@m8t-stack/cli 0.2.69 → 0.2.70

package/dist/cli.js

@@ -1364,7 +1364,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.69";
+var CLI_VERSION = "0.2.70";
 
 // src/lib/render-error.ts
 init_errors();
@@ -3698,12 +3698,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path42(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path43(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path43 = statics.reduce((previousValue, currentValue, index) => {
+  const path44 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3720,7 +3720,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path42(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path43.split(/[?#]/, 1)[0];
+  const pathOnly = path44.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3741,10 +3741,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path42(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path43}
+${path44}
 ${underline}`);
   }
-  return path43;
+  return path44;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -12012,9 +12012,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path42, query, defaultBaseURL) {
+  buildURL(path43, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path42) ? new URL(path42) : new URL(baseURL + (baseURL.endsWith("/") && path42.startsWith("/") ? path42.slice(1) : path42));
+    const url = isAbsoluteURL(path43) ? new URL(path43) : new URL(baseURL + (baseURL.endsWith("/") && path43.startsWith("/") ? path43.slice(1) : path43));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -12044,24 +12044,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path42, opts) {
-    return this.methodRequest("get", path42, opts);
+  get(path43, opts) {
+    return this.methodRequest("get", path43, opts);
   }
-  post(path42, opts) {
-    return this.methodRequest("post", path42, opts);
+  post(path43, opts) {
+    return this.methodRequest("post", path43, opts);
   }
-  patch(path42, opts) {
-    return this.methodRequest("patch", path42, opts);
+  patch(path43, opts) {
+    return this.methodRequest("patch", path43, opts);
   }
-  put(path42, opts) {
-    return this.methodRequest("put", path42, opts);
+  put(path43, opts) {
+    return this.methodRequest("put", path43, opts);
   }
-  delete(path42, opts) {
-    return this.methodRequest("delete", path42, opts);
+  delete(path43, opts) {
+    return this.methodRequest("delete", path43, opts);
   }
-  methodRequest(method, path42, opts) {
+  methodRequest(method, path43, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path42, ...opts2 };
+      return { method, path: path43, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -12186,8 +12186,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path42, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path42, ...opts2 })) : { method: "get", path: path42, ...opts });
+  getAPIList(path43, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path43, ...opts2 })) : { method: "get", path: path43, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -12281,8 +12281,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path42, query, defaultBaseURL } = options;
-    const url = this.buildURL(path42, query, defaultBaseURL);
+    const { method, path: path43, query, defaultBaseURL } = options;
+    const url = this.buildURL(path43, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12510,6 +12510,9 @@ function classifyFoundryError(err) {
 }
 
 // src/lib/render-error.ts
+function renderHint(hint) {
+  return hint.split("\n").join("\n        ");
+}
 function renderError(err, opts) {
   const mode = resolveOutputMode(opts.output, opts.stderr);
   if (err instanceof Error && (err.name === "ExitPromptError" || err.message === "User force closed the prompt")) {
@@ -12533,7 +12536,7 @@ function renderError(err, opts) {
     opts.stderr.write(`${colors.error("error:")} ${err.envelope.message}
 `);
     const hint = resolveBackendHint(err.envelope);
-    if (hint) opts.stderr.write(`  ${colors.hint("hint:")} ${hint}
+    if (hint) opts.stderr.write(`  ${colors.hint("hint:")} ${renderHint(hint)}
 `);
     if (opts.verbose) {
       opts.stderr.write("\n" + colors.dim(renderJson(err.envelope)) + "\n");
@@ -12560,7 +12563,7 @@ function renderError(err, opts) {
     opts.stderr.write(`${colors.error("error:")} ${err.message}
 `);
     const hint = err.hint ?? resolveLocalHint(err.code);
-    if (hint) opts.stderr.write(`  ${colors.hint("hint:")} ${hint}
+    if (hint) opts.stderr.write(`  ${colors.hint("hint:")} ${renderHint(hint)}
 `);
     if (opts.verbose && err.cause instanceof Error) {
       opts.stderr.write("\n" + colors.dim(`caused by: ${err.cause.stack ?? err.cause.message}`) + "\n");
@@ -13325,10 +13328,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path42 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path43 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path42 },
+      { method: "GET", path: path43 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -14159,7 +14162,7 @@ var TeamShowCommand = class extends M8tCommand {
 // src/commands/brain/app-create.ts
 import * as fs4 from "fs";
 import * as os from "os";
-import * as path4 from "path";
+import * as path5 from "path";
 import { randomBytes } from "crypto";
 import * as readline from "readline/promises";
 import { Command as Command16, Option as Option15 } from "clipanion";
@@ -14359,6 +14362,41 @@ async function findValidBrainApp(credsPath, org, deps = {}) {
   }
 }
 
+// src/lib/github-app-paths.ts
+import * as path4 from "path";
+function brainAppPointerPath(home) {
+  return path4.join(home, ".m8t", "github-app.json");
+}
+function orgFileSegment(org) {
+  return org.replace(/[^A-Za-z0-9-]+/g, "-");
+}
+function brainAppFilePaths(home, org, appId) {
+  const dir = path4.join(home, ".m8t");
+  const stem = `github-app-${orgFileSegment(org)}-${appId}`;
+  return {
+    pemPath: path4.join(dir, `${stem}.pem`),
+    sidecarPath: path4.join(dir, `${stem}.json`)
+  };
+}
+function isPreservable(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const c = v;
+  return typeof c.org === "string" && c.org !== "" && typeof c.appId === "string" && c.appId !== "";
+}
+function outgoingSidecarToPreserve(home, pointerText, sidecarExists) {
+  if (pointerText === null) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(pointerText);
+  } catch {
+    return null;
+  }
+  if (!isPreservable(parsed)) return null;
+  const { sidecarPath } = brainAppFilePaths(home, parsed.org, parsed.appId);
+  if (sidecarExists(sidecarPath)) return null;
+  return { path: sidecarPath, org: parsed.org, appId: parsed.appId };
+}
+
 // src/lib/gh-helpers.ts
 init_errors();
 import { spawn as spawn2 } from "child_process";
@@ -14539,8 +14577,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path42) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path42}`]);
+    getFile: async (path43) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path43}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -14607,6 +14645,36 @@ var BrainAppCreateCommand = class extends M8tCommand {
   forceNew = Option15.Boolean("--new", false, {
     description: "Create a new brain App even if one is already installed on the org."
   });
+  /**
+   * Copy the currently-active App's record to its own per-App file when it has
+   * none. Best-effort: a pointer that cannot be read or written is not a reason
+   * to refuse to create an App, and the outcome is announced either way rather
+   * than swallowed — losing this record silently is the failure being prevented.
+   */
+  preserveOutgoingRecord(credsOut) {
+    let pointerText;
+    try {
+      pointerText = fs4.readFileSync(credsOut, "utf8");
+    } catch {
+      return;
+    }
+    const outgoing = outgoingSidecarToPreserve(os.homedir(), pointerText, fs4.existsSync);
+    if (!outgoing) return;
+    try {
+      fs4.mkdirSync(path5.dirname(outgoing.path), { recursive: true });
+      fs4.writeFileSync(outgoing.path, pointerText, { mode: 384 });
+      this.context.stderr.write(
+        `  ${colors.dim(`kept the current App's record (${outgoing.org}, id ${outgoing.appId}) at ${outgoing.path}`)}
+`
+      );
+    } catch (e) {
+      this.context.stderr.write(
+        `  ${colors.warn(`could not save the current App's record to ${outgoing.path}: ${e.message}`)}
+  ${colors.warn(`back up ${credsOut} yourself if you need to switch back to that App.`)}
+`
+      );
+    }
+  }
   async executeCommand() {
     if (!this.org) {
       throw new LocalCliError({
@@ -14616,11 +14684,12 @@ var BrainAppCreateCommand = class extends M8tCommand {
       });
     }
     const org = this.org;
-    const pemOut = typeof this.pemOut === "string" ? this.pemOut : path4.join(os.homedir(), ".m8t", "github-app.pem");
-    const credsOut = typeof this.credsOut === "string" ? this.credsOut : path4.join(os.homedir(), ".m8t", "github-app.json");
+    const pemOutOverride = typeof this.pemOut === "string" ? this.pemOut : void 0;
+    const credsOut = typeof this.credsOut === "string" ? this.credsOut : brainAppPointerPath(os.homedir());
     const port = Number(this.port);
     const onProgress = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
+    this.preserveOutgoingRecord(credsOut);
     const existing = await findValidBrainApp(credsOut, org);
     if (existing) {
       const isTTY = this.context.stdout.isTTY === true;
@@ -14669,7 +14738,9 @@ var BrainAppCreateCommand = class extends M8tCommand {
       }),
       onProgress
     });
-    fs4.mkdirSync(path4.dirname(pemOut), { recursive: true });
+    const layout = brainAppFilePaths(os.homedir(), org, app.id);
+    const pemOut = pemOutOverride ?? layout.pemPath;
+    fs4.mkdirSync(path5.dirname(pemOut), { recursive: true });
     fs4.writeFileSync(pemOut, app.pem, { mode: 384 });
     this.context.stdout.write(
       `${colors.success("\u2713")} App created: ${colors.field(app.slug)} (id ${app.id}); pem \u2192 ${pemOut}
@@ -14683,11 +14754,16 @@ ${colors.success("\u2713")} installed on ${org} (installation ${installationId})
       installationId,
       pemPath: pemOut
     };
-    fs4.mkdirSync(path4.dirname(credsOut), { recursive: true });
-    fs4.writeFileSync(credsOut, JSON.stringify(creds, null, 2), { mode: 384 });
+    const credsJson = JSON.stringify(creds, null, 2);
+    if (!pemOutOverride) {
+      fs4.writeFileSync(layout.sidecarPath, credsJson, { mode: 384 });
+    }
+    fs4.mkdirSync(path5.dirname(credsOut), { recursive: true });
+    fs4.writeFileSync(credsOut, credsJson, { mode: 384 });
     this.context.stdout.write(
-      `${colors.success("\u2713")} creds \u2192 ${credsOut}
-`
+      `${colors.success("\u2713")} creds \u2192 ${credsOut} ${colors.dim("(this App is now the active one)")}
+` + (pemOutOverride ? "" : `  ${colors.dim(`kept alongside the key: ${layout.sidecarPath}`)}
+`)
     );
     if (this.output === "json") this.context.stdout.write(JSON.stringify(creds) + "\n");
     return 0;
@@ -14703,7 +14779,7 @@ import { DefaultAzureCredential as DefaultAzureCredential3 } from "@azure/identi
 init_errors();
 import * as fs5 from "fs";
 import * as os2 from "os";
-import * as path5 from "path";
+import * as path6 from "path";
 function discoverKvUri(env, override) {
   if (override) return override;
   const v = env.AZURE_KEYVAULT_URI ?? env.KEYVAULT_URI;
@@ -14715,7 +14791,7 @@ function discoverKvUri(env, override) {
   });
 }
 function tryResolveRepoRoot() {
-  const marker = path5.join(os2.homedir(), ".m8t", "repo-root");
+  const marker = path6.join(os2.homedir(), ".m8t", "repo-root");
   if (!fs5.existsSync(marker)) return null;
   const root = fs5.readFileSync(marker, "utf8").trim();
   return root.length > 0 ? root : null;
@@ -14785,10 +14861,10 @@ var BrainCheckAppCommand = class extends M8tCommand {
 init_esm2();
 import { Command as Command18, Option as Option17 } from "clipanion";
 import { execFileSync, spawnSync } from "child_process";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import * as fs11 from "fs";
 import * as os4 from "os";
-import * as path10 from "path";
+import * as path11 from "path";
 import * as readline2 from "readline/promises";
 import { DefaultAzureCredential as DefaultAzureCredential4 } from "@azure/identity";
 init_errors();
@@ -14808,6 +14884,9 @@ async function listProjectsForAccount(credential2, accountId) {
 function formatProjectCandidate(c) {
   return `${c.projectName} (account=${c.accountName}, ${c.region})`;
 }
+function resourceGroupOfArmId(id) {
+  return /\/resourceGroups\/([^/]+)/i.exec(id)?.[1].toLowerCase();
+}
 async function resolveFoundryProject(opts) {
   const candidates = [];
   const accounts = await authedJsonPagedValues({
@@ -14844,29 +14923,37 @@ async function resolveFoundryProject(opts) {
     const match = candidates.find((c) => c.endpoint === opts.agentEndpoint);
     if (match) return match;
   }
-  if (candidates.length === 0) {
+  let scoped = candidates;
+  if (opts.resourceGroup) {
+    const want = opts.resourceGroup.toLowerCase();
+    scoped = candidates.filter((c) => resourceGroupOfArmId(c.accountScope) === want);
+    const dropped = candidates.filter((c) => !scoped.includes(c));
+    if (dropped.length > 0) opts.onScopedOut?.(dropped);
+  }
+  const searched = opts.resourceGroup ? `resource group ${opts.resourceGroup} (subscription ${opts.subscriptionId})` : `subscription ${opts.subscriptionId}`;
+  if (scoped.length === 0) {
     throw new LocalCliError({
       code: "FOUNDRY_PROJECT_ZERO",
-      message: `No AIServices Foundry project found in subscription ${opts.subscriptionId}.`,
+      message: `No AIServices Foundry project found in ${searched}.`,
       hint: "Create one with 'm8t foundry create --resource-group <rg> --location <region>', switch subscription with 'az account set --subscription <id>', or pass --endpoint."
     });
   }
-  if (candidates.length === 1) return candidates[0];
+  if (scoped.length === 1) return scoped[0];
   if (!opts.interactive) {
     throw new LocalCliError({
       code: "FOUNDRY_PROJECT_MULTIPLE",
-      message: `Multiple Foundry projects found: ${candidates.map(formatProjectCandidate).join("; ")}.`,
-      hint: `Pass --endpoint <url> to choose. Endpoints: ${candidates.map((c) => c.endpoint).join(" | ")}`
+      message: opts.resourceGroup ? `Resource group ${opts.resourceGroup} holds more than one Foundry project: ${scoped.map(formatProjectCandidate).join("; ")}.` : `Multiple Foundry projects found: ${scoped.map(formatProjectCandidate).join("; ")}.`,
+      hint: `Pass --endpoint <url> to choose. Endpoints: ${scoped.map((c) => c.endpoint).join(" | ")}`
     });
   }
   const endpoint = await select2({
-    message: `Multiple Foundry projects in subscription ${opts.subscriptionId}. Choose one:`,
-    choices: candidates.map((c) => ({
+    message: `Multiple Foundry projects in ${searched}. Choose one:`,
+    choices: scoped.map((c) => ({
       name: formatProjectCandidate(c),
       value: c.endpoint
     }))
   });
-  const chosen = candidates.find((c) => c.endpoint === endpoint);
+  const chosen = scoped.find((c) => c.endpoint === endpoint);
   if (!chosen) {
     throw new LocalCliError({ code: "FOUNDRY_PROJECT_SELECTION_FAILED", message: "No project selected." });
   }
@@ -14876,11 +14963,11 @@ async function resolveFoundryProject(opts) {
 // src/lib/agent-yaml.ts
 init_errors();
 import * as fs6 from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 import * as os3 from "os";
 import { parse as parseYaml3, stringify as stringifyYaml3 } from "yaml";
 function agentYamlPath(agentName, home = os3.homedir()) {
-  return path6.join(home, ".m8t", "foundry", `${agentName}.yaml`);
+  return path7.join(home, ".m8t", "foundry", `${agentName}.yaml`);
 }
 function readAgentYaml(agentName, home) {
   const file = agentYamlPath(agentName, home);
@@ -14890,7 +14977,7 @@ function readAgentYaml(agentName, home) {
 }
 function writeAgentYaml(agentName, data, home) {
   const file = agentYamlPath(agentName, home);
-  fs6.mkdirSync(path6.dirname(file), { recursive: true });
+  fs6.mkdirSync(path7.dirname(file), { recursive: true });
   fs6.writeFileSync(file, stringifyYaml3(data), { mode: 384 });
 }
 function patchAgentYaml(agentName, patch, home) {
@@ -14933,7 +15020,7 @@ function patchAgentYaml(agentName, patch, home) {
 init_esm2();
 init_esm();
 init_errors();
-import * as path7 from "path";
+import * as path8 from "path";
 import * as fs8 from "fs";
 
 // src/lib/persona-render.ts
@@ -15116,7 +15203,7 @@ async function linkBrain(args) {
   progress(`Token rotated (expires ${rotation.expiresAt.toISOString()})`);
   let foundryVersion;
   if (!alreadyLinked) {
-    const loaderPath = path7.join(args.repoRoot, "targets/foundry/brain-loader.md");
+    const loaderPath = path8.join(args.repoRoot, "targets/foundry/brain-loader.md");
     const loaderTemplate = fs8.readFileSync(loaderPath, "utf8");
     const loader = loaderTemplate.replaceAll("{{brain_repo}}", args.repo);
     const yaml = readAgentYaml(args.agentName, args.home);
@@ -15124,7 +15211,7 @@ async function linkBrain(args) {
     let base;
     if (personaPath) {
       progress("Re-rendering persona body with brain loader\u2026");
-      const resolved = personaPath.startsWith("/") ? personaPath : path7.join(args.repoRoot, personaPath);
+      const resolved = personaPath.startsWith("/") ? personaPath : path8.join(args.repoRoot, personaPath);
       base = renderPersonaBody(resolved, yaml?.fillableFieldValues ?? {}, args.agentName);
     } else {
       progress("No local persona yaml \u2014 basing instructions on the deployed agent\u2026");
@@ -15281,11 +15368,11 @@ async function createBrainEnabledVersion(args) {
 // src/lib/brain-seed.ts
 init_errors();
 import * as fs10 from "fs";
-import * as path9 from "path";
+import * as path10 from "path";
 
 // src/lib/seed-manifest.ts
 import * as fs9 from "fs";
-import * as path8 from "path";
+import * as path9 from "path";
 var SEED_MANIFEST_PATH = ".m8t/seed-manifest.json";
 var SEED_PATHS = ["skills", "references", "targets"];
 function isLineage(v) {
@@ -15318,7 +15405,7 @@ function serializeSeedManifest(m) {
   return JSON.stringify(m, null, 2) + "\n";
 }
 function walkFiles(root, rel = "") {
-  const abs = path8.join(root, rel);
+  const abs = path9.join(root, rel);
   if (!fs9.existsSync(abs)) return [];
   const out = [];
   for (const entry of fs9.readdirSync(abs, { withFileTypes: true })) {
@@ -15331,14 +15418,14 @@ function walkFiles(root, rel = "") {
 function deriveOwnedPaths(seedDir) {
   const owned = /* @__PURE__ */ new Set([SEED_MANIFEST_PATH]);
   for (const sub of SEED_PATHS) {
-    for (const rel of walkFiles(path8.join(seedDir, sub))) owned.add(`${sub}/${rel}`);
+    for (const rel of walkFiles(path9.join(seedDir, sub))) owned.add(`${sub}/${rel}`);
   }
   return [...owned].sort((a, b) => a.localeCompare(b));
 }
 
 // src/lib/brain-seed.ts
 function resolveSeed(name) {
-  const dir = path9.join(resolveRepoRoot(), "brain-seeds", name);
+  const dir = path10.join(resolveRepoRoot(), "brain-seeds", name);
   if (!fs10.existsSync(dir)) {
     throw new LocalCliError({
       code: "SEED_NOT_FOUND",
@@ -15361,8 +15448,8 @@ function writeSeedMarker(args) {
     refreshedToVersion: args.version,
     ownedPaths: deriveOwnedPaths(args.seedDir)
   }]);
-  const dest = path9.join(args.destDir, SEED_MANIFEST_PATH);
-  fs10.mkdirSync(path9.dirname(dest), { recursive: true });
+  const dest = path10.join(args.destDir, SEED_MANIFEST_PATH);
+  fs10.mkdirSync(path10.dirname(dest), { recursive: true });
   fs10.writeFileSync(dest, serializeSeedManifest(manifest));
 }
 
@@ -15607,7 +15694,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path42) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path42, fetchImpl: args.fetchImpl }),
+    getFile: (path43) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path43, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -15904,7 +15991,7 @@ var BrainCreateCommand = class extends M8tCommand {
     if (useAppPath) {
       await assertInstallationPermissions({
         appId: appIdOpt,
-        privateKeyPem: readFileSync6(appPemOpt, "utf8"),
+        privateKeyPem: readFileSync7(appPemOpt, "utf8"),
         installationId: installationIdOpt,
         org: owner,
         onUnverified: (m) => this.context.stderr.write(`  ${colors.dim(`warning: ${m}`)}
@@ -15936,7 +16023,7 @@ var BrainCreateCommand = class extends M8tCommand {
       agentEndpoint
     });
     const repoRoot = resolveRepoRoot();
-    const templateSrc = path10.join(repoRoot, "brain-template");
+    const templateSrc = path11.join(repoRoot, "brain-template");
     if (!fs11.existsSync(templateSrc)) {
       throw new LocalCliError({
         code: "TEMPLATE_MISSING",
@@ -15944,7 +16031,7 @@ var BrainCreateCommand = class extends M8tCommand {
         hint: "Ensure brain-template/ exists at the repo root (same level as apps/)."
       });
     }
-    const tmpDir = fs11.mkdtempSync(path10.join(os4.tmpdir(), `m8t-brain-create-${worker}-`));
+    const tmpDir = fs11.mkdtempSync(path11.join(os4.tmpdir(), `m8t-brain-create-${worker}-`));
     let result2;
     let resolvedInstallationId = null;
     const force = this.reuse === true ? "reuse" : this.newName === true ? "new" : void 0;
@@ -15954,7 +16041,7 @@ var BrainCreateCommand = class extends M8tCommand {
     if (useAppPath) {
       token = await mintInstallationTokenFromPem({
         appId: appIdOpt,
-        privateKeyPem: readFileSync6(appPemOpt, "utf8"),
+        privateKeyPem: readFileSync7(appPemOpt, "utf8"),
         installationId: installationIdOpt
       });
       const tok = token;
@@ -16530,7 +16617,7 @@ init_esm2();
 init_errors();
 import * as fs12 from "fs";
 import * as os5 from "os";
-import * as path11 from "path";
+import * as path12 from "path";
 init_foundry_agent_get();
 init_foundry_agent_version();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
@@ -16561,7 +16648,7 @@ async function unlinkBrain(args) {
   if (yaml?.personaPath) {
     let personaPath = yaml.personaPath;
     if (!personaPath.startsWith("/")) {
-      const marker = path11.join(args.home ?? os5.homedir(), ".m8t", "repo-root");
+      const marker = path12.join(args.home ?? os5.homedir(), ".m8t", "repo-root");
       if (!fs12.existsSync(marker)) {
         throw new LocalCliError({
           code: "PERSONA_PATH_NOT_ABSOLUTE",
@@ -16569,7 +16656,7 @@ async function unlinkBrain(args) {
           hint: "Re-run 'm8t install' from a fresh m8t checkout (writes ~/.m8t/repo-root) \u2014 or edit the personaPath to absolute."
         });
       }
-      personaPath = path11.join(fs12.readFileSync(marker, "utf8").trim(), personaPath);
+      personaPath = path12.join(fs12.readFileSync(marker, "utf8").trim(), personaPath);
     }
     strippedInstructions = renderPersonaBody(personaPath, yaml.fillableFieldValues ?? {}, args.agentName);
   } else {
@@ -16791,24 +16878,24 @@ init_errors();
 
 // src/lib/deploy-prompt-advisor.ts
 import * as fs13 from "fs";
-import * as path12 from "path";
+import * as path13 from "path";
 import { parse as parseYaml6 } from "yaml";
 init_foundry_agents();
 init_errors();
 init_esm();
 function findPersonasRoot(hint) {
-  let dir = path12.resolve(hint);
-  const fsRoot = path12.parse(dir).root;
+  let dir = path13.resolve(hint);
+  const fsRoot = path13.parse(dir).root;
   for (; ; ) {
-    if (fs13.existsSync(path12.join(dir, "personas"))) return dir;
-    const parent = path12.dirname(dir);
+    if (fs13.existsSync(path13.join(dir, "personas"))) return dir;
+    const parent = path13.dirname(dir);
     if (parent === dir || dir === fsRoot) return null;
     dir = parent;
   }
 }
 async function deployPromptAdvisor(args) {
   const resolvedRoot = findPersonasRoot(args.repoRoot);
-  const personaPath = resolvedRoot ? path12.join(resolvedRoot, "personas", args.persona, "persona.md") : path12.join(args.repoRoot, "personas", args.persona, "persona.md");
+  const personaPath = resolvedRoot ? path13.join(resolvedRoot, "personas", args.persona, "persona.md") : path13.join(args.repoRoot, "personas", args.persona, "persona.md");
   let raw;
   try {
     raw = fs13.readFileSync(personaPath, "utf8");
@@ -17572,7 +17659,7 @@ ${colors.success("\u2713")} removed ${colors.field(name)}.
 };
 
 // src/commands/a2a/enable.ts
-import * as path14 from "path";
+import * as path15 from "path";
 import { Command as Command26, Option as Option25 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential11 } from "@azure/identity";
 init_errors();
@@ -17581,7 +17668,7 @@ init_errors();
 init_errors();
 import * as fs16 from "fs";
 import * as os6 from "os";
-import * as path13 from "path";
+import * as path14 from "path";
 import { parse as parseYaml8 } from "yaml";
 var A2A_PATH = "/api/a2a/mcp";
 function resolveBridgeUrl(opts) {
@@ -17603,7 +17690,7 @@ function clean(v) {
   return t.length ? t : void 0;
 }
 function readConfigGatewayUrl(home) {
-  const cfg = path13.join(home ?? os6.homedir(), ".m8t", "config.yaml");
+  const cfg = path14.join(home ?? os6.homedir(), ".m8t", "config.yaml");
   if (!fs16.existsSync(cfg)) return void 0;
   try {
     const o = parseYaml8(fs16.readFileSync(cfg, "utf8"));
@@ -17675,11 +17762,11 @@ var A2aEnableCommand = class extends M8tCommand {
   resolvePersonaPath() {
     if (typeof this.persona === "string" && this.persona.length > 0) {
       if (this.persona.includes("/") || this.persona.endsWith(".md")) return this.persona;
-      return path14.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
+      return path15.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
     }
     const yaml = readAgentYaml(this.worker);
     if (yaml?.personaPath) {
-      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path14.join(resolveRepoRoot(), yaml.personaPath);
+      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path15.join(resolveRepoRoot(), yaml.personaPath);
     }
     throw new LocalCliError({ code: "A2A_NO_PERSONA", message: `Could not resolve a persona for '${this.worker}'. Pass --persona <name>.` });
   }
@@ -17737,7 +17824,7 @@ import { Command as Command28 } from "clipanion";
 import { createHash as createHash2 } from "crypto";
 import * as fs17 from "fs";
 import * as os7 from "os";
-import * as path15 from "path";
+import * as path16 from "path";
 function readVersionFrontmatter(file) {
   if (!fs17.existsSync(file)) return "";
   const text = fs17.readFileSync(file, "utf8");
@@ -17755,20 +17842,20 @@ var SIDECAR_FILENAME = "m8t-architect.m8t-skill.json";
 var LEGACY_SIDECAR_FILENAME = ".m8t-skill.json";
 function vsCodeUserDataDir() {
   if (process.platform === "darwin") {
-    return path15.join(os7.homedir(), "Library", "Application Support", "Code", "User");
+    return path16.join(os7.homedir(), "Library", "Application Support", "Code", "User");
   }
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA ?? path15.join(os7.homedir(), "AppData", "Roaming");
-    return path15.join(appData, "Code", "User");
+    const appData = process.env.APPDATA ?? path16.join(os7.homedir(), "AppData", "Roaming");
+    return path16.join(appData, "Code", "User");
   }
   return null;
 }
 function vsCodePromptsDir() {
   const userData = vsCodeUserDataDir();
   if (!userData) return null;
-  const prompts = path15.join(userData, "prompts");
+  const prompts = path16.join(userData, "prompts");
   if (fs17.existsSync(prompts)) return prompts;
-  const promptFiles = path15.join(userData, "prompt-files");
+  const promptFiles = path16.join(userData, "prompt-files");
   if (fs17.existsSync(promptFiles)) return promptFiles;
   return prompts;
 }
@@ -17780,7 +17867,7 @@ var COPILOT_CLI_SKILLS_ROOTS = [
 function sidecarLocations() {
   const home = os7.homedir();
   const locations = [
-    { host: "Claude Code", dir: path15.join(home, ".claude", "skills", "m8t-architect") }
+    { host: "Claude Code", dir: path16.join(home, ".claude", "skills", "m8t-architect") }
   ];
   const vsCodeDir = vsCodePromptsDir();
   if (vsCodeDir) {
@@ -17789,7 +17876,7 @@ function sidecarLocations() {
   for (const segments of COPILOT_CLI_SKILLS_ROOTS) {
     locations.push({
       host: "GitHub Copilot CLI",
-      dir: path15.join(home, ...segments, "m8t-architect")
+      dir: path16.join(home, ...segments, "m8t-architect")
     });
   }
   return locations;
@@ -17798,7 +17885,7 @@ function resolveSidecar() {
   let best = null;
   for (const loc of sidecarLocations()) {
     for (const filename of [SIDECAR_FILENAME, LEGACY_SIDECAR_FILENAME]) {
-      const candidate2 = path15.join(loc.dir, filename);
+      const candidate2 = path16.join(loc.dir, filename);
       let mtimeMs;
       try {
         mtimeMs = fs17.statSync(candidate2).mtimeMs;
@@ -17813,7 +17900,7 @@ function resolveSidecar() {
   return best;
 }
 function checkArchitectDrift() {
-  const sourcePath = path15.join(
+  const sourcePath = path16.join(
     resolveRepoRoot(),
     "personas",
     "m8t-architect",
@@ -17896,7 +17983,7 @@ var ArchitectCheckCommand = class extends M8tCommand {
 
 // src/commands/coder/deploy.ts
 init_esm2();
-import * as path17 from "path";
+import * as path18 from "path";
 import { Command as Command29, Option as Option27 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential13 } from "@azure/identity";
 init_errors();
@@ -18164,13 +18251,13 @@ async function deployHostedWorker(args) {
 
 // src/lib/persona.ts
 import * as fs18 from "fs";
-import * as path16 from "path";
+import * as path17 from "path";
 import { parse as parseYaml9 } from "yaml";
 function findRepoRoot(startDir) {
-  let dir = path16.resolve(startDir);
+  let dir = path17.resolve(startDir);
   for (; ; ) {
-    if (fs18.existsSync(path16.join(dir, "personas"))) return dir;
-    const parent = path16.dirname(dir);
+    if (fs18.existsSync(path17.join(dir, "personas"))) return dir;
+    const parent = path17.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -18178,7 +18265,7 @@ function findRepoRoot(startDir) {
 function resolvePersona(persona, cwd = process.cwd()) {
   const root = findRepoRoot(cwd);
   if (!root) return { persona, personaVersion: null };
-  const file = path16.join(root, "personas", persona, "persona.md");
+  const file = path17.join(root, "personas", persona, "persona.md");
   let raw;
   try {
     raw = fs18.readFileSync(file, "utf-8");
@@ -18538,7 +18625,7 @@ var CoderDeployCommand = class extends M8tCommand {
         projectEndpoint: project.endpoint,
         projectArmId: `${project.accountScope}/projects/${project.projectName}`,
         agentName: this.name,
-        personaPath: path17.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
+        personaPath: path18.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
         bridgeUrl,
         onProgress
       });
@@ -18665,7 +18752,7 @@ var CoderTeardownCommand = class extends M8tCommand {
 
 // src/commands/azure-exec/deploy.ts
 init_esm2();
-import * as path18 from "path";
+import * as path19 from "path";
 import { Command as Command31, Option as Option29 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential15 } from "@azure/identity";
 init_errors();
@@ -18941,7 +19028,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       kvUri
     });
     onProgress?.("a2a-enabling as a target\u2026");
-    const personaPath = path18.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
+    const personaPath = path19.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
     const bridgeUrl = resolveBridgeUrl({
       flag: typeof this.gatewayUrl === "string" ? this.gatewayUrl : void 0,
       env: processEnv
@@ -19107,8 +19194,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path42 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path42}:pull`);
+  const path43 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path43}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -19124,7 +19211,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path42}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path43}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -19409,7 +19496,7 @@ async function fetchManifest(source, deps = {}) {
 // src/lib/release-content.ts
 import * as fs20 from "fs";
 import * as os8 from "os";
-import * as path19 from "path";
+import * as path20 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 init_errors();
 var OWNER_REPO = "m8t-labs/m8t";
@@ -19448,15 +19535,15 @@ function verifyPersonaTrees(manifest, tree) {
 }
 async function resolveReleaseContent(manifest, opts = {}) {
   if (opts.contentDir) {
-    if (!fs20.existsSync(path19.join(opts.contentDir, "personas"))) {
+    if (!fs20.existsSync(path20.join(opts.contentDir, "personas"))) {
       throw new LocalCliError({ code: "PLATFORM_CONTENT_DIR_INVALID", message: `--content-dir '${opts.contentDir}' has no personas/ \u2014 not a repo checkout.` });
     }
     return opts.contentDir;
   }
   const commit = manifest.platform.commit;
-  const cacheRoot = opts.cacheRoot ?? path19.join(os8.homedir(), ".m8t", "cache");
-  const dest = path19.join(cacheRoot, `release-${commit}`);
-  if (fs20.existsSync(path19.join(dest, "personas"))) return dest;
+  const cacheRoot = opts.cacheRoot ?? path20.join(os8.homedir(), ".m8t", "cache");
+  const dest = path20.join(cacheRoot, `release-${commit}`);
+  if (fs20.existsSync(path20.join(dest, "personas"))) return dest;
   const fetchImpl = opts.fetchImpl ?? fetch;
   const ghToken = opts.ghToken ?? getGhToken;
   let token;
@@ -19471,18 +19558,18 @@ async function resolveReleaseContent(manifest, opts = {}) {
     throw new LocalCliError({ code: "PLATFORM_TARBALL_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
   }
   fs20.mkdirSync(cacheRoot, { recursive: true });
-  const tmp = fs20.mkdtempSync(path19.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
+  const tmp = fs20.mkdtempSync(path20.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
   try {
-    const tgz = path19.join(tmp, "src.tar.gz");
+    const tgz = path20.join(tmp, "src.tar.gz");
     fs20.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
-    const unpacked = path19.join(tmp, "unpacked");
+    const unpacked = path20.join(tmp, "unpacked");
     fs20.mkdirSync(unpacked);
     extractTarGz(tgz, unpacked);
     try {
       fs20.renameSync(unpacked, dest);
     } catch (e) {
       const err = e;
-      const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs20.existsSync(path19.join(dest, "personas"));
+      const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs20.existsSync(path20.join(dest, "personas"));
       if (!isBenignRace) {
         throw new LocalCliError({
           code: "PLATFORM_CACHE_PUBLISH_FAILED",
@@ -19649,13 +19736,13 @@ async function readStamp(opts) {
 // src/lib/platform-converge.ts
 init_esm();
 import * as fs22 from "fs";
-import * as path21 from "path";
+import * as path22 from "path";
 import { parse as parseYaml10 } from "yaml";
 
 // src/lib/deploy.ts
 import * as fs21 from "fs/promises";
 import * as os9 from "os";
-import * as path20 from "path";
+import * as path21 from "path";
 init_errors();
 var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
 function parseFoundryTracingMode(v) {
@@ -19714,7 +19801,7 @@ function buildBicepParams(p) {
   return params;
 }
 async function resolveRepoRoot2(home = os9.homedir()) {
-  const marker = path20.join(home, ".m8t", "repo-root");
+  const marker = path21.join(home, ".m8t", "repo-root");
   try {
     const root = (await fs21.readFile(marker, "utf8")).trim();
     if (!root) throw new Error("empty");
@@ -19802,7 +19889,7 @@ function buildDeployResult(args) {
   };
 }
 async function runBicepDeployment(opts) {
-  const bicepPath = path20.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path21.join(opts.repoRoot, "deploy", "main.bicep");
   const result2 = JSON.parse(
     await runAz([
       "deployment",
@@ -20212,7 +20299,7 @@ function brainRepoOf(current) {
 }
 async function applyPersona(a, ctx, opts) {
   const current = await getAgentVersion({ credential: ctx.credential, projectEndpoint: opts.project.endpoint, agentName: opts.agentName });
-  const personaPath = path21.join(opts.personaDir, "persona.md");
+  const personaPath = path22.join(opts.personaDir, "persona.md");
   const yamlValues = readAgentYaml(opts.agentName)?.fillableFieldValues ?? null;
   const values = resolveFillableValues(current, yamlValues);
   const declared = declaredFillableFields(personaPath);
@@ -20317,6 +20404,33 @@ function renderLiveVerify(v, apiVersion, fmt2 = { ok: (s) => s, warn: (s) => s }
   ];
 }
 
+// src/lib/gateway-api.ts
+function versionFromEnvelope(body) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const data = body.data;
+  if (typeof data !== "object" || data === null) return void 0;
+  const version = data.version;
+  return typeof version === "string" && version.length > 0 ? version : void 0;
+}
+function renderVersionRead(read) {
+  if (read.kind === "version") return read.version;
+  if (read.kind === "auth-gated") return "unknown (auth-gated)";
+  return "unknown";
+}
+async function readGatewayVersion(gatewayUrl, fetchImpl = fetch) {
+  let res;
+  try {
+    res = await fetchImpl(`${gatewayUrl}/api/version`, { method: "GET" });
+  } catch (e) {
+    return { kind: "unreachable", detail: e.message };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "auth-gated", status: res.status };
+  if (!res.ok) return { kind: "http-error", status: res.status };
+  const body = await res.json().catch(() => void 0);
+  const version = versionFromEnvelope(body);
+  return version === void 0 ? { kind: "no-version" } : { kind: "version", version };
+}
+
 // src/commands/platform/status.ts
 var PlatformStatusCommand = class extends M8tCommand {
   static paths = [["platform", "status"]];
@@ -20440,18 +20554,7 @@ var PlatformStatusCommand = class extends M8tCommand {
     } catch {
       liveImage = void 0;
     }
-    let apiVersion = "unknown";
-    try {
-      const res = await fetch(`${gatewayUrl}/api/version`, { method: "GET" });
-      if (res.ok) {
-        const body = await res.json().catch(() => ({}));
-        apiVersion = body.version ?? "unknown";
-      } else if (res.status === 401 || res.status === 403) {
-        apiVersion = "unknown (auth-gated)";
-      }
-    } catch {
-      apiVersion = "unknown";
-    }
+    const apiVersion = renderVersionRead(await readGatewayVersion(gatewayUrl));
     return {
       gateway: compareGatewayBinding({
         stampTag: stampGatewayTag ?? "unknown",
@@ -20472,7 +20575,7 @@ import { confirm as confirm5 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
 
 // src/lib/platform-converge-cli.ts
-import * as path25 from "path";
+import * as path26 from "path";
 
 // src/lib/platform-infra-params.ts
 import { TableClient as TableClient3 } from "@azure/data-tables";
@@ -20557,17 +20660,17 @@ init_errors();
 
 // src/lib/seed-refresh-driver.ts
 init_esm2();
-import * as path24 from "path";
+import * as path25 from "path";
 
 // src/lib/seed-refresh.ts
 init_errors();
 import * as fs24 from "fs";
-import * as path23 from "path";
+import * as path24 from "path";
 
 // src/lib/seed-merge.ts
 import * as fs23 from "fs";
 import * as os10 from "os";
-import * as path22 from "path";
+import * as path23 from "path";
 import { spawnSync as spawnSync3 } from "child_process";
 function isProbablyText(s) {
   return !s.includes("\0");
@@ -20577,11 +20680,11 @@ function mergeThreeWay(ours, base, theirs) {
     return { ok: false, merged: "" };
   }
   const lf = (s) => s.replace(/\r\n/g, "\n");
-  const dir = fs23.mkdtempSync(path22.join(os10.tmpdir(), "seed-merge-"));
+  const dir = fs23.mkdtempSync(path23.join(os10.tmpdir(), "seed-merge-"));
   try {
-    const o = path22.join(dir, "ours");
-    const b = path22.join(dir, "base");
-    const t = path22.join(dir, "theirs");
+    const o = path23.join(dir, "ours");
+    const b = path23.join(dir, "base");
+    const t = path23.join(dir, "theirs");
     fs23.writeFileSync(o, lf(ours));
     fs23.writeFileSync(b, lf(base));
     fs23.writeFileSync(t, lf(theirs));
@@ -20601,25 +20704,25 @@ function mergeThreeWay(ours, base, theirs) {
     fs23.rmSync(dir, { recursive: true, force: true });
   }
 }
-var skip = (path42, skipReason) => ({ path: path42, kind: "skip", skipReason });
+var skip = (path43, skipReason) => ({ path: path43, kind: "skip", skipReason });
 function classifyCandidate(c) {
-  const { path: path42, base, ours, theirs } = c;
-  if (theirs === base) return { path: path42, kind: "noop" };
+  const { path: path43, base, ours, theirs } = c;
+  if (theirs === base) return { path: path43, kind: "noop" };
   if (base === null) {
-    if (theirs === null) return { path: path42, kind: "noop" };
-    if (ours === null) return { path: path42, kind: "add", content: theirs };
-    if (ours === theirs) return { path: path42, kind: "noop" };
-    return skip(path42, "you already have a file at this path");
+    if (theirs === null) return { path: path43, kind: "noop" };
+    if (ours === null) return { path: path43, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path43, kind: "noop" };
+    return skip(path43, "you already have a file at this path");
   }
   if (ours === null) {
-    return theirs === null ? { path: path42, kind: "noop" } : skip(path42, "you removed this file; upstream changed it");
+    return theirs === null ? { path: path43, kind: "noop" } : skip(path43, "you removed this file; upstream changed it");
   }
   if (theirs === null) {
-    return ours === base ? { path: path42, kind: "delete" } : skip(path42, "you edited this file; upstream removed it");
+    return ours === base ? { path: path43, kind: "delete" } : skip(path43, "you edited this file; upstream removed it");
   }
-  if (ours === base) return { path: path42, kind: "update", content: theirs };
+  if (ours === base) return { path: path43, kind: "update", content: theirs };
   const m = mergeThreeWay(ours, base, theirs);
-  return m.ok ? { path: path42, kind: "update", content: m.merged } : skip(path42, "your edits conflict with the update");
+  return m.ok ? { path: path43, kind: "update", content: m.merged } : skip(path43, "your edits conflict with the update");
 }
 
 // src/lib/seed-pr-body.ts
@@ -20654,7 +20757,7 @@ function composeSeedPrBody(s) {
 // src/lib/seed-refresh.ts
 function readIf(dir, rel) {
   if (!dir) return null;
-  const abs = path23.join(dir, rel);
+  const abs = path24.join(dir, rel);
   return fs24.existsSync(abs) ? fs24.readFileSync(abs, "utf8") : null;
 }
 async function assembleCandidates(args) {
@@ -20787,7 +20890,7 @@ function dedupeBrainRepos(agents) {
 function seedContentDir(contentRoot, manifest, seedName) {
   const items = manifest.components.brainSeeds.items;
   if (!Object.hasOwn(items, seedName)) return null;
-  return path24.join(contentRoot, items[seedName].path);
+  return path25.join(contentRoot, items[seedName].path);
 }
 function bindRepoApi(token, repo) {
   return {
@@ -20804,7 +20907,7 @@ function bindRepoApi(token, repo) {
     openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
     updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
     closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
-    readFileAtRef: (path42, ref) => readRepoFileViaApp({ token, repo, path: path42, ref })
+    readFileAtRef: (path43, ref) => readRepoFileViaApp({ token, repo, path: path43, ref })
   };
 }
 async function runSeedRefresh(args) {
@@ -20917,7 +21020,7 @@ async function buildConvergeDeps(args) {
     const persona = a.metadata.persona;
     if (persona) discovered[persona] = a.name;
   }
-  const loaderPath = path25.join(args.contentDir, "targets/foundry/brain-loader.md");
+  const loaderPath = path26.join(args.contentDir, "targets/foundry/brain-loader.md");
   return {
     async applyPersona(a, ctx) {
       const personaName = a.personaName;
@@ -20933,7 +21036,7 @@ async function buildConvergeDeps(args) {
       return applyPersona(a, ctx, {
         agentName,
         project: args.project,
-        personaDir: path25.join(ctx.contentDir, personaItem.path),
+        personaDir: path26.join(ctx.contentDir, personaItem.path),
         loaderPath
       });
     },
@@ -21007,18 +21110,23 @@ async function buildConvergeDeps(args) {
         await awaitAgentQueryable({ credential: args.credential, projectEndpoint: args.project.endpoint, agentName, onProgress: args.onProgress });
       }
       if (args.gatewayUrl) {
-        try {
-          const res = await fetch(`${args.gatewayUrl}/api/version`, { method: "GET" });
-          if (res.ok) {
-            const body = await res.json().catch(() => ({}));
-            args.onProgress?.(`gateway reachable (version: ${body.version ?? "unknown"}).`);
-          } else if (res.status === 401 || res.status === 403) {
-            args.onProgress?.(`gateway reachable (auth-gated, HTTP ${res.status.toString()}).`);
-          } else {
-            warn(`gateway health probe returned HTTP ${res.status.toString()} \u2014 not treated as fatal.`);
-          }
-        } catch (e) {
-          warn(`gateway health probe failed: ${e.message} \u2014 not treated as fatal.`);
+        const read = await readGatewayVersion(args.gatewayUrl);
+        switch (read.kind) {
+          case "version":
+            args.onProgress?.(`gateway reachable (version: ${read.version}).`);
+            break;
+          case "no-version":
+            args.onProgress?.("gateway reachable (version: unknown).");
+            break;
+          case "auth-gated":
+            args.onProgress?.(`gateway reachable (auth-gated, HTTP ${read.status.toString()}).`);
+            break;
+          case "http-error":
+            warn(`gateway health probe returned HTTP ${read.status.toString()} \u2014 not treated as fatal.`);
+            break;
+          case "unreachable":
+            warn(`gateway health probe failed: ${read.detail} \u2014 not treated as fatal.`);
+            break;
         }
       }
     },
@@ -21363,14 +21471,14 @@ async function patchApplyRequest(client, mutate) {
 
 // src/lib/platform-self-update.ts
 import * as fs25 from "fs";
-import * as path26 from "path";
+import * as path27 from "path";
 function toVTag2(v) {
   return v.startsWith("v") ? v : `v${v}`;
 }
 function readBakedReleaseVersion(repoRoot) {
   if (!repoRoot) return null;
   try {
-    const raw = fs25.readFileSync(path26.join(repoRoot, "installer", "version.json"), "utf8");
+    const raw = fs25.readFileSync(path27.join(repoRoot, "installer", "version.json"), "utf8");
     const v = JSON.parse(raw).version;
     return typeof v === "string" && v.length > 0 ? v : null;
   } catch {
@@ -21515,17 +21623,20 @@ async function reconvergeToPrevious(args, previousVersion) {
   await applyPlan(rollbackPlan, args.deps, rollbackCtx);
 }
 async function defaultGatewayProbe(gatewayUrl, expected) {
-  try {
-    const res = await fetch(`${gatewayUrl}/api/version`, { method: "GET" });
-    if (res.status === 401 || res.status === 403) return { ok: true };
-    if (!res.ok) return { ok: false, detail: `gateway /api/version returned HTTP ${res.status.toString()}` };
-    const body = await res.json().catch(() => ({}));
-    if (body.version && !versionMatches(body.version, expected)) {
-      return { ok: false, detail: `gateway reports version '${body.version}', expected '${expected}'` };
-    }
-    return { ok: true };
-  } catch (e) {
-    return { ok: false, detail: `gateway unreachable: ${e.message}` };
+  const read = await readGatewayVersion(gatewayUrl);
+  switch (read.kind) {
+    case "unreachable":
+      return { ok: false, detail: `gateway unreachable: ${read.detail}` };
+    case "http-error":
+      return { ok: false, detail: `gateway /api/version returned HTTP ${read.status.toString()}` };
+    case "auth-gated":
+    case "no-version":
+      return { ok: true };
+    case "version":
+      return versionMatches(read.version, expected) ? { ok: true } : {
+        ok: true,
+        detail: `gateway reports version '${read.version}', target '${expected}' \u2014 recorded, not gated (see defaultGatewayProbe)`
+      };
   }
 }
 function versionMatches(running, expected) {
@@ -21787,7 +21898,7 @@ function targetManifestSource(ctx, target) {
 }
 
 // src/commands/platform/seed-stamp.ts
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 import { Command as Command35, Option as Option32 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential18, ManagedIdentityCredential as ManagedIdentityCredential2 } from "@azure/identity";
 init_errors();
@@ -21874,7 +21985,7 @@ function buildSeedStamp(d, cliVersion, nowIso) {
 
 // src/commands/platform/seed-stamp.ts
 async function seedStamp2(args) {
-  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync17(p, "utf8"));
+  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync18(p, "utf8"));
   const readStampImpl = args.readStampImpl ?? readStamp;
   const writeStampImpl = args.writeStampImpl ?? ((stamp2, o) => writeStamp({ ...o, stamp: stamp2 }));
   const discoverImpl = args.discoverImpl ?? discoverStampStorage;
@@ -22752,7 +22863,7 @@ async function patchRedirectUris(appObjectId, fqdn) {
 init_errors();
 
 // src/lib/whatif.ts
-import * as path27 from "path";
+import * as path28 from "path";
 
 // src/lib/identifier-patterns.ts
 var IDENTIFIER_PATTERNS = [
@@ -22808,7 +22919,7 @@ function deriveResourceType(resourceId) {
   return parts.join("/");
 }
 async function runWhatIf(opts) {
-  const bicepPath = path27.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path28.join(opts.repoRoot, "deploy", "main.bicep");
   const out = await runAz([
     "deployment",
     "group",
@@ -22906,9 +23017,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path42 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path42));
-    else out.push({ ...d, path: path42 });
+    const path43 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path43));
+    else out.push({ ...d, path: path43 });
   }
   return out;
 }
@@ -23271,7 +23382,7 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync18, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync19, existsSync as existsSync16, readdirSync as readdirSync2 } from "fs";
 import { join as join27 } from "path";
 import { Command as Command42, Option as Option39 } from "clipanion";
 init_errors();
@@ -23454,10 +23565,10 @@ function resolveRefereeHome(refereeHomeOut, env) {
   return null;
 }
 function resolveTaskSetDir(base, worker, version) {
-  if (existsSync15(join27(base, version))) return version;
+  if (existsSync16(join27(base, version))) return version;
   const prefixed = `${worker}-${version}`;
-  if (existsSync15(join27(base, prefixed))) return prefixed;
-  if (version === "latest" && existsSync15(base)) {
+  if (existsSync16(join27(base, prefixed))) return prefixed;
+  if (version === "latest" && existsSync16(base)) {
     const dirs = readdirSync2(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
     if (dirs.length > 0) return dirs[dirs.length - 1];
   }
@@ -23476,7 +23587,7 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
   const manifestPath = join27(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync18(manifestPath, "utf-8");
+    text = readFileSync19(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -23864,7 +23975,7 @@ import { Command as Command46, Option as Option43 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
 import * as fs26 from "fs";
 import * as os11 from "os";
-import * as path28 from "path";
+import * as path29 from "path";
 
 // src/lib/doctor-checks.ts
 function checkAzSignedIn(az) {
@@ -24343,7 +24454,7 @@ async function resolveAccountLocation(accountId) {
   }
 }
 function probeRepoRoot() {
-  const marker = path28.join(os11.homedir(), ".m8t", "repo-root");
+  const marker = path29.join(os11.homedir(), ".m8t", "repo-root");
   if (!fs26.existsSync(marker)) {
     return { markerExists: false, path: null, isDir: false, isGitCheckout: false };
   }
@@ -24360,13 +24471,13 @@ function probeRepoRoot() {
   } catch {
     isDir = false;
   }
-  const isGitCheckout = isDir && fs26.existsSync(path28.join(repoPath, ".git"));
+  const isGitCheckout = isDir && fs26.existsSync(path29.join(repoPath, ".git"));
   return { markerExists: true, path: repoPath, isDir, isGitCheckout };
 }
 function probeLegacyStateDir() {
   return {
-    legacyExists: fs26.existsSync(path28.join(os11.homedir(), ".m8t-stack")),
-    currentExists: fs26.existsSync(path28.join(os11.homedir(), ".m8t"))
+    legacyExists: fs26.existsSync(path29.join(os11.homedir(), ".m8t-stack")),
+    currentExists: fs26.existsSync(path29.join(os11.homedir(), ".m8t"))
   };
 }
 var DoctorCommand = class extends M8tCommand {
@@ -25297,14 +25408,14 @@ import { Command as Command48, Option as Option45 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs27 from "fs/promises";
-import * as path29 from "path";
+import * as path30 from "path";
 import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
 function profilesDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path29.join(home, ".m8t", "profiles");
+  return path30.join(home, ".m8t", "profiles");
 }
 function getProfilePath(name) {
-  return path29.join(profilesDir(), `${path29.basename(name)}.yaml`);
+  return path30.join(profilesDir(), `${path30.basename(name)}.yaml`);
 }
 function slugifyTenant(domainOrId) {
   const base = domainOrId.split(".")[0].toLowerCase();
@@ -26580,7 +26691,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path42, allowedPrefix) => allowedPrefix.test(path42) && !path42.split("/").includes("..");
+var isAllowedWritePath = (path43, allowedPrefix) => allowedPrefix.test(path43) && !path43.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
@@ -26623,8 +26734,8 @@ function makeGitDataWriter(args) {
   if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
     throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
   }
-  async function gh(token, method, path42, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path42}`, {
+  async function gh(token, method, path43, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path43}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -26637,8 +26748,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path42) {
-    const encodedPath = path42.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path43) {
+    const encodedPath = path43.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -26654,9 +26765,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path42) {
+    async readFile(path43) {
       const token = await args.mintToken();
-      return readFileWith(token, path42);
+      return readFileWith(token, path43);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -26665,9 +26776,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path42 of paths) {
-        const content = await readFileWith(token, path42);
-        out.push({ path: path42, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path43 of paths) {
+        const content = await readFileWith(token, path43);
+        out.push({ path: path43, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -27106,7 +27217,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path42) => originByPath.get(path42) ?? "worker"
+    originOf: (path43) => originByPath.get(path43) ?? "worker"
   };
 }
 
@@ -27127,14 +27238,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path42, message) {
+  constructor(path43, message) {
     super(message);
-    this.path = path42;
+    this.path = path43;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path42) => /(^|\/)[^/]*_index\.md$/.test(path42);
-var isMemoryIndex = (path42) => path42 === "memory/MEMORY.md";
+var isIndexFile = (path43) => /(^|\/)[^/]*_index\.md$/.test(path43);
+var isMemoryIndex = (path43) => path43 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -27151,29 +27262,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path42 = targetPath(delta);
-  if (path42 === null)
+  const path43 = targetPath(delta);
+  if (path43 === null)
     return { ok: true };
-  if (isIndexFile(path42) && !isMemoryIndex(path42)) {
-    return { ok: false, flagged: { kind: "flagged", path: path42, tension: `refused: ${path42} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path43) && !isMemoryIndex(path43)) {
+    return { ok: false, flagged: { kind: "flagged", path: path43, tension: `refused: ${path43} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path42);
-  const isStructural = path42.startsWith("references/");
+  const target = await lookup(path43);
+  const isStructural = path43.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path42, `supersede/retract OLD target ${path42} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path43, `supersede/retract OLD target ${path43} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path42, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path43, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path42) => path42.split("/").includes("..");
+var hasTraversal = (path43) => path43.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -27280,7 +27391,7 @@ ${inject}
 ---
 ` + body.slice(m[0].length);
 }
-var indexLine = (path42, title, date, tags) => `- \`${path42}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path43, title, date, tags) => `- \`${path43}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -27453,16 +27564,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path42) => Promise.resolve(mem.files.find((f) => f.path === path42) ?? null);
+      const lookup = (path43) => Promise.resolve(mem.files.find((f) => f.path === path43) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path42 = checkPathAllowed(delta);
-          if (!path42.ok) {
-            digest.push(path42.rejected);
+          const path43 = checkPathAllowed(delta);
+          if (!path43.ok) {
+            digest.push(path43.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -28590,9 +28701,9 @@ var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t rece
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
-function ingestUrl(path42) {
+function ingestUrl(path43) {
   const base = INGEST_BASE_URL.replace(/\/+$/, "");
-  return `${base}${path42.startsWith("/") ? path42 : `/${path42}`}`;
+  return `${base}${path43.startsWith("/") ? path43 : `/${path43}`}`;
 }
 
 // src/commands/bootstrap/preflight.ts
@@ -28726,7 +28837,7 @@ ${colors.error("  " + why)}
 // src/commands/bootstrap/launch.ts
 import * as fs30 from "fs";
 import * as os14 from "os";
-import * as path32 from "path";
+import * as path33 from "path";
 import { Command as Command54, Option as Option51 } from "clipanion";
 init_errors();
 
@@ -28885,7 +28996,7 @@ async function kickInstaller(s) {
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 import * as fs28 from "fs/promises";
 import * as os12 from "os";
-import * as path30 from "path";
+import * as path31 from "path";
 init_errors();
 var STATUS_CONTAINER = "status";
 var STATUS_BLOB = "status.json";
@@ -28924,7 +29035,7 @@ async function readStatusBlob(opts) {
       cause: e
     });
   }
-  const tmpFile = path30.join(os12.tmpdir(), `m8t-status-${randomUUID2()}.json`);
+  const tmpFile = path31.join(os12.tmpdir(), `m8t-status-${randomUUID2()}.json`);
   try {
     await runAz([
       "storage",
@@ -28960,12 +29071,12 @@ async function readStatusBlob(opts) {
 // src/lib/bootstrap-state.ts
 import * as fs29 from "fs/promises";
 import * as os13 from "os";
-import * as path31 from "path";
+import * as path32 from "path";
 function stateDir(home) {
-  return path31.join(home, ".m8t");
+  return path32.join(home, ".m8t");
 }
 function statePath(home) {
-  return path31.join(stateDir(home), "bootstrap.json");
+  return path32.join(stateDir(home), "bootstrap.json");
 }
 async function readBootstrapState(home = os13.homedir()) {
   try {
@@ -29166,7 +29277,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 `);
       return 0;
     }
-    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t", "github-app.json");
+    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path33.join(os14.homedir(), ".m8t", "github-app.json");
     const skipBrains = this.noBrains === true;
     const requestedOrg = typeof this.org === "string" ? this.org : void 0;
     let githubApp;
@@ -29316,13 +29427,13 @@ async function getAciState(opts) {
 // src/lib/bootstrap-finalize.ts
 import * as fs34 from "fs/promises";
 import * as os18 from "os";
-import * as path38 from "path";
+import * as path39 from "path";
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync21 } from "fs";
+import { closeSync, openSync, readFileSync as readFileSync22 } from "fs";
 import * as os15 from "os";
-import * as path33 from "path";
+import * as path34 from "path";
 init_errors();
 
 // src/lib/onboarding-profile.ts
@@ -30047,9 +30158,9 @@ function composeFounderIdentityNote(id) {
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path33.join(os15.homedir(), ".m8t", "github-app.json");
+  const p = credsPath ?? path34.join(os15.homedir(), ".m8t", "github-app.json");
   try {
-    return JSON.parse(readFileSync21(p, "utf8"));
+    return JSON.parse(readFileSync22(p, "utf8"));
   } catch {
     return null;
   }
@@ -30115,7 +30226,7 @@ function upsertMemoryIndexOnce(existing, line2, targetPath2) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync21(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync22(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -30205,7 +30316,7 @@ async function applyProfileToBrains(args) {
   }
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path33.join(os15.homedir(), ".m8t", "seed-profile.log");
+  const logPath = path34.join(os15.homedir(), ".m8t", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -30280,7 +30391,7 @@ function renderInstallSummary(args) {
 // src/lib/companion-install.ts
 import { constants as constants2 } from "fs";
 import * as fs32 from "fs/promises";
-import * as path35 from "path";
+import * as path36 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import { execFile, spawn as spawn7 } from "child_process";
 
@@ -30288,7 +30399,7 @@ import { execFile, spawn as spawn7 } from "child_process";
 import { createHash as createHash5 } from "crypto";
 import { constants } from "fs";
 import * as fs31 from "fs/promises";
-import * as path34 from "path";
+import * as path35 from "path";
 var SHA256 = /^[a-f0-9]{64}$/u;
 var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u;
 function exactKeys(value, expected) {
@@ -30296,23 +30407,23 @@ function exactKeys(value, expected) {
   return actual.length === expected.length && actual.every((key2, index) => key2 === [...expected].sort()[index]);
 }
 function normalizedRelative(value) {
-  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path34.posix.isAbsolute(value)) {
+  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path35.posix.isAbsolute(value)) {
     throw new Error("Artifact path must be a normalized relative POSIX path");
   }
-  const normalized = path34.posix.normalize(value);
+  const normalized = path35.posix.normalize(value);
   if (normalized !== value || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     throw new Error("Artifact path escapes the payload root");
   }
   return value;
 }
 function validateLink(entryPath, target) {
-  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path34.posix.isAbsolute(target)) {
+  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path35.posix.isAbsolute(target)) {
     throw new Error("Artifact symlink target must be relative");
   }
-  const resolved = path34.posix.normalize(
-    path34.posix.join(path34.posix.dirname(entryPath), target)
+  const resolved = path35.posix.normalize(
+    path35.posix.join(path35.posix.dirname(entryPath), target)
   );
-  if (resolved === ".." || resolved.startsWith("../") || path34.posix.isAbsolute(resolved)) {
+  if (resolved === ".." || resolved.startsWith("../") || path35.posix.isAbsolute(resolved)) {
     throw new Error("Artifact symlink target escapes the payload root");
   }
   return target;
@@ -30396,13 +30507,13 @@ async function sha256File2(filePath) {
   return createHash5("sha256").update(await fs31.readFile(filePath)).digest("hex");
 }
 async function walk(root, relative3 = "") {
-  const directory = path34.join(root, ...relative3.split("/").filter(Boolean));
+  const directory = path35.join(root, ...relative3.split("/").filter(Boolean));
   const children = await fs31.readdir(directory, { withFileTypes: true });
   const entries = [];
   for (const child of children.sort((left, right) => left.name.localeCompare(right.name))) {
     const childRelative = relative3 ? `${relative3}/${child.name}` : child.name;
     normalizedRelative(childRelative);
-    const childPath = path34.join(directory, child.name);
+    const childPath = path35.join(directory, child.name);
     const stat5 = await fs31.lstat(childPath);
     if (stat5.isDirectory()) {
       entries.push(...await walk(root, childRelative));
@@ -30437,10 +30548,10 @@ async function validateResolvedLinks(root, entries) {
   for (const entry of entries) {
     if (entry.type !== "symlink") continue;
     try {
-      const linkPath = path34.join(root, ...entry.path.split("/"));
+      const linkPath = path35.join(root, ...entry.path.split("/"));
       const resolved = await fs31.realpath(linkPath);
-      const relative3 = path34.relative(realRoot, resolved);
-      if (relative3 === ".." || relative3.startsWith(`..${path34.sep}`) || path34.isAbsolute(relative3)) {
+      const relative3 = path35.relative(realRoot, resolved);
+      if (relative3 === ".." || relative3.startsWith(`..${path35.sep}`) || path35.isAbsolute(relative3)) {
         throw new Error("Artifact symlink chain escapes the payload root");
       }
     } catch (error) {
@@ -30493,9 +30604,9 @@ async function readArtifactManifest(manifestPath) {
   }
 }
 function ensureContainedEntry(root, entryPath) {
-  const absolute = path34.join(root, ...entryPath.split("/"));
-  const relative3 = path34.relative(root, absolute);
-  if (relative3.startsWith("..") || path34.isAbsolute(relative3)) {
+  const absolute = path35.join(root, ...entryPath.split("/"));
+  const relative3 = path35.relative(root, absolute);
+  if (relative3.startsWith("..") || path35.isAbsolute(relative3)) {
     throw new Error("Artifact entry escapes payload root");
   }
   return absolute;
@@ -30549,7 +30660,7 @@ async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
   for (const entry of manifest.entries) {
     const source = ensureContainedEntry(sourceRoot, entry.path);
     const target = ensureContainedEntry(targetRoot, entry.path);
-    await fs31.mkdir(path34.dirname(target), { recursive: true, mode: 448 });
+    await fs31.mkdir(path35.dirname(target), { recursive: true, mode: 448 });
     if (entry.type === "file") {
       await fs31.copyFile(source, target);
       await fs31.chmod(target, entry.mode);
@@ -30593,8 +30704,8 @@ function execFileOutput(file, args) {
 }
 async function setCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const launchAgents = path35.join(input.homeDirectory, "Library", "LaunchAgents");
-    const registration = path35.join(
+    const launchAgents = path36.join(input.homeDirectory, "Library", "LaunchAgents");
+    const registration = path36.join(
       launchAgents,
       "com.m8t.companion.plist"
     );
@@ -30655,7 +30766,7 @@ async function setCompanionStartAtLogin(input) {
 }
 async function getCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const registration = path35.join(
+    const registration = path36.join(
       input.homeDirectory,
       "Library",
       "LaunchAgents",
@@ -30717,26 +30828,26 @@ function assertSupported(options) {
 }
 function companionInstallPaths(options) {
   assertSupported(options);
-  const companionState = path35.join(
+  const companionState = path36.join(
     options.homeDirectory,
     ".m8t",
     "companion"
   );
-  const targetRoot = options.platform === "darwin" ? path35.join(
+  const targetRoot = options.platform === "darwin" ? path36.join(
     options.homeDirectory,
     "Applications",
     "m8t Companion.app"
-  ) : path35.join(
-    options.localAppData ?? path35.join(options.homeDirectory, "AppData", "Local"),
+  ) : path36.join(
+    options.localAppData ?? path36.join(options.homeDirectory, "AppData", "Local"),
     "m8t",
     "companion",
     "app"
   );
   return {
     targetRoot,
-    installManifest: path35.join(companionState, "install-v1.json"),
-    runtimeBinding: path35.join(companionState, "runtime-v1.json"),
-    preferences: path35.join(companionState, "preferences-v1.json")
+    installManifest: path36.join(companionState, "install-v1.json"),
+    runtimeBinding: path36.join(companionState, "runtime-v1.json"),
+    preferences: path36.join(companionState, "preferences-v1.json")
   };
 }
 function exactKeys2(value, keys) {
@@ -30747,7 +30858,7 @@ function parseInstallManifest(value) {
     throw new Error("Install manifest schema is invalid");
   }
   const record = value;
-  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path35.isAbsolute(record.ownedTargetRoot)) {
+  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path36.isAbsolute(record.ownedTargetRoot)) {
     throw new Error("Install manifest schema is invalid");
   }
   return record;
@@ -30757,7 +30868,7 @@ function parseRuntimeBinding(value, platform) {
     throw new Error("Runtime binding schema is invalid");
   }
   const record = value;
-  const paths = platform === "win32" ? path35.win32 : path35.posix;
+  const paths = platform === "win32" ? path36.win32 : path36.posix;
   if (!exactKeys2(record, RUNTIME_KEYS) || record.schemaVersion !== 1 || typeof record.nodeExecutable !== "string" || !paths.isAbsolute(record.nodeExecutable) || typeof record.cliEntry !== "string" || !paths.isAbsolute(record.cliEntry) || typeof record.gatewayOrigin !== "string") {
     throw new Error("Runtime binding schema is invalid");
   }
@@ -30791,18 +30902,18 @@ async function assertNotSymlink(filePath, kind) {
   }
 }
 async function assertOwnedDirectoryChain(anchor, targetDirectory) {
-  const relative3 = path35.relative(anchor, targetDirectory);
-  if (relative3 === ".." || relative3.startsWith(`..${path35.sep}`) || path35.isAbsolute(relative3)) {
+  const relative3 = path36.relative(anchor, targetDirectory);
+  if (relative3 === ".." || relative3.startsWith(`..${path36.sep}`) || path36.isAbsolute(relative3)) {
     throw new Error("Companion owned directory escapes its trusted anchor");
   }
-  const segments = relative3.split(path35.sep).filter(Boolean);
+  const segments = relative3.split(path36.sep).filter(Boolean);
   let current = anchor;
   const anchorStatus = await fs32.lstat(anchor);
   if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
     throw new Error("Companion owned directory anchor is unsafe");
   }
   for (const segment of segments) {
-    current = path35.join(current, segment);
+    current = path36.join(current, segment);
     try {
       const status = await fs32.lstat(current);
       if (status.isSymbolicLink() || !status.isDirectory()) {
@@ -30817,10 +30928,10 @@ async function assertOwnedDirectoryChain(anchor, targetDirectory) {
 async function assertOwnedParents(options, paths) {
   await assertOwnedDirectoryChain(
     options.homeDirectory,
-    path35.dirname(paths.installManifest)
+    path36.dirname(paths.installManifest)
   );
-  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path35.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
-  await assertOwnedDirectoryChain(targetAnchor, path35.dirname(paths.targetRoot));
+  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path36.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
+  await assertOwnedDirectoryChain(targetAnchor, path36.dirname(paths.targetRoot));
 }
 async function readRegularText(filePath, maxBytes) {
   const before = await fs32.lstat(filePath);
@@ -30852,7 +30963,7 @@ async function atomicWriteJson(filePath, value) {
 }
 async function atomicWriteText(filePath, contents, mode) {
   await assertNotSymlink(filePath, "Companion state file");
-  await fs32.mkdir(path35.dirname(filePath), {
+  await fs32.mkdir(path36.dirname(filePath), {
     recursive: true,
     mode: 448
   });
@@ -30969,7 +31080,7 @@ async function statusCompanion(options) {
       realRegularFile(runtime.nodeExecutable, options.platform !== "win32"),
       realRegularFile(runtime.cliEntry, false)
     ]);
-    const executable = path35.join(
+    const executable = path36.join(
       paths.targetRoot,
       ...install.entryRelativePath.split("/")
     );
@@ -31017,8 +31128,8 @@ async function converge(options, force) {
   if (artifactManifest.platform !== options.platform || artifactManifest.architecture !== options.architecture) {
     throw new Error("Companion artifact does not match this OS and architecture");
   }
-  const payloadRoot = path35.join(
-    path35.dirname(options.artifactManifestPath),
+  const payloadRoot = path36.join(
+    path36.dirname(options.artifactManifestPath),
     "payload"
   );
   await verifyArtifactSource(payloadRoot, artifactManifest);
@@ -31038,7 +31149,7 @@ async function converge(options, force) {
   if (priorInstalled) {
     await assertCompanionNotRunning(
       options,
-      path35.join(
+      path36.join(
         priorInstalled.paths.targetRoot,
         ...priorInstalled.install.entryRelativePath.split("/")
       )
@@ -31057,7 +31168,7 @@ async function converge(options, force) {
   const stage = `${paths.targetRoot}.m8t-stage-${randomUUID3()}`;
   const backup = `${paths.targetRoot}.m8t-backup-${randomUUID3()}`;
   const copy = options.copyPayload ?? copyArtifactPayload;
-  await fs32.mkdir(path35.dirname(paths.targetRoot), {
+  await fs32.mkdir(path36.dirname(paths.targetRoot), {
     recursive: true,
     mode: 448
   });
@@ -31121,7 +31232,7 @@ async function converge(options, force) {
       await readClosedJson(paths.runtimeBinding),
       options.platform
     );
-    const executable = path35.join(
+    const executable = path36.join(
       paths.targetRoot,
       ...artifactManifest.entryRelativePath.split("/")
     );
@@ -31131,7 +31242,7 @@ async function converge(options, force) {
       platform: options.platform,
       executable: ownedExecutable
     }));
-    priorLoginExecutable = priorInstalled ? path35.join(
+    priorLoginExecutable = priorInstalled ? path36.join(
       priorInstalled.paths.targetRoot,
       ...priorInstalled.install.entryRelativePath.split("/")
     ) : executable;
@@ -31190,7 +31301,7 @@ async function uninstallCompanion(options) {
   if (install.ownedTargetRoot !== paths.targetRoot) {
     throw new Error("Refusing to remove a non-owned companion target");
   }
-  const executable = path35.join(
+  const executable = path36.join(
     paths.targetRoot,
     ...install.entryRelativePath.split("/")
   );
@@ -31208,7 +31319,7 @@ async function uninstallCompanion(options) {
 
 // src/commands/companion/install.ts
 import * as os17 from "os";
-import * as path37 from "path";
+import * as path38 from "path";
 import { Command as Command55, Option as Option52 } from "clipanion";
 
 // src/lib/companion-channel.ts
@@ -31228,7 +31339,7 @@ import { createHash as createHash6 } from "crypto";
 import { execFile as execFile2 } from "child_process";
 import * as fs33 from "fs/promises";
 import * as os16 from "os";
-import * as path36 from "path";
+import * as path37 from "path";
 init_errors();
 var MAX_ASSET_BYTES = 512 * 1024 * 1024;
 function extractArchive(archive, into) {
@@ -31281,20 +31392,20 @@ async function downloadCompanionArtifact(component, deps = {}) {
       hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
     });
   }
-  const root = await (deps.makeTemporaryDirectory ?? (() => fs33.mkdtemp(path36.join(os16.tmpdir(), "m8t-companion-"))))();
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs33.mkdtemp(path37.join(os16.tmpdir(), "m8t-companion-"))))();
   const dispose = async () => {
     await fs33.rm(root, { recursive: true, force: true }).catch(() => void 0);
   };
   try {
-    const archive = path36.join(root, pinned.asset);
+    const archive = path37.join(root, pinned.asset);
     await fs33.writeFile(archive, bytes, { mode: 384 });
-    const unpacked = path36.join(root, "unpacked");
+    const unpacked = path37.join(root, "unpacked");
     await fs33.mkdir(unpacked, { recursive: false, mode: 448 });
     await (deps.extract ?? extractArchive)(archive, unpacked);
     await fs33.rm(archive, { force: true });
     return {
       version: component.version,
-      artifactManifestPath: path36.join(unpacked, "artifact-v1.json"),
+      artifactManifestPath: path37.join(unpacked, "artifact-v1.json"),
       dispose
     };
   } catch (error) {
@@ -31325,7 +31436,7 @@ async function convergeCompanionFromChannel(converge2, options = {}) {
   let artifactManifestPath;
   let dispose = () => Promise.resolve();
   if (stagedDirectory !== void 0) {
-    artifactManifestPath = path37.resolve(stagedDirectory, "artifact-v1.json");
+    artifactManifestPath = path38.resolve(stagedDirectory, "artifact-v1.json");
   } else {
     const release = await readCompanionRelease(
       platformVersion !== void 0 ? { channel: true, version: platformTag(platformVersion) } : { url: CHANNEL_LATEST_URL }
@@ -31403,7 +31514,7 @@ function resolveRepoRootMarker(args) {
 }
 async function looksLikeCheckout(dir) {
   try {
-    return (await fs34.stat(path38.join(dir, "brain-template"))).isDirectory();
+    return (await fs34.stat(path39.join(dir, "brain-template"))).isDirectory();
   } catch {
     return false;
   }
@@ -31422,8 +31533,8 @@ var defaultDeps2 = {
   homedir: () => os18.homedir()
 };
 async function finalizeInstall(args, deps = defaultDeps2) {
-  const markerDir = path38.join(deps.homedir(), ".m8t");
-  const markerPath = path38.join(markerDir, "repo-root");
+  const markerDir = path39.join(deps.homedir(), ".m8t");
+  const markerPath = path39.join(markerDir, "repo-root");
   const cwd = process.cwd();
   const existing = await fs34.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
   const repoRoot = resolveRepoRootMarker({
@@ -31511,7 +31622,7 @@ async function finalizeInstall(args, deps = defaultDeps2) {
   }
   let brainOrg = null;
   try {
-    const credsRaw = await fs34.readFile(path38.join(markerDir, "github-app.json"), "utf8");
+    const credsRaw = await fs34.readFile(path39.join(markerDir, "github-app.json"), "utf8");
     const creds = JSON.parse(credsRaw);
     brainOrg = typeof creds.org === "string" ? creds.org : null;
   } catch {
@@ -31942,7 +32053,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 // src/commands/bootstrap/ui.ts
 import * as fs36 from "fs";
 import * as os20 from "os";
-import * as path40 from "path";
+import * as path41 from "path";
 import { Command as Command58, Option as Option55 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 init_errors();
@@ -31951,7 +32062,7 @@ init_errors();
 import * as fs35 from "fs";
 import * as net from "net";
 import * as os19 from "os";
-import * as path39 from "path";
+import * as path40 from "path";
 import { randomBytes as randomBytes3 } from "crypto";
 import { spawn as spawn8, spawnSync as spawnSync6 } from "child_process";
 init_errors();
@@ -32057,20 +32168,46 @@ async function deployIntakeAgentWithRetry(args) {
     }
   }
 }
+function renderNotReadyHint(resourceGroup, excluded) {
+  const lines = ["Check 'm8t bootstrap status --watch' \u2014 the install may have stalled in foundry-create."];
+  if (resourceGroup) {
+    if (excluded.length > 0) {
+      const count = excluded.length === 1 ? "1 project" : `${excluded.length.toString()} projects`;
+      const verb = excluded.length === 1 ? "was" : "were";
+      lines.push(
+        `Discovery is scoped to this install's resource group (${resourceGroup}) on purpose, so it can`,
+        `never deploy into someone else's project. ${count} elsewhere in this subscription ${verb}`,
+        "skipped:",
+        ...excluded.map((c) => `  ${c.endpoint}`)
+      );
+    }
+    lines.push(
+      "If ~/.m8t/bootstrap.json names a different install than the one you meant, re-run with",
+      "--endpoint <projectEndpoint>."
+    );
+  }
+  return lines.join("\n");
+}
 async function resolveFoundryEndpointWithWait(args, opts = {}) {
   const pollMs = opts.pollMs ?? 1e4;
   const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
   const deadline = Date.now() + timeoutMs;
+  let excluded = [];
   for (; ; ) {
     try {
+      excluded = [];
       const p = await resolveFoundryProject({
         credential: args.credential,
         subscriptionId: args.subscriptionId,
         interactive: false,
-        // When the subscription holds multiple projects (e.g. a founder reinstalling
-        // alongside an existing platform), an explicit endpoint disambiguates instead
-        // of FOUNDRY_PROJECT_MULTIPLE. Omitted → single-project auto-discovery.
-        endpoint: args.endpoint
+        // When the install's own resource group holds multiple projects, an
+        // explicit endpoint disambiguates instead of FOUNDRY_PROJECT_MULTIPLE.
+        // Omitted → single-project auto-discovery within that group.
+        endpoint: args.endpoint,
+        resourceGroup: args.resourceGroup,
+        onScopedOut: (dropped) => {
+          excluded = dropped;
+        }
       });
       return { endpoint: p.endpoint, accountScope: p.accountScope };
     } catch (e) {
@@ -32078,7 +32215,11 @@ async function resolveFoundryEndpointWithWait(args, opts = {}) {
         throw new LocalCliError({
           code: "BOOTSTRAP_UI_MULTIPLE_PROJECTS",
           message: `${e.message} bootstrap ui can't pick one safely (it must not deploy the intake agent into the wrong project).`,
-          hint: `Re-run with the throwaway project's endpoint, e.g. 'm8t bootstrap ui --repo-root "$(pwd)" --endpoint https://<account>.services.ai.azure.com/api/projects/m8t'. The installer prints it in 'm8t bootstrap status'.`,
+          hint: [
+            "Re-run naming the project you want:",
+            'm8t bootstrap ui --repo-root "$(pwd)" --endpoint <projectEndpoint>',
+            "'m8t bootstrap status' prints this install's endpoint (result.foundryEndpoint)."
+          ].join("\n"),
           cause: e
         });
       }
@@ -32088,8 +32229,8 @@ async function resolveFoundryEndpointWithWait(args, opts = {}) {
       if (Date.now() >= deadline) {
         throw new LocalCliError({
           code: "BOOTSTRAP_UI_FOUNDRY_NOT_READY",
-          message: "Foundry is not ready yet \u2014 no AI project appeared in your subscription before the timeout.",
-          hint: "Check 'm8t bootstrap status --watch'; the install may have stalled in foundry-create.",
+          message: args.resourceGroup ? `Foundry is not ready yet \u2014 no AI project appeared in resource group ${args.resourceGroup} before the timeout.` : "Foundry is not ready yet \u2014 no AI project appeared in your subscription before the timeout.",
+          hint: renderNotReadyHint(args.resourceGroup, excluded),
           cause: e
         });
       }
@@ -32119,7 +32260,7 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path39.join(args.repoRoot, "apps", "web", ".env.local");
+  const envPath = path40.join(args.repoRoot, "apps", "web", ".env.local");
   let prior = "";
   if (fs35.existsSync(envPath)) {
     prior = fs35.readFileSync(envPath, "utf8");
@@ -32167,7 +32308,7 @@ function readValidInternalSecret(envText) {
   return isValidInternalSecret(values[0]) ? values[0] : void 0;
 }
 function readWebInternalSecret(repoRoot) {
-  const envPath = path39.join(repoRoot, "apps", "web", ".env.local");
+  const envPath = path40.join(repoRoot, "apps", "web", ".env.local");
   let secret;
   try {
     secret = readValidInternalSecret(fs35.readFileSync(envPath, "utf8"));
@@ -32222,17 +32363,17 @@ async function installWebDeps(repoRoot) {
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
 function onboardingUiPaths(home = os19.homedir()) {
-  const dir = path39.join(home, ".m8t");
+  const dir = path40.join(home, ".m8t");
   return {
-    logPath: path39.join(dir, "onboarding-ui.log"),
-    pidPath: path39.join(dir, "onboarding-ui.pid")
+    logPath: path40.join(dir, "onboarding-ui.log"),
+    pidPath: path40.join(dir, "onboarding-ui.pid")
   };
 }
 function onboardingRelayPaths(home = os19.homedir()) {
-  const dir = path39.join(home, ".m8t");
+  const dir = path40.join(home, ".m8t");
   return {
-    logPath: path39.join(dir, "onboarding-relay.log"),
-    pidPath: path39.join(dir, "onboarding-relay.pid")
+    logPath: path40.join(dir, "onboarding-relay.log"),
+    pidPath: path40.join(dir, "onboarding-relay.pid")
   };
 }
 function isLocalPortOpen(port) {
@@ -32306,7 +32447,7 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs35.mkdirSync(path39.dirname(logPath), { recursive: true });
+  fs35.mkdirSync(path40.dirname(logPath), { recursive: true });
   const fd = fs35.openSync(logPath, "a");
   const child = spawn8("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
@@ -32357,7 +32498,7 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs35.mkdirSync(path39.dirname(logPath), { recursive: true });
+  fs35.mkdirSync(path40.dirname(logPath), { recursive: true });
   const fd = fs35.openSync(logPath, "a");
   const child = spawn8("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
     cwd: args.repoRoot,
@@ -32775,7 +32916,7 @@ var BootstrapUiCommand = class extends M8tCommand {
   repoRoot = Option55.String("--repo-root");
   port = Option55.String("--port", "3000");
   endpoint = Option55.String("--endpoint", {
-    description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
+    description: "Foundry project endpoint to target \u2014 overrides discovery when this install's resource group holds more than one Foundry project."
   });
   prepOnly = Option55.Boolean("--prep-only", false);
   skipInstall = Option55.Boolean("--skip-install", false);
@@ -32816,7 +32957,7 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs36.existsSync(path40.join(os20.homedir(), ".m8t", "config.yaml"))) {
+    if (fs36.existsSync(path41.join(os20.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
     const credential2 = new DefaultAzureCredential24();
@@ -32827,7 +32968,12 @@ var BootstrapUiCommand = class extends M8tCommand {
       {
         credential: credential2,
         subscriptionId: state.subscriptionId,
-        endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
+        endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
+        // Scoped to the resource group this install owns — the state file names
+        // it (and the installer was handed the same one), so there is no
+        // guessing between deployments in a shared subscription. Same rationale
+        // as discoverGateway in bootstrap-finalize.ts.
+        resourceGroup: state.resourceGroup
       },
       { onWait: out }
     );
@@ -33020,7 +33166,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 // src/commands/telemetry/enroll.ts
 import * as fs37 from "fs";
 import * as os21 from "os";
-import * as path41 from "path";
+import * as path42 from "path";
 import { Command as Command60, Option as Option57 } from "clipanion";
 init_errors();
 
@@ -33148,8 +33294,8 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ...company ? { company } : {},
       ...contactEmail ? { contactEmail } : {}
     });
-    const keyDir = fs37.mkdtempSync(path41.join(os21.tmpdir(), "m8t-ingest-key-"));
-    const keyFile = path41.join(keyDir, "key");
+    const keyDir = fs37.mkdtempSync(path42.join(os21.tmpdir(), "m8t-ingest-key-"));
+    const keyFile = path42.join(keyDir, "key");
     try {
       fs37.writeFileSync(keyFile, ingestKey, { mode: 384 });
       await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);