target is not a file");
+  const stat5 = await fs32.stat(real);
+  if (!stat5.isFile()) throw new Error("Companion launch target is not a file");
   await fs32.access(real, executable ? constants2.X_OK : constants2.R_OK);
   return real;
 }
@@ -30851,6 +30650,29 @@ function defaultLaunch(executable) {
   child.unref();
   return Promise.resolve();
 }
+async function companionIsRunning(platform, executable) {
+  if (platform !== "win32") return false;
+  let handle;
+  try {
+    handle = await fs32.open(executable, "r+");
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT") return false;
+    if (code === "EBUSY" || code === "EPERM" || code === "EACCES") return true;
+    throw error;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+  return false;
+}
+async function assertCompanionNotRunning(options, executable) {
+  const running = options.isRunning ?? ((owned) => companionIsRunning(options.platform, owned));
+  if (await running(executable)) {
+    throw new Error(
+      "The desktop companions are running. Quit them from the tray, then run this again."
+    );
+  }
+}
 async function readInstalled(options) {
   const paths = companionInstallPaths(options);
   await assertNotSymlink(paths.installManifest, "Install manifest");
@@ -30979,6 +30801,15 @@ async function converge(options, force) {
   if (!force && current.state === "installed" && current.version === artifactManifest.version && current.artifactTreeSha256 === artifactManifest.treeSha256 && current.startAtLogin) {
     return current;
   }
+  if (priorInstalled) {
+    await assertCompanionNotRunning(
+      options,
+      path35.join(
+        priorInstalled.paths.targetRoot,
+        ...priorInstalled.install.entryRelativePath.split("/")
+      )
+    );
+  }
   if (current.state === "not-installed") {
     try {
       await fs32.lstat(paths.targetRoot);
@@ -31129,6 +30960,7 @@ async function uninstallCompanion(options) {
     paths.targetRoot,
     ...install.entryRelativePath.split("/")
   );
+  await assertCompanionNotRunning(options, executable);
   await (options.setStartAtLogin ?? (() => Promise.resolve()))(executable, false);
   const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
     await fs32.rm(ownedPath, { recursive, force: true });
@@ -31143,7 +30975,7 @@ async function uninstallCompanion(options) {
 // src/commands/companion/install.ts
 import * as os17 from "os";
 import * as path37 from "path";
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -31254,7 +31086,7 @@ function defaultLocalCompanionInstallOptions() {
     getStartAtLogin: (executable) => getCompanionStartAtLogin({ homeDirectory, platform, executable })
   };
 }
-async function convergeCompanionFromChannel(converge2, stagedDirectory) {
+async function convergeCompanionFromChannel(converge2, stagedDirectory, resourceGroup) {
   let artifactManifestPath;
   let dispose = () => Promise.resolve();
   if (stagedDirectory !== void 0) {
@@ -31266,7 +31098,7 @@ async function convergeCompanionFromChannel(converge2, stagedDirectory) {
     artifactManifestPath = build.artifactManifestPath;
     dispose = build.dispose;
   }
-  const gateway = await resolveGatewayContext({ interactive: false });
+  const gateway = await resolveGatewayContext({ interactive: false, resourceGroup });
   try {
     return await converge2({
       ...defaultLocalCompanionInstallOptions(),
@@ -31277,204 +31109,565 @@ async function convergeCompanionFromChannel(converge2, stagedDirectory) {
     await dispose();
   }
 }
-async function runCompanionInstallCommand(stdout, install) {
-  const state = await install();
-  if (state.state === "not-released") {
-    stdout.write(
-      "The release this platform is pinned to carries no desktop companions.\nThey arrive with a platform release \u2014 run: m8t platform update\n"
-    );
-    return 1;
-  }
-  if (state.state !== "installed") {
-    stdout.write("Desktop companions need repair.\nRun: m8t companion repair\n");
-    return 1;
+async function runCompanionInstallCommand(stdout, install) {
+  const state = await install();
+  if (state.state === "not-released") {
+    stdout.write(
+      "The release this platform is pinned to carries no desktop companions.\nThey arrive with a platform release \u2014 run: m8t platform update\n"
+    );
+    return 1;
+  }
+  if (state.state !== "installed") {
+    stdout.write("Desktop companions need repair.\nRun: m8t companion repair\n");
+    return 1;
+  }
+  stdout.write(
+    `Desktop companions installed: Stacey and Azzy are ready.
+Version: ${state.version}
+`
+  );
+  return 0;
+}
+var CompanionInstallCommand = class extends M8tCommand {
+  static paths = [["companion", "install"]];
+  static usage = Command55.Usage({
+    description: "Install the desktop companions for this user from the release channel.",
+    examples: [
+      ["Install the released build", "$0 companion install"],
+      [
+        "Install one built from this clone",
+        "$0 companion install --from apps/companion/dist-artifacts/darwin-arm64"
+      ]
+    ]
+  });
+  from = Option52.String("--from", {
+    description: "A locally staged build directory instead of the released one."
+  });
+  resourceGroup = Option52.String("--resource-group", {
+    description: "Which deployment to bind to, when the subscription holds more than one."
+  });
+  async executeCommand() {
+    return runCompanionInstallCommand(
+      this.context.stdout,
+      () => convergeCompanionFromChannel(installCompanion, this.from, this.resourceGroup)
+    );
+  }
+};
+
+// src/lib/bootstrap-finalize.ts
+function resolveRepoRootMarker(args) {
+  if (args.explicit !== void 0) return args.explicit;
+  if (args.cwdIsCheckout) return args.cwd;
+  if (args.existing !== null && args.existing !== "") return args.existing;
+  return args.cwd;
+}
+async function looksLikeCheckout(dir) {
+  try {
+    return (await fs34.stat(path38.join(dir, "brain-template"))).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var defaultDeps2 = {
+  discoverGateway,
+  writeConfig,
+  ensureGatewayRedirectUri,
+  runUsagePhase,
+  reactiveSeed: reactiveSeedOnInstallComplete,
+  companionsSupportHost,
+  convergeCompanion: () => convergeCompanionFromChannel(installCompanion),
+  homedir: () => os18.homedir()
+};
+async function finalizeInstall(args, deps = defaultDeps2) {
+  const markerDir = path38.join(deps.homedir(), ".m8t");
+  const markerPath = path38.join(markerDir, "repo-root");
+  const cwd = process.cwd();
+  const existing = await fs34.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
+  const repoRoot = resolveRepoRootMarker({
+    ...args.repoRoot !== void 0 ? { explicit: args.repoRoot } : {},
+    cwd,
+    cwdIsCheckout: await looksLikeCheckout(cwd),
+    existing
+  });
+  await fs34.mkdir(markerDir, { recursive: true });
+  await fs34.writeFile(markerPath, `${repoRoot}
+`, "utf8");
+  let webappUrl;
+  try {
+    const d = await deps.discoverGateway({ subscriptionId: args.subscriptionId, interactive: false, resourceGroup: args.resourceGroup });
+    await deps.writeConfig({
+      gatewayUrl: d.gatewayUrl,
+      gatewayClientId: d.gatewayClientId,
+      gatewayTenantId: d.gatewayTenantId,
+      subscriptionId: d.subscriptionId,
+      containerAppResourceId: d.containerAppResourceId,
+      cachedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    webappUrl = d.gatewayUrl;
+    args.stdout(
+      `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")}
+  gateway:  ${d.gatewayUrl}
+  foundry:  ${args.doc.result?.foundryEndpoint ?? "-"}
+
+`
+    );
+    try {
+      await deps.ensureGatewayRedirectUri(d.gatewayClientId, new URL(d.gatewayUrl).host);
+    } catch (e) {
+      const err = e;
+      args.stderr(
+        `  ${colors.error("\u26A0 could not authorize sign-in for your webapp:")} ${err.message}
+  ${colors.hint(`Until this is fixed, opening ${d.gatewayUrl} will fail with AADSTS50011 (redirect URI mismatch).`)}
+  ${colors.hint("Ask a directory admin to run:")}
+  ${colors.hint(`    m8t bootstrap status   # (as an admin), or by hand:`)}
+  ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
+
+`
+      );
+    }
+    try {
+      const verdict = await deps.runUsagePhase(
+        buildPrereqDeps({ subscription: args.subscriptionId, resourceGroup: args.resourceGroup }),
+        { fix: true, onProgress: (m) => {
+          args.stdout(colors.dim(`  ${m}
+`));
+        } }
+      );
+      const rows = verdict.results.filter((r) => r.slug !== "signin-redirect-uri");
+      const unresolved = rows.filter((r) => r.status === "fail");
+      if (unresolved.length === 0) {
+        args.stdout(`  ${colors.success("\u2713 your account can reach Foundry and read the platform Key Vault")}
+
+`);
+      }
+      for (const r of unresolved) {
+        args.stderr(
+          `  ${colors.error("\u26A0 could not grant you access:")} ${r.detail}
+` + (r.remedy ? `  ${colors.hint(`Fix it with: ${r.remedy}`)}
+` : "") + "\n"
+        );
+      }
+    } catch (e) {
+      args.stderr(
+        `  ${colors.error("\u26A0 could not check or grant your platform access:")} ${e.message}
+  ${colors.hint("Run 'm8t prereqs --fix' when you can \u2014 until then your AI team will not load and worker deploys will fail.")}
+
+`
+      );
+    }
+  } catch (e) {
+    const err = e;
+    args.stdout(`${colors.success("\u2705 The platform is live.")}
+
+`);
+    args.stderr(
+      `  ${colors.hint(`\u26A0 couldn't auto-point your local tools at the gateway: ${err.message}`)}
+` + (err.hint ? `  ${colors.hint(err.hint)}
+` : "") + "\n"
+    );
+  }
+  if (webappUrl !== void 0 && deps.companionsSupportHost()) {
+    try {
+      const companion = await deps.convergeCompanion();
+      if (companion.state === "installed") {
+        args.stdout("Desktop companions installed: Stacey and Azzy are ready.\n\n");
+      } else if (companion.state !== "not-released") {
+        throw new Error("companion installation is not verified");
+      }
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      args.stdout(
+        `Platform installation succeeded, but the desktop companions need repair.
+Run: m8t companion repair
+  ${colors.hint(reason)}
+
+`
+      );
+    }
+  }
+  let brainOrg = null;
+  try {
+    const credsRaw = await fs34.readFile(path38.join(markerDir, "github-app.json"), "utf8");
+    const creds = JSON.parse(credsRaw);
+    brainOrg = typeof creds.org === "string" ? creds.org : null;
+  } catch {
+  }
+  args.stdout(renderInstallSummary({ webappUrl, brainOrg }) + "\n");
+  args.stdout(
+    `${colors.field("Optional local tooling for your coding agent:")}
+  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
+  \u2022 Azure-capable MCP servers (microsoft/azure-skills, Microsoft Learn) \u2014 see the optional steps in guides/install.md.
+  \u2022 Deploy workers conversationally with the opt-in persona skills \u2014 see guides/workers.md.
+  \u2022 Make sure your m8t CLI is current: npm i -g @m8t-stack/cli@latest
+
+${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP servers load only on a fresh start.
+`
+  );
+  try {
+    await deps.reactiveSeed({
+      endpoint: args.doc.result?.foundryEndpoint,
+      subscriptionId: args.subscriptionId,
+      stdout: args.stdout
+    });
+  } catch (e) {
+    args.stderr(
+      `  ${colors.dim(`(company-profile seed deferred: ${e instanceof Error ? e.message : String(e)} \u2014 run 'm8t bootstrap seed-profile' later)`)}
+`
+    );
+  }
+}
+
+// src/commands/bootstrap/status.ts
+var BootstrapStatusCommand = class extends M8tCommand {
+  // `bootstrap finish` is a DEPRECATED ALIAS, not a second command. Everything it
+  // used to do either moved into the cloud installer (the founder's data-plane
+  // grant, now at entrypoint.sh step 3b) or into this command's own `done`
+  // handling. The path stays registered because it is written down in guides,
+  // runbooks and shakedown recipes that a founder may already be part-way
+  // through — it prints a deprecation notice and does the right thing.
+  static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
+  static usage = Command56.Usage({
+    description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
+    details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
+    examples: [
+      ["One read", "$0 bootstrap status"],
+      ["Watch to completion, then finish the local setup", "$0 bootstrap status --watch"],
+      ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
+    ]
+  });
+  watch = Option53.Boolean("--watch", false);
+  output = Option53.String("--output");
+  repoRoot = Option53.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option53.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option53.String("--subscription");
+  resourceGroup = Option53.String("--resource-group");
+  async executeCommand() {
+    const state = await readBootstrapState();
+    if (!state) {
+      throw new LocalCliError({
+        code: "BOOTSTRAP_NO_STATE",
+        message: "No bootstrap is in flight (no ~/.m8t/bootstrap.json).",
+        hint: "Run 'm8t bootstrap launch --location <region>' first."
+      });
+    }
+    const mode = resolveOutputMode(
+      typeof this.output === "string" ? this.output : void 0,
+      this.context.stdout
+    );
+    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const watch = this.watch === true;
+    const invokedPath = this.path ?? [];
+    const viaFinishAlias = invokedPath[invokedPath.length - 1] === "finish";
+    if (viaFinishAlias) {
+      this.context.stderr.write(
+        `  ${colors.hint("note:")} ${colors.dim("`m8t bootstrap finish` is deprecated \u2014 `m8t bootstrap status --watch` now finishes the local setup itself when the install lands.")}
+`
+      );
+    }
+    const wantsFinalize = watch || viaFinishAlias || this.finalize === true;
+    for (; ; ) {
+      let doc;
+      try {
+        doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+      } catch (e) {
+        if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
+          const early = await getAciState({
+            aciName: state.aciName,
+            resourceGroup: state.resourceGroup,
+            subscriptionId: state.subscriptionId
+          }).catch(() => null);
+          if (early?.terminated) {
+            this.context.stderr.write(
+              `  ${colors.error("\u2717")} the installer container has terminated (exit ${String(early.exitCode ?? "?")}) and never reported a status.
+  ${colors.hint("inspect:")} az container logs -n ${state.aciName} -g ${state.resourceGroup}
+  ${colors.hint("reap:")} m8t bootstrap reap --force
+`
+            );
+            return 1;
+          }
+          if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
+`);
+          await sleep5(1e4);
+          continue;
+        }
+        throw e;
+      }
+      if (!watch || doc.status !== "running") {
+        if (mode === "json") {
+          this.context.stdout.write(renderJson(doc) + "\n");
+        } else {
+          this.context.stdout.write(formatStatus(doc));
+        }
+        if (wantsFinalize) {
+          if (doc.status === "done") {
+            await this.runFinalize(doc, state.subscriptionId, state.resourceGroup, mode);
+          } else if (this.finalize === true || viaFinishAlias) {
+            throw new LocalCliError({
+              code: "BOOTSTRAP_FINISH_NOT_DONE",
+              message: `The platform is not live yet (status: ${doc.status}, phase: ${doc.phase}).`,
+              hint: "Wait for 'm8t bootstrap status --watch' to reach done \u2014 it finishes the local setup itself."
+            });
+          }
+        }
+        return doc.status === "failed" ? 1 : 0;
+      }
+      if (mode === "pretty") this.context.stderr.write(`  ${colors.dim(`${doc.phase} (${String(doc.phaseIndex)}/${String(doc.phaseTotal)}) ${doc.detail ?? ""}`)}
+`);
+      const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
+      if (aci?.terminated) {
+        this.context.stderr.write(
+          `  ${colors.error("\u2717")} the installer container has terminated (exit ${String(aci.exitCode ?? "?")}) but the status is still '${doc.phase}'.
+  ${colors.hint("inspect:")} az container logs -n ${state.aciName} -g ${state.resourceGroup}
+  ${colors.hint("reap:")} m8t bootstrap reap --force
+`
+        );
+        return 1;
+      }
+      await sleep5(1e4);
+    }
+  }
+  /**
+   * Complete the local half of the install. Never throws: the platform is live,
+   * and a failure to point one machine at it must not turn a successful install
+   * into a non-zero exit — every step inside reports its own failure with the
+   * remedy, and the outer catch covers the ones that cannot.
+   *
+   * In `--output json` mode stdout carries the status document and nothing else,
+   * so all of finalize's prose is routed to stderr rather than corrupting it.
+   */
+  async runFinalize(doc, subscriptionId, resourceGroup, mode) {
+    const toStderr = (s) => this.context.stderr.write(s);
+    try {
+      await finalizeInstall({
+        doc,
+        subscriptionId: (typeof this.subscription === "string" ? this.subscription : void 0) ?? subscriptionId,
+        resourceGroup: (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? resourceGroup,
+        ...typeof this.repoRoot === "string" ? { repoRoot: this.repoRoot } : {},
+        stdout: mode === "json" ? toStderr : (s) => this.context.stdout.write(s),
+        stderr: toStderr
+      });
+    } catch (e) {
+      this.context.stderr.write(
+        `  ${colors.error("\u26A0 the platform is live, but the local setup did not complete:")} ${e.message}
+  ${colors.hint("retry:")} m8t bootstrap status --finalize
+`
+      );
+    }
+  }
+};
+function formatStatus(d) {
+  const head = `${d.status.toUpperCase()} \u2014 ${d.phase} (${String(d.phaseIndex)}/${String(d.phaseTotal)})${d.detail ? ` \u2014 ${d.detail}` : ""}
+`;
+  if (d.status === "done" && d.result) {
+    return colors.success("\u2713 ") + head + `  gateway:  ${d.result.gatewayUrl ?? "-"}
+  foundry:  ${d.result.foundryEndpoint ?? "-"}
+  ${colors.hint("next:")} m8t bootstrap reap
+`;
+  }
+  if (d.status === "failed" && d.error) {
+    return colors.error("\u2717 ") + head + `  ${colors.error(`error in ${d.error.phase}: ${d.error.message}`)}
+  ${colors.hint("inspect:")} az container logs
+`;
+  }
+  return head;
+}
+
+// src/commands/bootstrap/reap.ts
+import { Command as Command57, Option as Option54 } from "clipanion";
+init_errors();
+
+// src/lib/bootstrap-reap.ts
+var ROLE_ASSIGNMENT_API = "2022-04-01";
+var GATEWAY_SUBSCOPE_ROLES = ["Cost Management Reader", "Monitoring Reader"];
+async function listSubscriptionAssignments(subscriptionId) {
+  return JSON.parse(
+    await runAz([
+      "role",
+      "assignment",
+      "list",
+      "--all",
+      "--subscription",
+      subscriptionId,
+      "-o",
+      "json"
+    ]).catch(() => "[]") || "[]"
+  );
+}
+async function deleteAssignmentsById(ids) {
+  for (const id of ids) {
+    await runAz([
+      "rest",
+      "--method",
+      "delete",
+      "--url",
+      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
+    ]).catch(() => void 0);
+  }
+}
+async function sweepOrphanGatewaySubRoles(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
+  const matched = all.filter((r) => {
+    if (r.principalName) return false;
+    if (r.principalType !== "ServicePrincipal") return false;
+    if (r.scope !== subScope) return false;
+    if (r.description === GATEWAY_SUBSCOPE_GRANT_DESCRIPTION) return true;
+    return GATEWAY_SUBSCOPE_ROLES.includes(r.roleDefinitionName ?? "");
+  });
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
+  return matched.map((r) => ({ id: r.id, description: r.description, roleDefinitionName: r.roleDefinitionName, createdOn: r.createdOn }));
+}
+async function sweepOrphanOwnerAssignments(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
+  const matched = all.filter((r) => {
+    if (r.description === INSTALLER_GRANT_DESCRIPTION) return true;
+    return !r.principalName && r.principalType === "ServicePrincipal" && r.roleDefinitionName === "Owner" && r.scope === subScope;
+  });
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
+  return matched.map((r) => ({ id: r.id, description: r.description, createdOn: r.createdOn }));
+}
+async function reapInstaller(opts) {
+  const swallow = async (p) => {
+    try {
+      await p;
+    } catch {
+    }
+  };
+  await swallow(runAz(["container", "delete", "--name", opts.aciName, "--resource-group", opts.resourceGroup, "--subscription", opts.subscriptionId, "--yes", "--only-show-errors"]));
+  await swallow(runAz(["identity", "delete", "--name", opts.miName, "--resource-group", opts.resourceGroup, "--subscription", opts.subscriptionId]));
+  for (const id of opts.roleAssignmentIds) {
+    await swallow(runAz([
+      "rest",
+      "--method",
+      "delete",
+      "--url",
+      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
+    ]));
   }
-  stdout.write(
-    `Desktop companions installed: Stacey and Azzy are ready.
-Version: ${state.version}
-`
+  const survivors = JSON.parse(
+    await runAz([
+      "role",
+      "assignment",
+      "list",
+      "--all",
+      "--subscription",
+      opts.subscriptionId,
+      "--query",
+      `[?principalId=='${opts.principalId}' && roleDefinitionName=='Owner'].id`,
+      "-o",
+      "json"
+    ]).catch(() => "[]") || "[]"
   );
-  return 0;
+  for (const id of survivors) {
+    await swallow(runAz(["rest", "--method", "delete", "--url", `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`]));
+  }
 }
-var CompanionInstallCommand = class extends M8tCommand {
-  static paths = [["companion", "install"]];
+
+// src/commands/bootstrap/reap.ts
+var BootstrapReapCommand = class extends M8tCommand {
+  static paths = [["bootstrap", "reap"]];
   static usage = Command57.Usage({
-    description: "Install the desktop companions for this user from the release channel.",
+    description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
+    details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
-      ["Install the released build", "$0 companion install"],
-      [
-        "Install one built from this clone",
-        "$0 companion install --from apps/companion/dist-artifacts/darwin-arm64"
-      ]
+      ["Reap after done", "$0 bootstrap reap"],
+      ["Reap a failed install anyway", "$0 bootstrap reap --force"],
+      ["List orphaned role assignments across the subscription", "$0 bootstrap reap --sweep-orphans"],
+      ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  from = Option54.String("--from", {
-    description: "A locally staged build directory instead of the released one."
-  });
-  async executeCommand() {
-    return runCompanionInstallCommand(
-      this.context.stdout,
-      () => convergeCompanionFromChannel(installCompanion, this.from)
-    );
-  }
-};
-
-// src/commands/bootstrap/finish.ts
-var BootstrapFinishCommand = class extends M8tCommand {
-  static paths = [["bootstrap", "finish"]];
-  static usage = Command58.Usage({
-    description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
-    details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding intake \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
-    examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
-  });
-  repoRoot = Option55.String("--repo-root");
-  subscription = Option55.String("--subscription");
-  resourceGroup = Option55.String("--resource-group");
+  force = Option54.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option54.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option54.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
-    const state = await readBootstrapState();
-    if (!state) {
-      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state.", hint: "Run 'm8t bootstrap launch' first." });
-    }
-    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-    if (doc.status !== "done") {
-      throw new LocalCliError({
-        code: "BOOTSTRAP_FINISH_NOT_DONE",
-        message: `The platform is not live yet (status: ${doc.status}, phase: ${doc.phase}).`,
-        hint: "Wait for 'm8t bootstrap status --watch' to reach done."
-      });
-    }
-    const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
-    const markerDir = path38.join(os18.homedir(), ".m8t");
-    await fs34.mkdir(markerDir, { recursive: true });
-    await fs34.writeFile(path38.join(markerDir, "repo-root"), `${repoRoot}
-`, "utf8");
-    const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? state.subscriptionId;
-    const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? state.resourceGroup;
-    let webappUrl;
-    try {
-      const d = await discoverGateway({ subscriptionId, interactive: false, resourceGroup });
-      await writeConfig({
-        gatewayUrl: d.gatewayUrl,
-        gatewayClientId: d.gatewayClientId,
-        gatewayTenantId: d.gatewayTenantId,
-        subscriptionId: d.subscriptionId,
-        containerAppResourceId: d.containerAppResourceId,
-        cachedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      webappUrl = d.gatewayUrl;
-      this.context.stdout.write(
-        `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")}
-  gateway:  ${d.gatewayUrl}
-  foundry:  ${doc.result?.foundryEndpoint ?? "-"}
-
-`
-      );
-      try {
-        await ensureGatewayRedirectUri(d.gatewayClientId, new URL(d.gatewayUrl).host);
-      } catch (e) {
-        const err = e;
-        this.context.stderr.write(
-          `  ${colors.error("\u26A0 could not authorize sign-in for your webapp:")} ${err.message}
-  ${colors.hint(`Until this is fixed, opening ${d.gatewayUrl} will fail with AADSTS50011 (redirect URI mismatch).`)}
-  ${colors.hint("Ask a directory admin to run:")}
-  ${colors.hint(`    m8t bootstrap finish --repo-root ${repoRoot}   # (as an admin), or by hand:`)}
-  ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
-
-`
-        );
+    if (this.sweepOrphans === true) {
+      const { subscriptionId: sub } = await getAzAccount();
+      if (!sub) {
+        throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
       }
-      try {
-        const verdict = await runUsagePhase(
-          buildPrereqDeps({ subscription: subscriptionId, resourceGroup }),
-          { fix: true, onProgress: (m) => {
-            this.context.stdout.write(colors.dim(`  ${m}
-`));
-          } }
-        );
-        const rows = verdict.results.filter((r) => r.slug !== "signin-redirect-uri");
-        const unresolved = rows.filter((r) => r.status === "fail");
-        if (unresolved.length === 0) {
-          this.context.stdout.write(`  ${colors.success("\u2713 your account can reach Foundry and read the platform Key Vault")}
-
+      const execute = this.yes === true;
+      const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute });
+      const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute });
+      const total = owner.length + gateway.length;
+      if (total === 0) {
+        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub or gateway sub-scope assignments found.
 `);
-        }
-        for (const r of unresolved) {
-          this.context.stderr.write(
-            `  ${colors.error("\u26A0 could not grant you access:")} ${r.detail}
-` + (r.remedy ? `  ${colors.hint(`Fix it with: ${r.remedy}`)}
-` : "") + "\n"
-          );
-        }
-      } catch (e) {
-        this.context.stderr.write(
-          `  ${colors.error("\u26A0 could not check or grant your platform access:")} ${e.message}
-  ${colors.hint("Run 'm8t prereqs --fix' when you can \u2014 until then your AI team will not load and worker deploys will fail.")}
-
-`
-        );
+        return 0;
       }
-    } catch (e) {
-      const err = e;
-      this.context.stdout.write(`${colors.success("\u2705 The platform is live.")}
-
+      for (const f of owner) {
+        this.context.stdout.write(`  ${colors.dim("Owner@sub")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
 `);
-      this.context.stderr.write(
-        `  ${colors.hint(`\u26A0 couldn't auto-point your local tools at the gateway: ${err.message}`)}
-` + (err.hint ? `  ${colors.hint(err.hint)}
-` : "") + "\n"
-      );
+      }
+      for (const f of gateway) {
+        this.context.stdout.write(`  ${colors.dim(f.roleDefinitionName ?? "gateway sub-scope")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+`);
+      }
+      const breakdown = `${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope`;
+      if (execute) {
+        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(total)} orphaned assignment(s) (${breakdown}).
+`);
+      } else {
+        this.context.stdout.write(`
+Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
+`);
+      }
+      return 0;
     }
-    if (webappUrl !== void 0 && companionsSupportHost()) {
-      try {
-        const companion = await convergeCompanionFromChannel(installCompanion);
-        if (companion.state === "installed") {
-          this.context.stdout.write(
-            "Desktop companions installed: Stacey and Azzy are ready.\n\n"
-          );
-        } else if (companion.state !== "not-released") {
-          throw new Error("companion installation is not verified");
+    const state = await readBootstrapState();
+    if (!state) {
+      if (this.force === true) {
+        const { subscriptionId: sub } = await getAzAccount();
+        if (!sub) {
+          throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
         }
-      } catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
+        const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute: true });
+        const total = owner.length + gateway.length;
         this.context.stdout.write(
-          `Platform installation succeeded, but the desktop companions need repair.
-Run: m8t companion repair
-  ${colors.hint(reason)}
-
+          total === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub or gateway sub-scope assignments. Nothing to reap.
+` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(total)} orphaned assignment(s) (${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope).
 `
         );
+        return 0;
       }
-    }
-    let brainOrg = null;
-    try {
-      const credsRaw = await fs34.readFile(path38.join(markerDir, "github-app.json"), "utf8");
-      const creds = JSON.parse(credsRaw);
-      brainOrg = typeof creds.org === "string" ? creds.org : null;
-    } catch {
-    }
-    this.context.stdout.write(renderInstallSummary({ webappUrl, brainOrg }) + "\n");
-    this.context.stdout.write(
-      `${colors.field("Optional local tooling for your coding agent:")}
-  \u2022 Talk to your deployed workers from agent sessions (e.g. /stacey) \u2014 install the m8t plugin: guides/install/m8t-plugin.md.
-  \u2022 Azure-capable MCP servers (microsoft/azure-skills, Microsoft Learn) \u2014 see the optional steps in guides/install.md.
-  \u2022 Deploy workers conversationally with the opt-in persona skills \u2014 see guides/workers.md.
-  \u2022 Make sure your m8t CLI is current: npm i -g @m8t-stack/cli@latest
-
-${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP servers load only on a fresh start.
-`
-    );
-    try {
-      await reactiveSeedOnFinish({
-        endpoint: doc.result?.foundryEndpoint,
-        subscriptionId,
-        stdout: (s) => this.context.stdout.write(s)
+      throw new LocalCliError({
+        code: "BOOTSTRAP_NO_STATE",
+        message: "No bootstrap state to reap.",
+        hint: "Nothing to do. If a launch failed and its RG was deleted it may have orphaned an installer Owner@sub grant or the gateway's sub-scope reader roles \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean them."
       });
-    } catch (e) {
-      this.context.stderr.write(
-        `  ${colors.dim(`(company-profile seed deferred: ${e instanceof Error ? e.message : String(e)} \u2014 run 'm8t bootstrap seed-profile' later)`)}
-`
-      );
     }
+    if (this.force !== true) {
+      const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+      if (doc.status !== "done") {
+        if (doc.status === "failed") {
+          throw new LocalCliError({
+            code: "BOOTSTRAP_REAP_FAILED_INSTALL",
+            message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
+            hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          });
+        }
+        const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
+        const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
+        throw new LocalCliError({
+          code: "BOOTSTRAP_REAP_NOT_DONE",
+          message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
+          hint: deadHint
+        });
+      }
+    }
+    await reapInstaller({
+      subscriptionId: state.subscriptionId,
+      resourceGroup: state.resourceGroup,
+      aciName: state.aciName,
+      miName: state.miName,
+      roleAssignmentIds: state.roleAssignmentIds,
+      principalId: state.miPrincipalId
+    });
+    this.context.stdout.write(`${colors.success("\u2713")} reaped the installer (ACI + identity + its role assignments). The platform stays.
+`);
+    this.context.stdout.write(`  ${colors.hint("next:")} m8t open   ${colors.dim("# your local setup was completed by 'm8t bootstrap status --watch'")}
+`);
     return 0;
   }
 };
@@ -31483,7 +31676,7 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 import * as fs36 from "fs";
 import * as os20 from "os";
 import * as path40 from "path";
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 init_errors();
 
@@ -32291,7 +32484,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command59.Usage({
+  static usage = Command58.Usage({
     description: "Deploy Azzy + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -32312,16 +32505,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option56.String("--repo-root");
-  port = Option56.String("--port", "3000");
-  endpoint = Option56.String("--endpoint", {
+  repoRoot = Option55.String("--repo-root");
+  port = Option55.String("--port", "3000");
+  endpoint = Option55.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option56.Boolean("--prep-only", false);
-  skipInstall = Option56.Boolean("--skip-install", false);
-  stop = Option56.Boolean("--stop", false);
-  foreground = Option56.Boolean("--foreground", false);
-  voice = Option56.Boolean("--voice", false, {
+  prepOnly = Option55.Boolean("--prep-only", false);
+  skipInstall = Option55.Boolean("--skip-install", false);
+  stop = Option55.Boolean("--stop", false);
+  foreground = Option55.Boolean("--foreground", false);
+  voice = Option55.Boolean("--voice", false, {
     description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
   });
   async executeCommand() {
@@ -32483,10 +32676,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command60, Option as Option57 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command60.Usage({
+  static usage = Command59.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
     details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
     examples: [
@@ -32494,11 +32687,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option57.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option57.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
-  watch = Option57.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option57.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option57.String("--github-app-creds");
+  endpoint = Option56.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option56.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
+  watch = Option56.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option56.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option56.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -32561,7 +32754,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs37 from "fs";
 import * as os21 from "os";
 import * as path41 from "path";
-import { Command as Command61, Option as Option58 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -32643,7 +32836,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command61.Usage({
+  static usage = Command60.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -32651,11 +32844,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option58.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option58.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option58.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option58.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option58.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option57.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option57.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option57.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option57.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option57.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -32705,7 +32898,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command62 } from "clipanion";
+import { Command as Command61 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -32939,7 +33132,7 @@ function serializeEvent(value) {
 }
 
 // src/lib/companion-chat-client.ts
-import { stat as stat3 } from "fs/promises";
+import { stat as stat4 } from "fs/promises";
 var RESPONSE_MAX_BYTES = 1e6;
 var REQUEST_DEADLINE_MS = 12e4;
 var OPAQUE_ID = /^[A-Za-z0-9_-]{1,256}$/u;
@@ -33113,7 +33306,7 @@ function createDeadline(deps) {
 }
 async function readInstallEpoch() {
   try {
-    const stats = await stat3(getConfigPath());
+    const stats = await stat4(getConfigPath());
     const candidates = [stats.birthtimeMs, stats.mtimeMs].filter(
       (value) => Number.isFinite(value) && value > 0
     );
@@ -33305,7 +33498,7 @@ function companionUpdateAvailable(update) {
 }
 
 // src/commands/companion/bridge.ts
-var defaultDeps2 = {
+var defaultDeps3 = {
   roster: rosterCompanions,
   send: sendCompanionMessage,
   update: () => checkCompanionUpdate(defaultLocalCompanionInstallOptions())
@@ -33337,7 +33530,7 @@ function exitFor(terminal) {
   }
   return 2;
 }
-async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps2) {
+async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps3) {
   let request;
   try {
     request = parseRequestLine(await readSingleRequest(stdin));
@@ -33362,7 +33555,7 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps2) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command62 {
+var CompanionBridgeCommand = class extends Command61 {
   static paths = [["companion", "_bridge"]];
   async execute() {
     return runCompanionBridge(
@@ -33374,7 +33567,7 @@ var CompanionBridgeCommand = class extends Command62 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command63 } from "clipanion";
+import { Command as Command62 } from "clipanion";
 async function runCompanionStatusCommand(stdout, status, update) {
   const state = await status();
   if (state.state === "not-installed") {
@@ -33404,7 +33597,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command63.Usage({
+  static usage = Command62.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -33418,7 +33611,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command64 } from "clipanion";
+import { Command as Command63, Option as Option58 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -33437,19 +33630,22 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command64.Usage({
-    description: "Restore the internal desktop companion and start-at-login state."
+  static usage = Command63.Usage({
+    description: "Restore the desktop companions and start-at-login state."
+  });
+  resourceGroup = Option58.String("--resource-group", {
+    description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
     return runCompanionRepairCommand(
       this.context.stdout,
-      () => convergeCompanionFromChannel(repairCompanion)
+      () => convergeCompanionFromChannel(repairCompanion, void 0, this.resourceGroup)
     );
   }
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command65 } from "clipanion";
+import { Command as Command64 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -33461,7 +33657,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command65.Usage({
+  static usage = Command64.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -33535,7 +33731,6 @@ cli.register(BootstrapPreflightCommand);
 cli.register(BootstrapLaunchCommand);
 cli.register(BootstrapStatusCommand);
 cli.register(BootstrapReapCommand);
-cli.register(BootstrapFinishCommand);
 cli.register(BootstrapUiCommand);
 cli.register(BootstrapSeedProfileCommand);
 cli.register(TelemetryEnrollCommand);