@m8t-stack/cli 0.2.71 → 0.2.72

package/dist/cli.js

@@ -1370,7 +1370,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.71";
+var CLI_VERSION = "0.2.72";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1917,7 +1917,7 @@ var safeJSON = (text) => {
 };
 
 // ../../node_modules/.pnpm/openai@6.49.0_ws@8.21.1_zod@4.4.3/node_modules/openai/internal/utils/sleep.mjs
-var sleep = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
+var sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 
 // ../../node_modules/.pnpm/openai@6.49.0_ws@8.21.1_zod@4.4.3/node_modules/openai/version.mjs
 var VERSION = "6.49.0";
@@ -3028,8 +3028,8 @@ function addRequestID(value, response) {
 var _APIPromise_client;
 var APIPromise = class _APIPromise extends Promise {
   constructor(client, responsePromise, parseResponse2 = defaultParseResponse) {
-    super((resolve4) => {
-      resolve4(null);
+    super((resolve6) => {
+      resolve6(null);
     });
     this.responsePromise = responsePromise;
     this.parseResponse = parseResponse2;
@@ -3704,12 +3704,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path43(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path48(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path44 = statics.reduce((previousValue, currentValue, index) => {
+  const path49 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3726,7 +3726,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path43(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path44.split(/[?#]/, 1)[0];
+  const pathOnly = path49.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3747,10 +3747,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path43(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path44}
+${path49}
 ${underline}`);
   }
-  return path44;
+  return path49;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -3926,12 +3926,12 @@ var EventStream = class {
     _EventStream_errored.set(this, false);
     _EventStream_aborted.set(this, false);
     _EventStream_catchingPromiseCreated.set(this, false);
-    __classPrivateFieldSet(this, _EventStream_connectedPromise, new Promise((resolve4, reject) => {
-      __classPrivateFieldSet(this, _EventStream_resolveConnectedPromise, resolve4, "f");
+    __classPrivateFieldSet(this, _EventStream_connectedPromise, new Promise((resolve6, reject) => {
+      __classPrivateFieldSet(this, _EventStream_resolveConnectedPromise, resolve6, "f");
       __classPrivateFieldSet(this, _EventStream_rejectConnectedPromise, reject, "f");
     }), "f");
-    __classPrivateFieldSet(this, _EventStream_endPromise, new Promise((resolve4, reject) => {
-      __classPrivateFieldSet(this, _EventStream_resolveEndPromise, resolve4, "f");
+    __classPrivateFieldSet(this, _EventStream_endPromise, new Promise((resolve6, reject) => {
+      __classPrivateFieldSet(this, _EventStream_resolveEndPromise, resolve6, "f");
       __classPrivateFieldSet(this, _EventStream_rejectEndPromise, reject, "f");
     }), "f");
     __classPrivateFieldGet(this, _EventStream_connectedPromise, "f").catch(() => {
@@ -4031,11 +4031,11 @@ var EventStream = class {
    *   const message = await stream.emitted('message') // rejects if the stream errors
    */
   emitted(event) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       __classPrivateFieldSet(this, _EventStream_catchingPromiseCreated, true, "f");
       if (event !== "error")
         this.once("error", reject);
-      this.once(event, resolve4);
+      this.once(event, resolve6);
     });
   }
   /**
@@ -4118,8 +4118,8 @@ var EventStream = class {
         }
         if (ended)
           return Promise.resolve(doneResult());
-        return new Promise((resolve4, reject) => {
-          readQueue.push({ resolve: resolve4, reject });
+        return new Promise((resolve6, reject) => {
+          readQueue.push({ resolve: resolve6, reject });
         });
       },
       return: () => {
@@ -5210,7 +5210,7 @@ var ChatCompletionStream = class _ChatCompletionStream extends AbstractChatCompl
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve6, reject) => readQueue.push({ resolve: resolve6, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -5392,7 +5392,7 @@ var ChatCompletionStreamingRunner = class _ChatCompletionStreamingRunner extends
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve6, reject) => readQueue.push({ resolve: resolve6, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
         }
         const event = pushQueue.shift();
         if (!event) {
@@ -8674,7 +8674,7 @@ var AssistantStream = class extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve6, reject) => readQueue.push({ resolve: resolve6, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -11051,7 +11051,7 @@ var ResponseStream = class _ResponseStream extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve6, reject) => readQueue.push({ resolve: resolve6, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
         }
         const event = pushQueue.shift();
         return { value: event, done: false };
@@ -12201,9 +12201,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path43, query, defaultBaseURL) {
+  buildURL(path48, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path43) ? new URL(path43) : new URL(baseURL + (baseURL.endsWith("/") && path43.startsWith("/") ? path43.slice(1) : path43));
+    const url = isAbsoluteURL(path48) ? new URL(path48) : new URL(baseURL + (baseURL.endsWith("/") && path48.startsWith("/") ? path48.slice(1) : path48));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -12233,24 +12233,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path43, opts) {
-    return this.methodRequest("get", path43, opts);
+  get(path48, opts) {
+    return this.methodRequest("get", path48, opts);
   }
-  post(path43, opts) {
-    return this.methodRequest("post", path43, opts);
+  post(path48, opts) {
+    return this.methodRequest("post", path48, opts);
   }
-  patch(path43, opts) {
-    return this.methodRequest("patch", path43, opts);
+  patch(path48, opts) {
+    return this.methodRequest("patch", path48, opts);
   }
-  put(path43, opts) {
-    return this.methodRequest("put", path43, opts);
+  put(path48, opts) {
+    return this.methodRequest("put", path48, opts);
   }
-  delete(path43, opts) {
-    return this.methodRequest("delete", path43, opts);
+  delete(path48, opts) {
+    return this.methodRequest("delete", path48, opts);
   }
-  methodRequest(method, path43, opts) {
+  methodRequest(method, path48, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path43, ...opts2 };
+      return { method, path: path48, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -12375,8 +12375,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path43, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path43, ...opts2 })) : { method: "get", path: path43, ...opts });
+  getAPIList(path48, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path48, ...opts2 })) : { method: "get", path: path48, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -12470,8 +12470,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path43, query, defaultBaseURL } = options;
-    const url = this.buildURL(path43, query, defaultBaseURL);
+    const { method, path: path48, query, defaultBaseURL } = options;
+    const url = this.buildURL(path48, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12839,7 +12839,7 @@ function redactAzArgs(args) {
   return out;
 }
 function runAz(args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
@@ -12879,7 +12879,7 @@ function runAz(args) {
         );
         return;
       }
-      resolve4(Buffer.concat(out).toString("utf8"));
+      resolve6(Buffer.concat(out).toString("utf8"));
     });
   });
 }
@@ -13473,8 +13473,8 @@ var BindCleanupCommand = class extends M8tCommand {
       colors.error("\u26A0") + ` cleaned ${data.cleaned.length.toString()} binding(s); ${data.failed.length.toString()} failed:
 `
     );
-    for (const fail of data.failed) {
-      this.context.stderr.write(`  - ${fail.bindingId} (${fail.channel}): ${fail.originalMessage}
+    for (const fail2 of data.failed) {
+      this.context.stderr.write(`  - ${fail2.bindingId} (${fail2.channel}): ${fail2.originalMessage}
 `);
     }
     this.context.stderr.write(
@@ -13517,10 +13517,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path43 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path48 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path43 },
+      { method: "GET", path: path48 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -14434,13 +14434,13 @@ async function createGitHubApp(args) {
   const setupUrl = `${base}/setup`;
   let createdApp = null;
   let polledInstallationId = null;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     let server;
     const complete = (installationId) => {
       if (settled || !createdApp) return;
       settled = true;
-      resolve4({ app: createdApp, installationId });
+      resolve6({ app: createdApp, installationId });
       setTimeout(() => {
         server.close();
       }, 2500);
@@ -14589,7 +14589,7 @@ function outgoingSidecarToPreserve(home, pointerText, sidecarExists) {
 // src/lib/gh-helpers.ts
 init_errors();
 import { spawn as spawn2 } from "child_process";
-var defaultGhExec = (cmd, args) => new Promise((resolve4) => {
+var defaultGhExec = (cmd, args) => new Promise((resolve6) => {
   const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
@@ -14597,7 +14597,7 @@ var defaultGhExec = (cmd, args) => new Promise((resolve4) => {
   const done = (r) => {
     if (!settled) {
       settled = true;
-      resolve4(r);
+      resolve6(r);
     }
   };
   child.stdout.on("data", (d) => {
@@ -14766,8 +14766,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path43) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path43}`]);
+    getFile: async (path48) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path48}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -15049,11 +15049,11 @@ var BrainCheckAppCommand = class extends M8tCommand {
 // src/commands/brain/create.ts
 init_esm2();
 import { Command as Command18, Option as Option17 } from "clipanion";
-import { execFileSync, spawnSync } from "child_process";
-import { readFileSync as readFileSync7 } from "fs";
-import * as fs11 from "fs";
-import * as os4 from "os";
-import * as path11 from "path";
+import { execFileSync as execFileSync3, spawnSync } from "child_process";
+import { readFileSync as readFileSync9 } from "fs";
+import * as fs14 from "fs";
+import * as os5 from "os";
+import * as path14 from "path";
 import * as readline2 from "readline/promises";
 import { DefaultAzureCredential as DefaultAzureCredential4 } from "@azure/identity";
 init_errors();
@@ -15556,8 +15556,107 @@ async function createBrainEnabledVersion(args) {
 
 // src/lib/brain-seed.ts
 init_errors();
-import * as fs10 from "fs";
-import * as path10 from "path";
+import * as fs13 from "fs";
+import * as path13 from "path";
+
+// src/lib/agent-content-sync.ts
+init_errors();
+import * as fs12 from "fs";
+import * as path12 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+
+// src/lib/release-pin.ts
+init_errors();
+var PIN_SCHEMA_VERSION = 2;
+var REF_RE = /^[0-9a-f]{40}$/;
+var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+var REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+function fail(source, detail, hint) {
+  throw new LocalCliError({
+    code: "RELEASE_PIN_INVALID",
+    message: `${source}: ${detail}`,
+    ...hint ? { hint } : {}
+  });
+}
+function parseAgent(source, key2, raw) {
+  if (typeof raw !== "object" || raw === null) fail(source, `agents.${key2} is not an object.`);
+  const a = raw;
+  if (typeof a.repo !== "string" || !REPO_RE.test(a.repo)) {
+    fail(source, `agents.${key2}.repo must be "owner/name", got ${JSON.stringify(a.repo)}.`);
+  }
+  if (typeof a.ref !== "string" || !REF_RE.test(a.ref)) {
+    fail(
+      source,
+      `agents.${key2}.ref must be a 40-hex commit sha, got ${JSON.stringify(a.ref)}.`,
+      "A tag or branch can move, so it is not a pin. Use `m8t agent-content pin <key>` to resolve one."
+    );
+  }
+  if (a.visibility !== "public" && a.visibility !== "private") {
+    fail(source, `agents.${key2}.visibility must be "public" or "private", got ${JSON.stringify(a.visibility)}.`);
+  }
+  if (typeof a.persona !== "string" || a.persona.length === 0) {
+    fail(source, `agents.${key2}.persona must be a non-empty persona slug.`);
+  }
+  if (typeof a.contentSha !== "string" || !DIGEST_RE.test(a.contentSha)) {
+    fail(source, `agents.${key2}.contentSha must be "sha256:<64-hex>", got ${JSON.stringify(a.contentSha)}.`);
+  }
+  return { repo: a.repo, ref: a.ref, visibility: a.visibility, persona: a.persona, contentSha: a.contentSha };
+}
+function parseReleasePin(json, source) {
+  let doc;
+  try {
+    doc = JSON.parse(json);
+  } catch (e) {
+    fail(source, `not valid JSON: ${e.message}`);
+  }
+  if (typeof doc !== "object" || doc === null) fail(source, "top level is not an object.");
+  const d = doc;
+  if (d.schemaVersion !== PIN_SCHEMA_VERSION) {
+    fail(
+      source,
+      `schemaVersion ${JSON.stringify(d.schemaVersion)} is not the expected ${PIN_SCHEMA_VERSION.toString()}.`,
+      "This CLI is older or newer than the pin it is reading. Guessing at an unknown shape is how a stale pin ships as if it were current."
+    );
+  }
+  if (typeof d.platformVersion !== "string") fail(source, "platformVersion is missing.");
+  const rawAgents = d.agents ?? {};
+  if (typeof rawAgents !== "object" || rawAgents === null || Array.isArray(rawAgents)) {
+    fail(source, "agents must be an object keyed by agent name.");
+  }
+  const agents = {};
+  const personaOwner = /* @__PURE__ */ new Map();
+  for (const [key2, raw] of Object.entries(rawAgents)) {
+    const agent = parseAgent(source, key2, raw);
+    const existing = personaOwner.get(agent.persona);
+    if (existing !== void 0) {
+      fail(
+        source,
+        `agents.${existing} and agents.${key2} both claim persona '${agent.persona}'.`,
+        "Two sources for one persona means hydration order decides which wins \u2014 silently."
+      );
+    }
+    personaOwner.set(agent.persona, key2);
+    agents[key2] = agent;
+  }
+  const personas = d.personas ?? [];
+  if (!Array.isArray(personas) || personas.some((p) => typeof p !== "string")) {
+    fail(source, "personas must be an array of strings.");
+  }
+  return {
+    schemaVersion: d.schemaVersion,
+    platformVersion: d.platformVersion,
+    agents,
+    personas
+  };
+}
+
+// src/lib/agent-content.ts
+init_errors();
+import * as fs11 from "fs";
+import * as os4 from "os";
+import * as path11 from "path";
+import { createHash } from "crypto";
+import { parse as parseYaml5 } from "yaml";
 
 // src/lib/seed-manifest.ts
 import * as fs9 from "fs";
@@ -15612,22 +15711,322 @@ function deriveOwnedPaths(seedDir) {
   return [...owned].sort((a, b) => a.localeCompare(b));
 }
 
+// src/lib/tarball-cache.ts
+init_errors();
+import * as fs10 from "fs";
+import * as path10 from "path";
+import { execFileSync } from "child_process";
+function extractTarGz(tgz, into) {
+  execFileSync("tar", ["-xzf", tgz, "-C", into, "--strip-components=1"]);
+}
+function publishAtomically(args) {
+  try {
+    fs10.renameSync(args.from, args.dest);
+  } catch (e) {
+    const err = e;
+    const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs10.existsSync(path10.join(args.dest, args.sentinel));
+    if (!isBenignRace) {
+      throw new LocalCliError({
+        code: args.errorCode,
+        message: `Could not publish cache to ${args.dest}: ${err.message}`
+      });
+    }
+  }
+}
+
+// src/lib/agent-content.ts
+var AGENT_DIR = "agent";
+var AGENT_SEED_DIRS = [...SEED_PATHS, "memory"];
+var AGENT_SEED_FILES = ["NOTICE"];
+var PERSONA_REL = `${AGENT_DIR}/persona.md`;
+function walk(base, dir, out) {
+  for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
+    const abs = path11.join(dir, entry.name);
+    if (entry.isDirectory()) walk(base, abs, out);
+    else if (entry.isFile()) out.push(path11.relative(base, abs).split(path11.sep).join("/"));
+  }
+}
+function collectAgentContent(repoDir) {
+  const personaAbs = path11.join(repoDir, AGENT_DIR, "persona.md");
+  if (!fs11.existsSync(personaAbs)) {
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_INVALID",
+      message: `'${repoDir}' is not an agent repo: no ${PERSONA_REL}.`,
+      hint: "An agent repo declares its agent at agent/persona.md \u2014 see docs/architecture/AGENT-REPO-CONTRACT.md."
+    });
+  }
+  const rels = [];
+  walk(repoDir, path11.join(repoDir, AGENT_DIR), rels);
+  for (const dir of AGENT_SEED_DIRS) {
+    const abs = path11.join(repoDir, dir);
+    if (fs11.existsSync(abs) && fs11.statSync(abs).isDirectory()) walk(repoDir, abs, rels);
+  }
+  for (const file of AGENT_SEED_FILES) {
+    const abs = path11.join(repoDir, file);
+    if (fs11.existsSync(abs) && fs11.statSync(abs).isFile()) rels.push(file);
+  }
+  const files = /* @__PURE__ */ new Map();
+  for (const rel of rels) files.set(rel, fs11.readFileSync(path11.join(repoDir, rel)));
+  return { files };
+}
+function digestAgentContent(content) {
+  const records = [...content.files.entries()].map(([rel, bytes]) => [rel.split("\\").join("/"), createHash("sha256").update(bytes).digest("hex")]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([rel, sha]) => `${sha} ${rel}`);
+  return "sha256:" + createHash("sha256").update(records.join("\0")).digest("hex");
+}
+function readDeclaredPersona(content) {
+  const raw = content.files.get(PERSONA_REL);
+  if (!raw) {
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_INVALID",
+      message: `Agent content carries no ${PERSONA_REL}.`
+    });
+  }
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw.toString("utf8"));
+  const name = fm ? parseYaml5(fm[1])?.name : void 0;
+  if (typeof name !== "string" || name.length === 0) {
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_INVALID",
+      message: `${PERSONA_REL} declares no frontmatter 'name'.`,
+      hint: "Layer 1 of the persona schema requires `name` \u2014 see docs/architecture/SCHEMA.md."
+    });
+  }
+  return name;
+}
+function hydrateAgentContent(content, destRoot, persona) {
+  const personaDir = path11.join(destRoot, "personas", persona);
+  const seedDir = path11.join(destRoot, "brain-seeds", persona);
+  fs11.mkdirSync(destRoot, { recursive: true });
+  const stage = fs11.mkdtempSync(path11.join(destRoot, `.hydrate-${persona}-`));
+  try {
+    for (const [rel, bytes] of content.files) {
+      const dest = rel.startsWith(`${AGENT_DIR}/`) ? path11.join(stage, "personas", rel.slice(AGENT_DIR.length + 1)) : path11.join(stage, "seed", rel);
+      fs11.mkdirSync(path11.dirname(dest), { recursive: true });
+      fs11.writeFileSync(dest, bytes);
+    }
+    swapInto(path11.join(stage, "personas"), personaDir);
+    swapInto(path11.join(stage, "seed"), seedDir);
+  } finally {
+    fs11.rmSync(stage, { recursive: true, force: true });
+  }
+}
+function swapInto(from, dest) {
+  if (!fs11.existsSync(from)) {
+    fs11.rmSync(dest, { recursive: true, force: true });
+    return;
+  }
+  fs11.mkdirSync(path11.dirname(dest), { recursive: true });
+  const old = `${dest}.old-${process.pid.toString()}`;
+  fs11.rmSync(old, { recursive: true, force: true });
+  if (fs11.existsSync(dest)) fs11.renameSync(dest, old);
+  fs11.renameSync(from, dest);
+  fs11.rmSync(old, { recursive: true, force: true });
+}
+async function resolveToken(deps) {
+  const env = deps.env ?? process.env;
+  const fromEnv = [env.AGENT_CONTENT_TOKEN, env.GH_TOKEN, env.GITHUB_TOKEN].find((t) => t);
+  if (fromEnv) return fromEnv;
+  try {
+    const tok = await (deps.ghToken ?? getGhToken)();
+    return tok || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function assertMatchesPin(content, pin) {
+  const actual = digestAgentContent(content);
+  if (actual !== pin.contentSha) {
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_DIGEST_MISMATCH",
+      message: `${pin.repo}@${pin.ref}: content digest ${actual} does not match the pinned ${pin.contentSha}.`,
+      hint: "The pin and the ref disagree. Re-derive with `m8t agent-content pin <key>`, or point the pin at the right commit."
+    });
+  }
+  const declared = readDeclaredPersona(content);
+  if (declared !== pin.persona) {
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_PERSONA_MISMATCH",
+      message: `${pin.repo}@${pin.ref} declares persona '${declared}', but the pin expects '${pin.persona}'.`,
+      hint: "Align the pin's `persona` with the frontmatter `name` in the repo's agent/persona.md."
+    });
+  }
+}
+async function downloadAgentRepo(pin, tmpDir, deps) {
+  const token = await resolveToken(deps);
+  if (pin.visibility === "private" && !token) {
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_TOKEN_MISSING",
+      message: `${pin.repo} is a private agent repo and no read token is available.`,
+      hint: "Set AGENT_CONTENT_TOKEN (contents:read on that repo), or GH_TOKEN / GITHUB_TOKEN, or run `gh auth login`."
+    });
+  }
+  const url = `https://api.github.com/repos/${pin.repo}/tarball/${pin.ref}`;
+  const res = await (deps.fetchImpl ?? fetch)(url, {
+    headers: token ? { Authorization: `Bearer ${token}` } : {}
+  });
+  if (!res.ok) {
+    const status = res.status.toString();
+    throw new LocalCliError({
+      code: "AGENT_CONTENT_FETCH_FAILED",
+      message: `GET ${url} \u2192 HTTP ${status} (agent '${pin.repo}' at ref ${pin.ref}).`,
+      hint: res.status === 404 && pin.visibility === "private" ? "A 404 on a private repo usually means the token lacks access, not that the ref is wrong. Check AGENT_CONTENT_TOKEN's permission on that repo." : res.status === 404 ? "Check that the pinned ref exists on that repo." : "Transient GitHub failures are retryable; a persistent one is not."
+    });
+  }
+  const tgz = path11.join(tmpDir, "src.tar.gz");
+  fs11.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
+  const unpacked = path11.join(tmpDir, "unpacked");
+  fs11.mkdirSync(unpacked);
+  extractTarGz(tgz, unpacked);
+  return unpacked;
+}
+async function resolveAgentContent(key2, pin, deps = {}) {
+  const cacheRoot = deps.cacheRoot ?? path11.join(os4.homedir(), ".m8t", "cache");
+  const digestTag = pin.contentSha.replace(/^sha256:/, "").slice(0, 16);
+  const dest = path11.join(cacheRoot, `agent-${key2}-${digestTag}`);
+  if (fs11.existsSync(path11.join(dest, PERSONA_REL))) {
+    try {
+      const cached = collectAgentContent(dest);
+      assertMatchesPin(cached, pin);
+      return cached;
+    } catch {
+      deps.onNotice?.(
+        `agent content cache for '${key2}' failed verification \u2014 discarding ${dest} and re-fetching.`
+      );
+      fs11.rmSync(dest, { recursive: true, force: true });
+    }
+  }
+  fs11.mkdirSync(cacheRoot, { recursive: true });
+  fs11.rmSync(dest, { recursive: true, force: true });
+  const tmpDir = fs11.mkdtempSync(path11.join(cacheRoot, `.dl-${key2}-`));
+  try {
+    const unpacked = await downloadAgentRepo(pin, tmpDir, deps);
+    const content = collectAgentContent(unpacked);
+    assertMatchesPin(content, pin);
+    publishAtomically({
+      from: unpacked,
+      dest,
+      sentinel: PERSONA_REL,
+      errorCode: "AGENT_CONTENT_CACHE_PUBLISH_FAILED"
+    });
+    return content;
+  } finally {
+    fs11.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+async function fetchAgentContentForPinning(source, deps = {}) {
+  const tmpDir = fs11.mkdtempSync(path11.join(os4.tmpdir(), "m8t-agent-pin-"));
+  try {
+    return collectAgentContent(await downloadAgentRepo(source, tmpDir, deps));
+  } finally {
+    fs11.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+function collectHydratedContent(destRoot, pin) {
+  const personaDir = path11.join(destRoot, "personas", pin.persona);
+  const seedDir = path11.join(destRoot, "brain-seeds", pin.persona);
+  if (!fs11.existsSync(path11.join(personaDir, "persona.md"))) return null;
+  const files = /* @__PURE__ */ new Map();
+  const rels = [];
+  walk(personaDir, personaDir, rels);
+  for (const rel of rels) files.set(`${AGENT_DIR}/${rel}`, fs11.readFileSync(path11.join(personaDir, rel)));
+  if (fs11.existsSync(seedDir)) {
+    const seedRels = [];
+    walk(seedDir, seedDir, seedRels);
+    for (const rel of seedRels) files.set(rel, fs11.readFileSync(path11.join(seedDir, rel)));
+  }
+  const content = { files };
+  return digestAgentContent(content) === pin.contentSha ? content : null;
+}
+async function hydrateAgentsInto(destRoot, agents, deps = {}) {
+  const resolved = [];
+  for (const [key2, pin] of Object.entries(agents)) {
+    if (collectHydratedContent(destRoot, pin)) continue;
+    resolved.push({ pin, content: await resolveAgentContent(key2, pin, deps) });
+  }
+  for (const { pin, content } of resolved) hydrateAgentContent(content, destRoot, pin.persona);
+}
+
+// src/lib/agent-content-sync.ts
+var PIN_REL_PATH = "installer/release-pin.json";
+async function syncAgentContent(args) {
+  const pinPath = path12.join(args.root, PIN_REL_PATH);
+  if (!fs12.existsSync(pinPath)) {
+    throw new LocalCliError({
+      code: "RELEASE_PIN_MISSING",
+      message: `No ${PIN_REL_PATH} under '${args.root}'.`,
+      hint: "Run from an m8t checkout, or pass --root pointing at one."
+    });
+  }
+  const pin = parseReleasePin(fs12.readFileSync(pinPath, "utf8"), pinPath);
+  await hydrateAgentsInto(args.root, pin.agents, args.deps);
+  return Object.values(pin.agents).map((a) => ({ persona: a.persona, repo: a.repo, ref: a.ref }));
+}
+function agentContentHint(root, persona) {
+  try {
+    const pin = parseReleasePin(fs12.readFileSync(path12.join(root, PIN_REL_PATH), "utf8"), PIN_REL_PATH);
+    const agent = Object.values(pin.agents).find((a) => a.persona === persona);
+    if (!agent) return void 0;
+    return `'${persona}' lives in ${agent.repo}, not in this repo \u2014 its content is generated, not committed. Run \`pnpm agent-content:sync\` to materialize it.`;
+  } catch {
+    return void 0;
+  }
+}
+function resolveRemoteRef(repo, branch) {
+  let out;
+  try {
+    out = execFileSync2("git", ["ls-remote", `https://github.com/${repo}.git`, branch], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (e) {
+    throw new LocalCliError({
+      code: "AGENT_REF_RESOLVE_FAILED",
+      message: `Could not resolve ${repo}#${branch}: ${e.message}`,
+      hint: "Check the repo name, the branch, and that your git can read it (`gh auth setup-git` for private repos)."
+    });
+  }
+  const sha = /^([0-9a-f]{40})\s/.exec(out.trim())?.[1];
+  if (!sha) {
+    throw new LocalCliError({
+      code: "AGENT_REF_RESOLVE_FAILED",
+      message: `${repo} has no branch '${branch}'.`
+    });
+  }
+  return sha;
+}
+async function derivePin(args) {
+  const ref = (args.resolveRef ?? resolveRemoteRef)(args.current.repo, args.branch);
+  const content = await fetchAgentContentForPinning(
+    { repo: args.current.repo, ref, visibility: args.current.visibility },
+    args.deps
+  );
+  return {
+    ...args.current,
+    ref,
+    persona: readDeclaredPersona(content),
+    contentSha: digestAgentContent(content)
+  };
+}
+
 // src/lib/brain-seed.ts
 function resolveSeed(name) {
-  const dir = path10.join(resolveRepoRoot(), "brain-seeds", name);
-  if (!fs10.existsSync(dir)) {
+  const root = resolveRepoRoot();
+  const dir = path13.join(root, "brain-seeds", name);
+  if (!fs13.existsSync(dir)) {
     throw new LocalCliError({
       code: "SEED_NOT_FOUND",
       message: `--seed "${name}": no brain-seeds/${name}/ directory found.`,
-      hint: "Seeds live under brain-seeds/. Check the name, or omit --seed for an unseeded brain."
+      // A product agent's seed is generated from its pinned repo rather than
+      // committed here, so "check the name" is the wrong advice for the most
+      // likely cause — an un-hydrated checkout.
+      hint: agentContentHint(root, name) ?? "Seeds live under brain-seeds/. Check the name, or omit --seed for an unseeded brain."
     });
   }
   return dir;
 }
 function materializeBrainTree(opts) {
-  fs10.cpSync(opts.templateSrc, opts.destDir, { recursive: true });
+  fs13.cpSync(opts.templateSrc, opts.destDir, { recursive: true });
   if (opts.seedDir) {
-    fs10.cpSync(opts.seedDir, opts.destDir, { recursive: true });
+    fs13.cpSync(opts.seedDir, opts.destDir, { recursive: true });
   }
 }
 function writeSeedMarker(args) {
@@ -15637,21 +16036,21 @@ function writeSeedMarker(args) {
     refreshedToVersion: args.version,
     ownedPaths: deriveOwnedPaths(args.seedDir)
   }]);
-  const dest = path10.join(args.destDir, SEED_MANIFEST_PATH);
-  fs10.mkdirSync(path10.dirname(dest), { recursive: true });
-  fs10.writeFileSync(dest, serializeSeedManifest(manifest));
+  const dest = path13.join(args.destDir, SEED_MANIFEST_PATH);
+  fs13.mkdirSync(path13.dirname(dest), { recursive: true });
+  fs13.writeFileSync(dest, serializeSeedManifest(manifest));
 }
 
 // src/lib/github-app-repo.ts
 init_errors();
 init_esm2();
 import { spawn as spawn3 } from "child_process";
-import { parse as parseYaml5 } from "yaml";
+import { parse as parseYaml6 } from "yaml";
 function isM8tBrainMarker(yamlText) {
   if (!yamlText.trim()) return false;
   let parsed;
   try {
-    parsed = parseYaml5(yamlText);
+    parsed = parseYaml6(yamlText);
   } catch {
     return false;
   }
@@ -15683,7 +16082,7 @@ async function createBlankRepo(args) {
   return { cloneUrl: j.clone_url, defaultBranch: j.default_branch ?? "main" };
 }
 function run(cmd, cmdArgs, cwd, env) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const c = spawn3(cmd, cmdArgs, { cwd, env: { ...process.env, ...env }, stdio: ["ignore", "pipe", "pipe"] });
     let err = "";
     c.stderr.on("data", (d) => {
@@ -15699,7 +16098,7 @@ function run(cmd, cmdArgs, cwd, env) {
     });
     c.on("close", (code) => {
       if (code === 0) {
-        resolve4();
+        resolve6();
       } else {
         reject(
           new LocalCliError({
@@ -15883,7 +16282,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path43) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path43, fetchImpl: args.fetchImpl }),
+    getFile: (path48) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path48, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -16097,7 +16496,7 @@ function resolveScaffoldCommit(repoRoot, env) {
   const baked = env.M8T_BUILD_SHA?.trim();
   if (baked) return baked;
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
+    return execFileSync3("git", ["rev-parse", "HEAD"], {
       cwd: repoRoot,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -16180,7 +16579,7 @@ var BrainCreateCommand = class extends M8tCommand {
     if (useAppPath) {
       await assertInstallationPermissions({
         appId: appIdOpt,
-        privateKeyPem: readFileSync7(appPemOpt, "utf8"),
+        privateKeyPem: readFileSync9(appPemOpt, "utf8"),
         installationId: installationIdOpt,
         org: owner,
         onUnverified: (m) => this.context.stderr.write(`  ${colors.dim(`warning: ${m}`)}
@@ -16212,15 +16611,15 @@ var BrainCreateCommand = class extends M8tCommand {
       agentEndpoint
     });
     const repoRoot = resolveRepoRoot();
-    const templateSrc = path11.join(repoRoot, "brain-template");
-    if (!fs11.existsSync(templateSrc)) {
+    const templateSrc = path14.join(repoRoot, "brain-template");
+    if (!fs14.existsSync(templateSrc)) {
       throw new LocalCliError({
         code: "TEMPLATE_MISSING",
         message: `brain-template/ missing at ${templateSrc}`,
         hint: "Ensure brain-template/ exists at the repo root (same level as apps/)."
       });
     }
-    const tmpDir = fs11.mkdtempSync(path11.join(os4.tmpdir(), `m8t-brain-create-${worker}-`));
+    const tmpDir = fs14.mkdtempSync(path14.join(os5.tmpdir(), `m8t-brain-create-${worker}-`));
     let result2;
     let resolvedInstallationId = null;
     const force = this.reuse === true ? "reuse" : this.newName === true ? "new" : void 0;
@@ -16230,7 +16629,7 @@ var BrainCreateCommand = class extends M8tCommand {
     if (useAppPath) {
       token = await mintInstallationTokenFromPem({
         appId: appIdOpt,
-        privateKeyPem: readFileSync7(appPemOpt, "utf8"),
+        privateKeyPem: readFileSync9(appPemOpt, "utf8"),
         installationId: installationIdOpt
       });
       const tok = token;
@@ -16352,7 +16751,7 @@ var BrainCreateCommand = class extends M8tCommand {
         project
       });
     } finally {
-      fs11.rmSync(tmpDir, { recursive: true, force: true });
+      fs14.rmSync(tmpDir, { recursive: true, force: true });
     }
     if (mode === "json") {
       this.context.stdout.write(
@@ -16804,9 +17203,9 @@ init_errors();
 // src/lib/brain-unlink.ts
 init_esm2();
 init_errors();
-import * as fs12 from "fs";
-import * as os5 from "os";
-import * as path12 from "path";
+import * as fs15 from "fs";
+import * as os6 from "os";
+import * as path15 from "path";
 init_foundry_agent_get();
 init_foundry_agent_version();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
@@ -16837,15 +17236,15 @@ async function unlinkBrain(args) {
   if (yaml?.personaPath) {
     let personaPath = yaml.personaPath;
     if (!personaPath.startsWith("/")) {
-      const marker = path12.join(args.home ?? os5.homedir(), ".m8t", "repo-root");
-      if (!fs12.existsSync(marker)) {
+      const marker = path15.join(args.home ?? os6.homedir(), ".m8t", "repo-root");
+      if (!fs15.existsSync(marker)) {
         throw new LocalCliError({
           code: "PERSONA_PATH_NOT_ABSOLUTE",
           message: `personaPath '${personaPath}' is relative and the repo-root marker is missing.`,
           hint: "Re-run 'm8t install' from a fresh m8t checkout (writes ~/.m8t/repo-root) \u2014 or edit the personaPath to absolute."
         });
       }
-      personaPath = path12.join(fs12.readFileSync(marker, "utf8").trim(), personaPath);
+      personaPath = path15.join(fs15.readFileSync(marker, "utf8").trim(), personaPath);
     }
     strippedInstructions = renderPersonaBody(personaPath, yaml.fillableFieldValues ?? {}, args.agentName);
   } else {
@@ -17066,38 +17465,41 @@ import { DefaultAzureCredential as DefaultAzureCredential9 } from "@azure/identi
 init_errors();
 
 // src/lib/deploy-prompt-advisor.ts
-import * as fs13 from "fs";
-import * as path13 from "path";
-import { parse as parseYaml6 } from "yaml";
+import * as fs16 from "fs";
+import * as path16 from "path";
+import { parse as parseYaml7 } from "yaml";
 init_foundry_agents();
 init_errors();
 init_esm();
 function findPersonasRoot(hint) {
-  let dir = path13.resolve(hint);
-  const fsRoot = path13.parse(dir).root;
+  let dir = path16.resolve(hint);
+  const fsRoot = path16.parse(dir).root;
   for (; ; ) {
-    if (fs13.existsSync(path13.join(dir, "personas"))) return dir;
-    const parent = path13.dirname(dir);
+    if (fs16.existsSync(path16.join(dir, "personas"))) return dir;
+    const parent = path16.dirname(dir);
     if (parent === dir || dir === fsRoot) return null;
     dir = parent;
   }
 }
 async function deployPromptAdvisor(args) {
   const resolvedRoot = findPersonasRoot(args.repoRoot);
-  const personaPath = resolvedRoot ? path13.join(resolvedRoot, "personas", args.persona, "persona.md") : path13.join(args.repoRoot, "personas", args.persona, "persona.md");
+  const personaPath = resolvedRoot ? path16.join(resolvedRoot, "personas", args.persona, "persona.md") : path16.join(args.repoRoot, "personas", args.persona, "persona.md");
   let raw;
   try {
-    raw = fs13.readFileSync(personaPath, "utf8");
+    raw = fs16.readFileSync(personaPath, "utf8");
   } catch (e) {
     throw new LocalCliError({
       code: "ADVISOR_PERSONA_MISSING",
       message: `Could not read the persona at '${personaPath}'.`,
-      hint: "Run from your m8t repo checkout, or pass --repo-root.",
+      // A product agent's persona is generated from its pinned repo rather than
+      // committed here, so an un-hydrated checkout is the likeliest cause and
+      // "run from your checkout" would send the reader the wrong way.
+      hint: agentContentHint(resolvedRoot ?? args.repoRoot, args.persona) ?? "Run from your m8t repo checkout, or pass --repo-root.",
       cause: e
     });
   }
   const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
-  const fm = fmMatch ? parseYaml6(fmMatch[1]) : {};
+  const fm = fmMatch ? parseYaml7(fmMatch[1]) : {};
   const model = args.model ?? fm.targets?.foundry?.model;
   if (!model) {
     throw new LocalCliError({
@@ -17271,14 +17673,14 @@ init_errors();
 // src/lib/agent-remove.ts
 init_errors();
 init_foundry_agent_get();
-import * as fs15 from "fs";
+import * as fs18 from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 
 // src/lib/a2a-enable.ts
 init_errors();
 init_foundry_agent_get();
 init_foundry_agent_version();
-import { randomBytes as randomBytes2, createHash } from "crypto";
+import { randomBytes as randomBytes2, createHash as createHash2 } from "crypto";
 
 // src/lib/data-plane-ready.ts
 init_errors();
@@ -17386,18 +17788,18 @@ async function awaitAgentQueryable(args) {
 // src/lib/persona-a2a.ts
 init_errors();
 init_esm();
-import * as fs14 from "fs";
-import { parse as parseYaml7 } from "yaml";
+import * as fs17 from "fs";
+import { parse as parseYaml8 } from "yaml";
 function readPersonaA2aCard(personaPath) {
   let raw;
   try {
-    raw = fs14.readFileSync(personaPath, "utf8");
+    raw = fs17.readFileSync(personaPath, "utf8");
   } catch (e) {
     throw new LocalCliError({ code: "PERSONA_READ_FAILED", message: `Could not read persona '${personaPath}': ${e.message}` });
   }
   const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fm) throw new LocalCliError({ code: "PERSONA_NO_FRONTMATTER", message: `Persona '${personaPath}' has no frontmatter.` });
-  const front = parseYaml7(fm[1]);
+  const front = parseYaml8(fm[1]);
   const role = typeof front.role === "string" ? front.role : "";
   const cardYaml = front.targets?.foundry?.["a2a-card"];
   if (!cardYaml || typeof cardYaml !== "object") {
@@ -17459,7 +17861,7 @@ async function enableA2a(args) {
     });
   }
   const bearer2 = `a2a_${randomBytes2(32).toString("base64url")}`;
-  const bearerHash = createHash("sha256").update(bearer2).digest("hex");
+  const bearerHash = createHash2("sha256").update(bearer2).digest("hex");
   progress("Provisioning the A2A connection\u2026");
   await putA2aConnection({ credential: args.credential, projectArmId: args.projectArmId, connectionName, target: args.bridgeUrl, bearer: bearer2 });
   progress("Deploying the a2a-enabled agent version\u2026");
@@ -17716,7 +18118,7 @@ function defaultRemoveAgentDeps(args) {
     },
     removeLocalYaml(agentName) {
       const p = agentYamlPath(agentName, home);
-      if (fs15.existsSync(p)) fs15.rmSync(p);
+      if (fs18.existsSync(p)) fs18.rmSync(p);
     }
   };
 }
@@ -17858,17 +18260,17 @@ ${colors.success("\u2713")} removed ${colors.field(name)}.
 };
 
 // src/commands/a2a/enable.ts
-import * as path15 from "path";
+import * as path18 from "path";
 import { Command as Command26, Option as Option25 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential11 } from "@azure/identity";
 init_errors();
 
 // src/lib/bridge-url.ts
 init_errors();
-import * as fs16 from "fs";
-import * as os6 from "os";
-import * as path14 from "path";
-import { parse as parseYaml8 } from "yaml";
+import * as fs19 from "fs";
+import * as os7 from "os";
+import * as path17 from "path";
+import { parse as parseYaml9 } from "yaml";
 var A2A_PATH = "/api/a2a/mcp";
 function resolveBridgeUrl(opts) {
   const env = opts.env ?? process.env;
@@ -17889,10 +18291,10 @@ function clean(v) {
   return t.length ? t : void 0;
 }
 function readConfigGatewayUrl(home) {
-  const cfg = path14.join(home ?? os6.homedir(), ".m8t", "config.yaml");
-  if (!fs16.existsSync(cfg)) return void 0;
+  const cfg = path17.join(home ?? os7.homedir(), ".m8t", "config.yaml");
+  if (!fs19.existsSync(cfg)) return void 0;
   try {
-    const o = parseYaml8(fs16.readFileSync(cfg, "utf8"));
+    const o = parseYaml9(fs19.readFileSync(cfg, "utf8"));
     return typeof o.gatewayUrl === "string" ? o.gatewayUrl : void 0;
   } catch {
     return void 0;
@@ -17961,11 +18363,11 @@ var A2aEnableCommand = class extends M8tCommand {
   resolvePersonaPath() {
     if (typeof this.persona === "string" && this.persona.length > 0) {
       if (this.persona.includes("/") || this.persona.endsWith(".md")) return this.persona;
-      return path15.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
+      return path18.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
     }
     const yaml = readAgentYaml(this.worker);
     if (yaml?.personaPath) {
-      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path15.join(resolveRepoRoot(), yaml.personaPath);
+      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path18.join(resolveRepoRoot(), yaml.personaPath);
     }
     throw new LocalCliError({ code: "A2A_NO_PERSONA", message: `Could not resolve a persona for '${this.worker}'. Pass --persona <name>.` });
   }
@@ -18020,13 +18422,13 @@ var A2aDisableCommand = class extends M8tCommand {
 import { Command as Command28 } from "clipanion";
 
 // src/lib/architect-version.ts
-import { createHash as createHash2 } from "crypto";
-import * as fs17 from "fs";
-import * as os7 from "os";
-import * as path16 from "path";
+import { createHash as createHash3 } from "crypto";
+import * as fs20 from "fs";
+import * as os8 from "os";
+import * as path19 from "path";
 function readVersionFrontmatter(file) {
-  if (!fs17.existsSync(file)) return "";
-  const text = fs17.readFileSync(file, "utf8");
+  if (!fs20.existsSync(file)) return "";
+  const text = fs20.readFileSync(file, "utf8");
   if (!text.startsWith("---")) return "";
   const closeIdx = text.indexOf("\n---", 3);
   if (closeIdx < 0) return "";
@@ -18035,27 +18437,27 @@ function readVersionFrontmatter(file) {
   return m ? m[1].trim() : "";
 }
 function sha256File(filePath) {
-  return createHash2("sha256").update(fs17.readFileSync(filePath)).digest("hex");
+  return createHash3("sha256").update(fs20.readFileSync(filePath)).digest("hex");
 }
 var SIDECAR_FILENAME = "m8t-architect.m8t-skill.json";
 var LEGACY_SIDECAR_FILENAME = ".m8t-skill.json";
 function vsCodeUserDataDir() {
   if (process.platform === "darwin") {
-    return path16.join(os7.homedir(), "Library", "Application Support", "Code", "User");
+    return path19.join(os8.homedir(), "Library", "Application Support", "Code", "User");
   }
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA ?? path16.join(os7.homedir(), "AppData", "Roaming");
-    return path16.join(appData, "Code", "User");
+    const appData = process.env.APPDATA ?? path19.join(os8.homedir(), "AppData", "Roaming");
+    return path19.join(appData, "Code", "User");
   }
   return null;
 }
 function vsCodePromptsDir() {
   const userData = vsCodeUserDataDir();
   if (!userData) return null;
-  const prompts = path16.join(userData, "prompts");
-  if (fs17.existsSync(prompts)) return prompts;
-  const promptFiles = path16.join(userData, "prompt-files");
-  if (fs17.existsSync(promptFiles)) return promptFiles;
+  const prompts = path19.join(userData, "prompts");
+  if (fs20.existsSync(prompts)) return prompts;
+  const promptFiles = path19.join(userData, "prompt-files");
+  if (fs20.existsSync(promptFiles)) return promptFiles;
   return prompts;
 }
 var COPILOT_CLI_SKILLS_ROOTS = [
@@ -18064,9 +18466,9 @@ var COPILOT_CLI_SKILLS_ROOTS = [
   [".github", "copilot", "skills"]
 ];
 function sidecarLocations() {
-  const home = os7.homedir();
+  const home = os8.homedir();
   const locations = [
-    { host: "Claude Code", dir: path16.join(home, ".claude", "skills", "m8t-architect") }
+    { host: "Claude Code", dir: path19.join(home, ".claude", "skills", "m8t-architect") }
   ];
   const vsCodeDir = vsCodePromptsDir();
   if (vsCodeDir) {
@@ -18075,7 +18477,7 @@ function sidecarLocations() {
   for (const segments of COPILOT_CLI_SKILLS_ROOTS) {
     locations.push({
       host: "GitHub Copilot CLI",
-      dir: path16.join(home, ...segments, "m8t-architect")
+      dir: path19.join(home, ...segments, "m8t-architect")
     });
   }
   return locations;
@@ -18084,10 +18486,10 @@ function resolveSidecar() {
   let best = null;
   for (const loc of sidecarLocations()) {
     for (const filename of [SIDECAR_FILENAME, LEGACY_SIDECAR_FILENAME]) {
-      const candidate2 = path16.join(loc.dir, filename);
+      const candidate2 = path19.join(loc.dir, filename);
       let mtimeMs;
       try {
-        mtimeMs = fs17.statSync(candidate2).mtimeMs;
+        mtimeMs = fs20.statSync(candidate2).mtimeMs;
       } catch {
         continue;
       }
@@ -18099,13 +18501,13 @@ function resolveSidecar() {
   return best;
 }
 function checkArchitectDrift() {
-  const sourcePath = path16.join(
+  const sourcePath = path19.join(
     resolveRepoRoot(),
     "personas",
     "m8t-architect",
     "persona.md"
   );
-  if (!fs17.existsSync(sourcePath)) {
+  if (!fs20.existsSync(sourcePath)) {
     return {
       match: false,
       sourceVersion: "",
@@ -18118,7 +18520,7 @@ function checkArchitectDrift() {
   let sidecar = null;
   if (resolved) {
     try {
-      const raw = JSON.parse(fs17.readFileSync(resolved.path, "utf8"));
+      const raw = JSON.parse(fs20.readFileSync(resolved.path, "utf8"));
       if (raw !== null && typeof raw === "object") {
         const r = raw;
         sidecar = {
@@ -18180,10 +18582,123 @@ var ArchitectCheckCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/agent-content/sync.ts
+import { Command as Command29, Option as Option27 } from "clipanion";
+import * as path20 from "path";
+var AgentContentSyncCommand = class extends M8tCommand {
+  static paths = [["agent-content", "sync"]];
+  static usage = Command29.Usage({
+    description: "Materialize the pinned agent repos into personas/ and brain-seeds/.",
+    details: "Reads installer/release-pin.json, fetches each pinned agent repo at its pinned commit, verifies the content against the pin's contentSha, and writes personas/<persona>/ + brain-seeds/<persona>/ under the repo root. Those paths are git-ignored: the agent repos are the source of truth, and this is how a checkout gets a usable copy. Private agent repos need AGENT_CONTENT_TOKEN (or GH_TOKEN / GITHUB_TOKEN / an authed gh). See docs/architecture/AGENT-REPO-CONTRACT.md.",
+    examples: [
+      ["Sync into the current checkout", "$0 agent-content sync"],
+      ["Sync into an explicit root", "$0 agent-content sync --root /opt/m8t/repo"]
+    ]
+  });
+  root = Option27.String("--root", { description: "Repo root to hydrate into. Defaults to the m8t checkout." });
+  async executeCommand() {
+    const root = (typeof this.root === "string" ? this.root : void 0) ?? tryResolveRepoRoot() ?? process.cwd();
+    const synced = await syncAgentContent({
+      root: path20.resolve(root),
+      deps: { env: this.context.env, onNotice: (m) => this.context.stderr.write(`  ${colors.dim(m)}
+`) }
+    });
+    if (synced.length === 0) {
+      this.context.stdout.write(`${colors.hint("note:")} the release pin declares no agents \u2014 nothing to sync.
+`);
+      return 0;
+    }
+    for (const a of synced) {
+      this.context.stdout.write(
+        `${colors.success("\u2713")} ${colors.field(a.persona)} \u2190 ${a.repo}@${a.ref.slice(0, 8)} (${colors.dim(`personas/${a.persona}/, brain-seeds/${a.persona}/`)})
+`
+      );
+    }
+    return 0;
+  }
+};
+
+// src/commands/agent-content/pin.ts
+import { Command as Command30, Option as Option28 } from "clipanion";
+import * as fs21 from "fs";
+import * as path21 from "path";
+init_errors();
+var AgentContentPinCommand = class extends M8tCommand {
+  static paths = [["agent-content", "pin"]];
+  static usage = Command30.Usage({
+    description: "Re-derive a pinned agent's ref + contentSha from its branch.",
+    details: "Resolves <key>'s repo branch to an immutable commit, fetches THAT commit, and digests what it actually contains \u2014 so the recorded contentSha describes bytes that were read, not a branch that may have moved. Prints the new entry; --write applies it to installer/release-pin.json. Bumping a pin is a release act: it changes what a from-zero install deploys.",
+    examples: [
+      ["Show what ezra's pin would become", "$0 agent-content pin ezra"],
+      ["Apply it", "$0 agent-content pin ezra --write"],
+      ["Pin a non-default branch", "$0 agent-content pin ezra --branch curated"]
+    ]
+  });
+  key = Option28.String();
+  branch = Option28.String("--branch", { description: "Branch to resolve. Default: main." });
+  write = Option28.Boolean("--write", false, { description: "Apply the new entry to installer/release-pin.json." });
+  root = Option28.String("--root");
+  output = Option28.String("--output");
+  async executeCommand() {
+    const key2 = typeof this.key === "string" ? this.key : void 0;
+    if (!key2) throw new LocalCliError({ code: "USAGE", message: "<key> is required (an agents.<key> from the release pin)" });
+    const branch = (typeof this.branch === "string" ? this.branch : void 0) ?? "main";
+    const root = path21.resolve(
+      (typeof this.root === "string" ? this.root : void 0) ?? tryResolveRepoRoot() ?? process.cwd()
+    );
+    const pinPath = path21.join(root, PIN_REL_PATH);
+    const raw = fs21.readFileSync(pinPath, "utf8");
+    const pin = parseReleasePin(raw, pinPath);
+    if (!Object.hasOwn(pin.agents, key2)) {
+      throw new LocalCliError({
+        code: "AGENT_PIN_UNKNOWN",
+        message: `No agents.${key2} in ${PIN_REL_PATH}.`,
+        hint: `Known keys: ${Object.keys(pin.agents).join(", ") || "(none)"}.`
+      });
+    }
+    const current = pin.agents[key2];
+    const next = await derivePin({
+      current,
+      branch,
+      deps: { env: this.context.env, onNotice: (m) => this.context.stderr.write(`  ${colors.dim(m)}
+`) }
+    });
+    if (this.output === "json") {
+      this.context.stdout.write(renderJson({ key: key2, branch, from: current, to: next }) + "\n");
+    } else if (next.ref === current.ref && next.contentSha === current.contentSha && next.persona === current.persona) {
+      this.context.stdout.write(`${colors.success("\u2713")} ${key2} is already pinned to ${branch} (${next.ref.slice(0, 8)}).
+`);
+    } else {
+      this.context.stdout.write(`${colors.field(key2)} \u2192 ${branch}
+`);
+      const line2 = (label, a, b) => {
+        this.context.stdout.write(
+          a === b ? `  ${colors.dim(`${label}: ${a} (unchanged)`)}
+` : `  ${label}: ${colors.dim(a)} \u2192 ${colors.field(b)}
+`
+        );
+      };
+      line2("ref       ", current.ref, next.ref);
+      line2("contentSha", current.contentSha, next.contentSha);
+      line2("persona   ", current.persona, next.persona);
+    }
+    if (this.write === true) {
+      const doc = JSON.parse(raw);
+      doc.agents[key2] = { repo: next.repo, ref: next.ref, visibility: next.visibility, persona: next.persona, contentSha: next.contentSha };
+      fs21.writeFileSync(pinPath, JSON.stringify(doc, null, 2) + "\n");
+      this.context.stdout.write(`${colors.success("\u2713")} wrote ${PIN_REL_PATH}
+`);
+      this.context.stdout.write(`  ${colors.hint("note:")} bumping a pin is a release act \u2014 it changes what a from-zero install deploys.
+`);
+    }
+    return 0;
+  }
+};
+
 // src/commands/coder/deploy.ts
 init_esm2();
-import * as path18 from "path";
-import { Command as Command29, Option as Option27 } from "clipanion";
+import * as path23 from "path";
+import { Command as Command31, Option as Option29 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential13 } from "@azure/identity";
 init_errors();
 init_foundry_agent_get();
@@ -18449,14 +18964,14 @@ async function deployHostedWorker(args) {
 }
 
 // src/lib/persona.ts
-import * as fs18 from "fs";
-import * as path17 from "path";
-import { parse as parseYaml9 } from "yaml";
+import * as fs22 from "fs";
+import * as path22 from "path";
+import { parse as parseYaml10 } from "yaml";
 function findRepoRoot(startDir) {
-  let dir = path17.resolve(startDir);
+  let dir = path22.resolve(startDir);
   for (; ; ) {
-    if (fs18.existsSync(path17.join(dir, "personas"))) return dir;
-    const parent = path17.dirname(dir);
+    if (fs22.existsSync(path22.join(dir, "personas"))) return dir;
+    const parent = path22.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -18464,10 +18979,10 @@ function findRepoRoot(startDir) {
 function resolvePersona(persona, cwd = process.cwd()) {
   const root = findRepoRoot(cwd);
   if (!root) return { persona, personaVersion: null };
-  const file = path17.join(root, "personas", persona, "persona.md");
+  const file = path22.join(root, "personas", persona, "persona.md");
   let raw;
   try {
-    raw = fs18.readFileSync(file, "utf-8");
+    raw = fs22.readFileSync(file, "utf-8");
   } catch {
     return { persona, personaVersion: null };
   }
@@ -18475,7 +18990,7 @@ function resolvePersona(persona, cwd = process.cwd()) {
   if (!match) return { persona, personaVersion: null };
   let fm = null;
   try {
-    fm = parseYaml9(match[1]);
+    fm = parseYaml10(match[1]);
   } catch {
     return { persona, personaVersion: null };
   }
@@ -18611,7 +19126,7 @@ var DEFAULT_MODEL = "gpt-4.1-mini";
 var NAME_RE = /^[a-z0-9-]+$/;
 var CoderDeployCommand = class extends M8tCommand {
   static paths = [["coder", "deploy"]];
-  static usage = Command29.Usage({
+  static usage = Command31.Usage({
     description: "Deploy the curated coding agent as a hosted Foundry worker.",
     details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
     examples: [
@@ -18620,22 +19135,22 @@ var CoderDeployCommand = class extends M8tCommand {
       ["Override the exec timeout", "$0 coder deploy my-coder --env M8T_CODER_EXEC_TIMEOUT_SECONDS=300"]
     ]
   });
-  name = Option27.String();
-  persona = Option27.String("--persona");
-  image = Option27.String("--image");
-  imageTag = Option27.String("--image-tag");
-  size = Option27.String("--size");
-  modelDeployment = Option27.String("--model-deployment");
-  env = Option27.Array("--env");
-  endpoint = Option27.String("--endpoint");
-  subscription = Option27.String("--subscription");
-  output = Option27.String("--output");
-  brain = Option27.String("--brain");
-  brainBranch = Option27.String("--branch");
-  brainKv = Option27.String("--brain-kv");
-  allowNonReasoning = Option27.Boolean("--allow-non-reasoning", false);
-  skipQuotaCheck = Option27.Boolean("--skip-quota-check", false);
-  gatewayUrl = Option27.String("--gateway-url", { description: "Base gateway URL for the a2a bridge (e.g. https://<gateway-fqdn>); enables this coder as an a2a target." });
+  name = Option29.String();
+  persona = Option29.String("--persona");
+  image = Option29.String("--image");
+  imageTag = Option29.String("--image-tag");
+  size = Option29.String("--size");
+  modelDeployment = Option29.String("--model-deployment");
+  env = Option29.Array("--env");
+  endpoint = Option29.String("--endpoint");
+  subscription = Option29.String("--subscription");
+  output = Option29.String("--output");
+  brain = Option29.String("--brain");
+  brainBranch = Option29.String("--branch");
+  brainKv = Option29.String("--brain-kv");
+  allowNonReasoning = Option29.Boolean("--allow-non-reasoning", false);
+  skipQuotaCheck = Option29.Boolean("--skip-quota-check", false);
+  gatewayUrl = Option29.String("--gateway-url", { description: "Base gateway URL for the a2a bridge (e.g. https://<gateway-fqdn>); enables this coder as an a2a target." });
   async executeCommand() {
     if (!NAME_RE.test(this.name)) {
       throw new LocalCliError({
@@ -18824,7 +19339,7 @@ var CoderDeployCommand = class extends M8tCommand {
         projectEndpoint: project.endpoint,
         projectArmId: `${project.accountScope}/projects/${project.projectName}`,
         agentName: this.name,
-        personaPath: path18.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
+        personaPath: path23.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
         bridgeUrl,
         onProgress
       });
@@ -18869,13 +19384,13 @@ var CoderDeployCommand = class extends M8tCommand {
 
 // src/commands/coder/teardown.ts
 import { confirm as confirm4 } from "@inquirer/prompts";
-import { Command as Command30, Option as Option28 } from "clipanion";
+import { Command as Command32, Option as Option30 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential14 } from "@azure/identity";
 init_foundry_agents();
 init_errors();
 var CoderTeardownCommand = class extends M8tCommand {
   static paths = [["coder", "teardown"]];
-  static usage = Command30.Usage({
+  static usage = Command32.Usage({
     description: "Delete a deployed hosted coder (removes its container + identity + role assignment).",
     details: "Idempotent: tearing down a missing coder reports 'already gone'. Only the named agent is touched. Discovery self-heals on the next worker list.",
     examples: [
@@ -18883,11 +19398,11 @@ var CoderTeardownCommand = class extends M8tCommand {
       ["Skip the confirm (scripts)", "$0 coder teardown my-coder --yes"]
     ]
   });
-  name = Option28.String();
-  yes = Option28.Boolean("--yes", false);
-  endpoint = Option28.String("--endpoint");
-  subscription = Option28.String("--subscription");
-  output = Option28.String("--output");
+  name = Option30.String();
+  yes = Option30.Boolean("--yes", false);
+  endpoint = Option30.String("--endpoint");
+  subscription = Option30.String("--subscription");
+  output = Option30.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -18951,8 +19466,8 @@ var CoderTeardownCommand = class extends M8tCommand {
 
 // src/commands/azure-exec/deploy.ts
 init_esm2();
-import * as path19 from "path";
-import { Command as Command31, Option as Option29 } from "clipanion";
+import * as path24 from "path";
+import { Command as Command33, Option as Option31 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential15 } from "@azure/identity";
 init_errors();
 init_foundry_agent_get();
@@ -19014,7 +19529,7 @@ var DEFAULT_MODEL2 = "gpt-5-mini";
 var NAME_RE2 = /^[a-z0-9-]+$/;
 var AzureExecDeployCommand = class extends M8tCommand {
   static paths = [["azure-exec", "deploy"]];
-  static usage = Command31.Usage({
+  static usage = Command33.Usage({
     description: "Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).",
     details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-labs/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
     examples: [
@@ -19024,23 +19539,23 @@ var AzureExecDeployCommand = class extends M8tCommand {
       ]
     ]
   });
-  name = Option29.String();
-  image = Option29.String("--image");
-  imageTag = Option29.String("--image-tag");
-  size = Option29.String("--size");
-  scope = Option29.String("--scope");
-  resourceGroup = Option29.String("--resource-group");
-  modelDeployment = Option29.String("--model-deployment");
-  env = Option29.Array("--env");
-  brain = Option29.String("--brain");
-  kvUri = Option29.String("--kv-uri");
-  gatewayUrl = Option29.String("--gateway-url");
-  endpoint = Option29.String("--endpoint");
-  subscription = Option29.String("--subscription");
-  output = Option29.String("--output");
-  skipQuotaCheck = Option29.Boolean("--skip-quota-check", false);
-  grantAccessAdmin = Option29.Boolean("--grant-access-admin", false);
-  enableEmail = Option29.Boolean("--enable-email", false);
+  name = Option31.String();
+  image = Option31.String("--image");
+  imageTag = Option31.String("--image-tag");
+  size = Option31.String("--size");
+  scope = Option31.String("--scope");
+  resourceGroup = Option31.String("--resource-group");
+  modelDeployment = Option31.String("--model-deployment");
+  env = Option31.Array("--env");
+  brain = Option31.String("--brain");
+  kvUri = Option31.String("--kv-uri");
+  gatewayUrl = Option31.String("--gateway-url");
+  endpoint = Option31.String("--endpoint");
+  subscription = Option31.String("--subscription");
+  output = Option31.String("--output");
+  skipQuotaCheck = Option31.Boolean("--skip-quota-check", false);
+  grantAccessAdmin = Option31.Boolean("--grant-access-admin", false);
+  enableEmail = Option31.Boolean("--enable-email", false);
   async executeCommand() {
     if (!NAME_RE2.test(this.name)) {
       throw new LocalCliError({
@@ -19227,7 +19742,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       kvUri
     });
     onProgress?.("a2a-enabling as a target\u2026");
-    const personaPath = path19.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
+    const personaPath = path24.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
     const bridgeUrl = resolveBridgeUrl({
       flag: typeof this.gatewayUrl === "string" ? this.gatewayUrl : void 0,
       env: processEnv
@@ -19285,7 +19800,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/status.ts
-import { Command as Command32, Option as Option30 } from "clipanion";
+import { Command as Command34, Option as Option32 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/identity";
 
 // src/lib/platform-update.ts
@@ -19393,8 +19908,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path43 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path43}:pull`);
+  const path48 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path48}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -19410,7 +19925,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path43}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path48}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -19424,7 +19939,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
 }
 
 // src/lib/release-channel.ts
-import * as fs19 from "fs";
+import * as fs23 from "fs";
 
 // ../../packages/platform-release/dist/esm/manifest.js
 var SEVERITIES = ["critical", "recommended", "optional"];
@@ -19647,7 +20162,7 @@ function manifestSourceForVersionTag(channelUrl, version) {
   return { url: custom };
 }
 async function fetchManifest(source, deps = {}) {
-  const readFile9 = deps.readFile ?? ((p) => fs19.readFileSync(p, "utf8"));
+  const readFile9 = deps.readFile ?? ((p) => fs23.readFileSync(p, "utf8"));
   const fetchImpl = deps.fetchImpl ?? fetch;
   const ghToken = deps.ghToken ?? getGhToken;
   let raw;
@@ -19693,10 +20208,9 @@ async function fetchManifest(source, deps = {}) {
 }
 
 // src/lib/release-content.ts
-import * as fs20 from "fs";
-import * as os8 from "os";
-import * as path20 from "path";
-import { execFileSync as execFileSync2 } from "child_process";
+import * as fs24 from "fs";
+import * as os9 from "os";
+import * as path25 from "path";
 init_errors();
 var OWNER_REPO = "m8t-labs/m8t";
 function parseTreeResponse(body) {
@@ -19725,8 +20239,13 @@ async function fetchRepoTree(commit, deps = {}) {
 function verifyPersonaTrees(manifest, tree) {
   const out = [];
   for (const [name, item] of Object.entries(manifest.components.personas.items)) {
+    if (item.source) continue;
     const actual = tree.treeShaOf(item.path);
-    if (actual !== void 0 && actual !== item.treeSha) {
+    if (actual === void 0) {
+      out.push(
+        `persona '${name}' (${item.path}): the manifest claims it is in the platform repo at ${manifest.platform.commit}, but that commit's tree has no such path`
+      );
+    } else if (actual !== item.treeSha) {
       out.push(`persona '${name}' (${item.path}): manifest pins ${item.treeSha} but commit tree has ${actual}`);
     }
   }
@@ -19734,15 +20253,15 @@ function verifyPersonaTrees(manifest, tree) {
 }
 async function resolveReleaseContent(manifest, opts = {}) {
   if (opts.contentDir) {
-    if (!fs20.existsSync(path20.join(opts.contentDir, "personas"))) {
+    if (!fs24.existsSync(path25.join(opts.contentDir, "personas"))) {
       throw new LocalCliError({ code: "PLATFORM_CONTENT_DIR_INVALID", message: `--content-dir '${opts.contentDir}' has no personas/ \u2014 not a repo checkout.` });
     }
     return opts.contentDir;
   }
   const commit = manifest.platform.commit;
-  const cacheRoot = opts.cacheRoot ?? path20.join(os8.homedir(), ".m8t", "cache");
-  const dest = path20.join(cacheRoot, `release-${commit}`);
-  if (fs20.existsSync(path20.join(dest, "personas"))) return dest;
+  const cacheRoot = opts.cacheRoot ?? path25.join(os9.homedir(), ".m8t", "cache");
+  const dest = path25.join(cacheRoot, `release-${commit}`);
+  if (fs24.existsSync(path25.join(dest, "personas"))) return dest;
   const fetchImpl = opts.fetchImpl ?? fetch;
   const ghToken = opts.ghToken ?? getGhToken;
   let token;
@@ -19756,33 +20275,29 @@ async function resolveReleaseContent(manifest, opts = {}) {
   if (!res.ok) {
     throw new LocalCliError({ code: "PLATFORM_TARBALL_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
   }
-  fs20.mkdirSync(cacheRoot, { recursive: true });
-  const tmp = fs20.mkdtempSync(path20.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
+  fs24.mkdirSync(cacheRoot, { recursive: true });
+  const tmp = fs24.mkdtempSync(path25.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
   try {
-    const tgz = path20.join(tmp, "src.tar.gz");
-    fs20.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
-    const unpacked = path20.join(tmp, "unpacked");
-    fs20.mkdirSync(unpacked);
+    const tgz = path25.join(tmp, "src.tar.gz");
+    fs24.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
+    const unpacked = path25.join(tmp, "unpacked");
+    fs24.mkdirSync(unpacked);
     extractTarGz(tgz, unpacked);
-    try {
-      fs20.renameSync(unpacked, dest);
-    } catch (e) {
-      const err = e;
-      const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs20.existsSync(path20.join(dest, "personas"));
-      if (!isBenignRace) {
-        throw new LocalCliError({
-          code: "PLATFORM_CACHE_PUBLISH_FAILED",
-          message: `Could not publish release cache to ${dest}: ${err.message}`
-        });
-      }
-    }
+    publishAtomically({
+      from: unpacked,
+      dest,
+      sentinel: "personas",
+      errorCode: "PLATFORM_CACHE_PUBLISH_FAILED"
+    });
   } finally {
-    fs20.rmSync(tmp, { recursive: true, force: true });
+    fs24.rmSync(tmp, { recursive: true, force: true });
   }
   return dest;
 }
-function extractTarGz(tgz, into) {
-  execFileSync2("tar", ["-xzf", tgz, "-C", into, "--strip-components=1"]);
+async function resolveReleaseContentWithAgents(manifest, opts = {}) {
+  const contentDir = await resolveReleaseContent(manifest, opts);
+  await hydrateAgentsInto(contentDir, manifest.components.agents ?? {}, opts.agentDeps);
+  return contentDir;
 }
 
 // src/lib/platform-stamp.ts
@@ -19934,14 +20449,14 @@ async function readStamp(opts) {
 
 // src/lib/platform-converge.ts
 init_esm();
-import * as fs22 from "fs";
-import * as path22 from "path";
-import { parse as parseYaml10 } from "yaml";
+import * as fs26 from "fs";
+import * as path27 from "path";
+import { parse as parseYaml11 } from "yaml";
 
 // src/lib/deploy.ts
-import * as fs21 from "fs/promises";
-import * as os9 from "os";
-import * as path21 from "path";
+import * as fs25 from "fs/promises";
+import * as os10 from "os";
+import * as path26 from "path";
 init_errors();
 var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
 function parseFoundryTracingMode(v) {
@@ -19999,10 +20514,10 @@ function buildBicepParams(p) {
   if (p.examApiBase) params.push(`examApiBase=${p.examApiBase}`);
   return params;
 }
-async function resolveRepoRoot2(home = os9.homedir()) {
-  const marker = path21.join(home, ".m8t", "repo-root");
+async function resolveRepoRoot2(home = os10.homedir()) {
+  const marker = path26.join(home, ".m8t", "repo-root");
   try {
-    const root = (await fs21.readFile(marker, "utf8")).trim();
+    const root = (await fs25.readFile(marker, "utf8")).trim();
     if (!root) throw new Error("empty");
     return root;
   } catch {
@@ -20088,7 +20603,7 @@ function buildDeployResult(args) {
   };
 }
 async function runBicepDeployment(opts) {
-  const bicepPath = path21.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path26.join(opts.repoRoot, "deploy", "main.bicep");
   const result2 = JSON.parse(
     await runAz([
       "deployment",
@@ -20455,14 +20970,14 @@ async function applyAgentImage(a, ctx, opts) {
 function declaredFillableFields(personaPath) {
   let raw;
   try {
-    raw = fs22.readFileSync(personaPath, "utf8");
+    raw = fs26.readFileSync(personaPath, "utf8");
   } catch {
     return [];
   }
   const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fmMatch) return [];
   try {
-    const fm = parseYaml10(fmMatch[1]);
+    const fm = parseYaml11(fmMatch[1]);
     return fm["fillable-fields"] ?? [];
   } catch {
     return [];
@@ -20481,7 +20996,7 @@ function injectAndRender(personaPath, values, agentName) {
 function loaderText(loaderPath) {
   if (!loaderPath) return null;
   try {
-    return fs22.readFileSync(loaderPath, "utf8");
+    return fs26.readFileSync(loaderPath, "utf8");
   } catch {
     return null;
   }
@@ -20498,7 +21013,7 @@ function brainRepoOf(current) {
 }
 async function applyPersona(a, ctx, opts) {
   const current = await getAgentVersion({ credential: ctx.credential, projectEndpoint: opts.project.endpoint, agentName: opts.agentName });
-  const personaPath = path22.join(opts.personaDir, "persona.md");
+  const personaPath = path27.join(opts.personaDir, "persona.md");
   const yamlValues = readAgentYaml(opts.agentName)?.fillableFieldValues ?? null;
   const values = resolveFillableValues(current, yamlValues);
   const declared = declaredFillableFields(personaPath);
@@ -20633,30 +21148,30 @@ async function readGatewayVersion(gatewayUrl, fetchImpl = fetch) {
 // src/commands/platform/status.ts
 var PlatformStatusCommand = class extends M8tCommand {
   static paths = [["platform", "status"]];
-  static usage = Command32.Usage({
+  static usage = Command34.Usage({
     description: "Show per-component platform drift against a release manifest.",
     details: "Fetches a release manifest (the current channel by default), reads the installed-state stamp, and reports each component's installed vs target version and drift status. Read-only \u2014 never writes the stamp, never converges anything (use 'm8t platform update' for that). --verify additionally probes the live gateway (image tag + /api/version) best-effort."
   });
-  subscription = Option30.String("--subscription");
-  resourceGroup = Option30.String("--resource-group", {
+  subscription = Option32.String("--subscription");
+  resourceGroup = Option32.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  to = Option30.String("--to", {
+  to = Option32.String("--to", {
     description: "Check status against a pinned platform version (defaults to the current release channel)."
   });
-  contentDir = Option30.String("--content-dir", {
+  contentDir = Option32.String("--content-dir", {
     description: "Path to a local m8t repo checkout (skips the tarball tree-SHA fetch)."
   });
-  manifestUrl = Option30.String("--manifest-url", {
+  manifestUrl = Option32.String("--manifest-url", {
     description: "Fetch the release manifest from this URL instead of the release channel."
   });
-  manifestFile = Option30.String("--manifest-file", {
+  manifestFile = Option32.String("--manifest-file", {
     description: "Read the release manifest from this local file instead of the release channel."
   });
-  verify = Option30.Boolean("--verify", false, {
+  verify = Option32.Boolean("--verify", false, {
     description: "Additionally probe the live gateway (image tag + /api/version) and report stamp-vs-live."
   });
-  output = Option30.String("--output");
+  output = Option32.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20769,12 +21284,12 @@ var PlatformStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/update.ts
-import { Command as Command33, Option as Option31 } from "clipanion";
+import { Command as Command35, Option as Option33 } from "clipanion";
 import { confirm as confirm5 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
 
 // src/lib/platform-converge-cli.ts
-import * as path26 from "path";
+import * as path31 from "path";
 
 // src/lib/platform-infra-params.ts
 import { TableClient as TableClient3 } from "@azure/data-tables";
@@ -20859,17 +21374,18 @@ init_errors();
 
 // src/lib/seed-refresh-driver.ts
 init_esm2();
-import * as path25 from "path";
+import * as fs29 from "fs";
+import * as path30 from "path";
 
 // src/lib/seed-refresh.ts
 init_errors();
-import * as fs24 from "fs";
-import * as path24 from "path";
+import * as fs28 from "fs";
+import * as path29 from "path";
 
 // src/lib/seed-merge.ts
-import * as fs23 from "fs";
-import * as os10 from "os";
-import * as path23 from "path";
+import * as fs27 from "fs";
+import * as os11 from "os";
+import * as path28 from "path";
 import { spawnSync as spawnSync3 } from "child_process";
 function isProbablyText(s) {
   return !s.includes("\0");
@@ -20879,14 +21395,14 @@ function mergeThreeWay(ours, base, theirs) {
     return { ok: false, merged: "" };
   }
   const lf = (s) => s.replace(/\r\n/g, "\n");
-  const dir = fs23.mkdtempSync(path23.join(os10.tmpdir(), "seed-merge-"));
+  const dir = fs27.mkdtempSync(path28.join(os11.tmpdir(), "seed-merge-"));
   try {
-    const o = path23.join(dir, "ours");
-    const b = path23.join(dir, "base");
-    const t = path23.join(dir, "theirs");
-    fs23.writeFileSync(o, lf(ours));
-    fs23.writeFileSync(b, lf(base));
-    fs23.writeFileSync(t, lf(theirs));
+    const o = path28.join(dir, "ours");
+    const b = path28.join(dir, "base");
+    const t = path28.join(dir, "theirs");
+    fs27.writeFileSync(o, lf(ours));
+    fs27.writeFileSync(b, lf(base));
+    fs27.writeFileSync(t, lf(theirs));
     const res = spawnSync3(
       "git",
       ["merge-file", "-p", "--diff3", o, b, t],
@@ -20900,28 +21416,28 @@ function mergeThreeWay(ours, base, theirs) {
     }
     return { ok: false, merged: "" };
   } finally {
-    fs23.rmSync(dir, { recursive: true, force: true });
+    fs27.rmSync(dir, { recursive: true, force: true });
   }
 }
-var skip = (path43, skipReason) => ({ path: path43, kind: "skip", skipReason });
+var skip = (path48, skipReason) => ({ path: path48, kind: "skip", skipReason });
 function classifyCandidate(c) {
-  const { path: path43, base, ours, theirs } = c;
-  if (theirs === base) return { path: path43, kind: "noop" };
+  const { path: path48, base, ours, theirs } = c;
+  if (theirs === base) return { path: path48, kind: "noop" };
   if (base === null) {
-    if (theirs === null) return { path: path43, kind: "noop" };
-    if (ours === null) return { path: path43, kind: "add", content: theirs };
-    if (ours === theirs) return { path: path43, kind: "noop" };
-    return skip(path43, "you already have a file at this path");
+    if (theirs === null) return { path: path48, kind: "noop" };
+    if (ours === null) return { path: path48, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path48, kind: "noop" };
+    return skip(path48, "you already have a file at this path");
   }
   if (ours === null) {
-    return theirs === null ? { path: path43, kind: "noop" } : skip(path43, "you removed this file; upstream changed it");
+    return theirs === null ? { path: path48, kind: "noop" } : skip(path48, "you removed this file; upstream changed it");
   }
   if (theirs === null) {
-    return ours === base ? { path: path43, kind: "delete" } : skip(path43, "you edited this file; upstream removed it");
+    return ours === base ? { path: path48, kind: "delete" } : skip(path48, "you edited this file; upstream removed it");
   }
-  if (ours === base) return { path: path43, kind: "update", content: theirs };
+  if (ours === base) return { path: path48, kind: "update", content: theirs };
   const m = mergeThreeWay(ours, base, theirs);
-  return m.ok ? { path: path43, kind: "update", content: m.merged } : skip(path43, "your edits conflict with the update");
+  return m.ok ? { path: path48, kind: "update", content: m.merged } : skip(path48, "your edits conflict with the update");
 }
 
 // src/lib/seed-pr-body.ts
@@ -20956,8 +21472,8 @@ function composeSeedPrBody(s) {
 // src/lib/seed-refresh.ts
 function readIf(dir, rel) {
   if (!dir) return null;
-  const abs = path24.join(dir, rel);
-  return fs24.existsSync(abs) ? fs24.readFileSync(abs, "utf8") : null;
+  const abs = path29.join(dir, rel);
+  return fs28.existsSync(abs) ? fs28.readFileSync(abs, "utf8") : null;
 }
 async function assembleCandidates(args) {
   const paths = /* @__PURE__ */ new Set([...args.lineage?.ownedPaths ?? [], ...args.trees.ownedAtTheirs]);
@@ -21089,7 +21605,8 @@ function dedupeBrainRepos(agents) {
 function seedContentDir(contentRoot, manifest, seedName) {
   const items = manifest.components.brainSeeds.items;
   if (!Object.hasOwn(items, seedName)) return null;
-  return path25.join(contentRoot, items[seedName].path);
+  const dir = path30.join(contentRoot, items[seedName].path);
+  return fs29.existsSync(dir) ? dir : null;
 }
 function bindRepoApi(token, repo) {
   return {
@@ -21106,12 +21623,12 @@ function bindRepoApi(token, repo) {
     openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
     updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
     closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
-    readFileAtRef: (path43, ref) => readRepoFileViaApp({ token, repo, path: path43, ref })
+    readFileAtRef: (path48, ref) => readRepoFileViaApp({ token, repo, path: path48, ref })
   };
 }
 async function runSeedRefresh(args) {
   const targetCommit = args.manifest.platform.commit;
-  const theirsRoot = await resolveReleaseContent(args.manifest, {});
+  const theirsRoot = await resolveReleaseContentWithAgents(args.manifest, {});
   const repos = dedupeBrainRepos(args.agents);
   const results = [];
   let delivered = 0;
@@ -21148,6 +21665,7 @@ async function runSeedRefresh(args) {
       const advisorLabel = ADVISOR_LABEL[seedName] ?? seedName;
       let lineage = marker?.seeds.find((s) => s.name === seedName) ?? null;
       let baseDir = null;
+      const agentSourced = Boolean(args.manifest.components.agents && Object.values(args.manifest.components.agents).some((a) => a.persona === seedName));
       if (lineage) {
         try {
           const baseRoot = await resolveReleaseContent(
@@ -21175,6 +21693,11 @@ async function runSeedRefresh(args) {
           }
         }
       }
+      if (agentSourced && !baseDir) {
+        args.onWarn?.(
+          `${ref.repo}: seed '${seedName}' comes from an agent repo and no merge base could be resolved \u2014 new files are delivered, files you already have are skipped and never overwritten.`
+        );
+      }
       const trees = { baseDir, theirsDir, ownedAtTheirs: deriveOwnedPaths(theirsDir) };
       const source = { readOurs: (p) => readRepoFileViaApp({ token, repo: ref.repo, path: p }) };
       const res = await refreshBrainRepo({
@@ -21219,7 +21742,7 @@ async function buildConvergeDeps(args) {
     const persona = a.metadata.persona;
     if (persona) discovered[persona] = a.name;
   }
-  const loaderPath = path26.join(args.contentDir, "targets/foundry/brain-loader.md");
+  const loaderPath = path31.join(args.contentDir, "targets/foundry/brain-loader.md");
   return {
     async applyPersona(a, ctx) {
       const personaName = a.personaName;
@@ -21235,7 +21758,7 @@ async function buildConvergeDeps(args) {
       return applyPersona(a, ctx, {
         agentName,
         project: args.project,
-        personaDir: path26.join(ctx.contentDir, personaItem.path),
+        personaDir: path31.join(ctx.contentDir, personaItem.path),
         loaderPath
       });
     },
@@ -21417,40 +21940,40 @@ function assertCliVersionOk(manifest, runningVersion, onWarn = () => {
 // src/commands/platform/update.ts
 var PlatformUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "update"]];
-  static usage = Command33.Usage({
+  static usage = Command35.Usage({
     description: "Converge the whole platform (gateway, hosted agents, personas, infra) to a release manifest.",
     details: "Fetches a release manifest (the current channel by default), diffs it against the installed-state stamp, and converges each changed component via its own executor: rolls the gateway/hosted-agent images, re-versions prompt personas (compose-preserving), and records infra state. A deploy/ tree drift is reported but NOT applied unless --force-infra is passed. Use --check to preview, --only to converge a single component, --yes to skip the confirmation prompt."
   });
-  subscription = Option31.String("--subscription");
-  resourceGroup = Option31.String("--resource-group", {
+  subscription = Option33.String("--subscription");
+  resourceGroup = Option33.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  to = Option31.String("--to", {
+  to = Option33.String("--to", {
     description: "Pin the platform version to converge to (defaults to the current release channel)."
   });
-  only = Option31.String("--only", {
+  only = Option33.String("--only", {
     description: "Converge only one component: infra | gateway | codingAgent | azureExecutor | personas | brainSeeds."
   });
-  check = Option31.Boolean("--check", false);
-  yes = Option31.Boolean("--yes", false);
-  skipInfra = Option31.Boolean("--skip-infra", false);
-  forceInfra = Option31.Boolean("--force-infra", false);
-  suffix = Option31.String("--suffix", {
+  check = Option33.Boolean("--check", false);
+  yes = Option33.Boolean("--yes", false);
+  skipInfra = Option33.Boolean("--skip-infra", false);
+  forceInfra = Option33.Boolean("--force-infra", false);
+  suffix = Option33.String("--suffix", {
     description: "Required with --force-infra \u2014 the existing deployment's resource-name suffix (avoids provisioning duplicates)."
   });
-  contentDir = Option31.String("--content-dir", {
+  contentDir = Option33.String("--content-dir", {
     description: "Path to a local m8t repo checkout (skips the tarball fetch + tree-drift check)."
   });
-  manifestUrl = Option31.String("--manifest-url", {
+  manifestUrl = Option33.String("--manifest-url", {
     description: "Fetch the release manifest from this URL instead of the release channel."
   });
-  manifestFile = Option31.String("--manifest-file", {
+  manifestFile = Option33.String("--manifest-file", {
     description: "Read the release manifest from this local file instead of the release channel."
   });
-  endpoint = Option31.String("--endpoint", {
+  endpoint = Option33.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  output = Option31.String("--output");
+  output = Option33.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21494,7 +22017,7 @@ var PlatformUpdateCommand = class extends M8tCommand {
     assertCliVersionOk(manifest, CLI_VERSION, onWarn);
     const stamp = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
     onProgress("resolving release content\u2026");
-    const contentDir = await resolveReleaseContent(manifest, { contentDir: contentDirFlag });
+    const contentDir = await resolveReleaseContentWithAgents(manifest, { contentDir: contentDirFlag });
     const tree = contentDirFlag ? { treeShaOf: () => void 0 } : await fetchRepoTree(manifest.platform.commit);
     if (!contentDirFlag) {
       const mismatches = verifyPersonaTrees(manifest, tree);
@@ -21578,7 +22101,7 @@ var PlatformUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/converge.ts
-import { Command as Command34 } from "clipanion";
+import { Command as Command36 } from "clipanion";
 
 // src/lib/platform-converge-mi.ts
 import { ManagedIdentityCredential } from "@azure/identity";
@@ -21669,15 +22192,15 @@ async function patchApplyRequest(client, mutate) {
 }
 
 // src/lib/platform-self-update.ts
-import * as fs25 from "fs";
-import * as path27 from "path";
+import * as fs30 from "fs";
+import * as path32 from "path";
 function toVTag2(v) {
   return v.startsWith("v") ? v : `v${v}`;
 }
 function readBakedReleaseVersion(repoRoot) {
   if (!repoRoot) return null;
   try {
-    const raw = fs25.readFileSync(path27.join(repoRoot, "installer", "version.json"), "utf8");
+    const raw = fs30.readFileSync(path32.join(repoRoot, "installer", "version.json"), "utf8");
     const v = JSON.parse(raw).version;
     return typeof v === "string" && v.length > 0 ? v : null;
   } catch {
@@ -21882,7 +22405,7 @@ async function failIfStillInFlight(client, now, error) {
 }
 var PlatformConvergeCommand = class extends M8tCommand {
   static paths = [["platform", "converge"]];
-  static usage = Command34.Usage({
+  static usage = Command36.Usage({
     category: "Platform",
     description: "Headless updater-job driver: claim a pending apply-request and converge the platform to it.",
     details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the converge engine behind the health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
@@ -21964,7 +22487,7 @@ var PlatformConvergeCommand = class extends M8tCommand {
         interactive: false,
         endpoint: ctx.endpoint
       });
-      const contentDir = await resolveReleaseContent(manifest, repoRoot ? { contentDir: repoRoot } : {});
+      const contentDir = await resolveReleaseContentWithAgents(manifest, repoRoot ? { contentDir: repoRoot } : {});
       const tree = manifest.components.infra?.treeSha ? { treeShaOf: () => void 0 } : await fetchRepoTree(manifest.platform.commit);
       const suffix = await this.recoverSuffix(ctx);
       const gatewayResourceId = await this.resolveGatewayResourceId(ctx, suffix);
@@ -22097,8 +22620,8 @@ function targetManifestSource(ctx, target) {
 }
 
 // src/commands/platform/seed-stamp.ts
-import { readFileSync as readFileSync18 } from "fs";
-import { Command as Command35, Option as Option32 } from "clipanion";
+import { readFileSync as readFileSync21 } from "fs";
+import { Command as Command37, Option as Option34 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential18, ManagedIdentityCredential as ManagedIdentityCredential2 } from "@azure/identity";
 init_errors();
 
@@ -22184,7 +22707,7 @@ function buildSeedStamp(d, cliVersion, nowIso) {
 
 // src/commands/platform/seed-stamp.ts
 async function seedStamp2(args) {
-  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync18(p, "utf8"));
+  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync21(p, "utf8"));
   const readStampImpl = args.readStampImpl ?? readStamp;
   const writeStampImpl = args.writeStampImpl ?? ((stamp2, o) => writeStamp({ ...o, stamp: stamp2 }));
   const discoverImpl = args.discoverImpl ?? discoverStampStorage;
@@ -22230,15 +22753,15 @@ async function seedStamp2(args) {
 }
 var PlatformSeedStampCommand = class extends M8tCommand {
   static paths = [["platform", "seed-stamp"]];
-  static usage = Command35.Usage({
+  static usage = Command37.Usage({
     description: "INTERNAL: write the initial installed-state stamp from a build-time install descriptor.",
     details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
   });
-  descriptor = Option32.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
-  subscription = Option32.String("--subscription");
-  resourceGroup = Option32.String("--resource-group");
-  miClientId = Option32.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
-  output = Option32.String("--output");
+  descriptor = Option34.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
+  subscription = Option34.String("--subscription");
+  resourceGroup = Option34.String("--resource-group");
+  miClientId = Option34.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option34.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -22270,7 +22793,7 @@ var PlatformSeedStampCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/stamp-build.ts
-import { Command as Command36, Option as Option33 } from "clipanion";
+import { Command as Command38, Option as Option35 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential19, ManagedIdentityCredential as ManagedIdentityCredential3 } from "@azure/identity";
 init_errors();
 
@@ -22304,17 +22827,17 @@ function buildRunningBuildStamp(input) {
 // src/commands/platform/stamp-build.ts
 var PlatformStampBuildCommand = class extends M8tCommand {
   static paths = [["platform", "stamp-build"]];
-  static usage = Command36.Usage({
+  static usage = Command38.Usage({
     description: "Record the currently running build as this install's platform version.",
     details: "For installs that are deployed continuously rather than from a published release. Unlike the install-time record, this overwrites on every run \u2014 the running build is the truth. Only components this writer deploys are reported; the rest are marked as managed elsewhere."
   });
-  version = Option33.String("--version", { description: "The running build's own version, bare X.Y.Z." });
-  gatewayTag = Option33.String("--gateway-tag", { description: "The tag of the gateway image this build deployed." });
-  gatewayDigest = Option33.String("--gateway-digest", { description: "The digest of the gateway image this build deployed." });
-  subscription = Option33.String("--subscription");
-  resourceGroup = Option33.String("--resource-group");
-  miClientId = Option33.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
-  output = Option33.String("--output");
+  version = Option35.String("--version", { description: "The running build's own version, bare X.Y.Z." });
+  gatewayTag = Option35.String("--gateway-tag", { description: "The tag of the gateway image this build deployed." });
+  gatewayDigest = Option35.String("--gateway-digest", { description: "The digest of the gateway image this build deployed." });
+  subscription = Option35.String("--subscription");
+  resourceGroup = Option35.String("--resource-group");
+  miClientId = Option35.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option35.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -22366,7 +22889,7 @@ var PlatformStampBuildCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/policy.ts
-import { Command as Command37, Option as Option34 } from "clipanion";
+import { Command as Command39, Option as Option36 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential20, ManagedIdentityCredential as ManagedIdentityCredential4 } from "@azure/identity";
 init_errors();
 
@@ -22422,16 +22945,16 @@ async function readPolicy(opts) {
 // src/commands/platform/policy.ts
 var PlatformPolicyCommand = class extends M8tCommand {
   static paths = [["platform", "policy"]];
-  static usage = Command37.Usage({
+  static usage = Command39.Usage({
     description: "Show or set how this install handles available platform updates.",
     details: "Modes: 'notify-only' shows updates but never applies them; 'auto-critical' (the default when unset) applies critical releases without asking; 'auto-all' applies every release. Use 'notify-only' where something else already controls what is deployed.",
     examples: [["Show the current mode", "m8t platform policy"], ["Never apply automatically", "m8t platform policy --set notify-only"]]
   });
-  set = Option34.String("--set", { description: "notify-only | auto-critical | auto-all" });
-  subscription = Option34.String("--subscription");
-  resourceGroup = Option34.String("--resource-group");
-  miClientId = Option34.String("--mi-client-id");
-  output = Option34.String("--output");
+  set = Option36.String("--set", { description: "notify-only | auto-critical | auto-all" });
+  subscription = Option36.String("--subscription");
+  resourceGroup = Option36.String("--resource-group");
+  miClientId = Option36.String("--mi-client-id");
+  output = Option36.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -22477,7 +23000,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-cost-report.ts
-import { Command as Command38, Option as Option35 } from "clipanion";
+import { Command as Command40, Option as Option37 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -22517,18 +23040,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command38.Usage({
+  static usage = Command40.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option35.String("--subscription");
-  resourceGroup = Option35.String("--resource-group", {
+  subscription = Option37.String("--subscription");
+  resourceGroup = Option37.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option35.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option35.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option35.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option35.String("--output");
+  acsEndpoint = Option37.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option37.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option37.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option37.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22602,45 +23125,45 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command39, Option as Option36 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command39.Usage({
+  static usage = Command41.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option36.String("--subscription");
-  resourceGroup = Option36.String("--resource-group", {
+  subscription = Option38.String("--subscription");
+  resourceGroup = Option38.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option36.String("--suffix", {
+  suffix = Option38.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option36.String("--installer-image", {
+  installerImage = Option38.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option36.String("--update-cron", {
+  updateCron = Option38.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option36.String("--channel-url", {
+  channelUrl = Option38.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option36.String("--location", {
+  location = Option38.String("--location", {
     description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
   });
-  foundryTracing = Option36.String("--foundry-tracing", {
+  foundryTracing = Option38.String("--foundry-tracing", {
     description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
   });
-  endpoint = Option36.String("--endpoint", {
+  endpoint = Option38.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option36.Boolean("--yes", false);
-  output = Option36.String("--output");
+  yes = Option38.Boolean("--yes", false);
+  output = Option38.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22777,7 +23300,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command40, Option as Option37 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
@@ -23062,7 +23585,7 @@ async function patchRedirectUris(appObjectId, fqdn) {
 init_errors();
 
 // src/lib/whatif.ts
-import * as path28 from "path";
+import * as path33 from "path";
 
 // src/lib/identifier-patterns.ts
 var IDENTIFIER_PATTERNS = [
@@ -23118,7 +23641,7 @@ function deriveResourceType(resourceId) {
   return parts.join("/");
 }
 async function runWhatIf(opts) {
-  const bicepPath = path28.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path33.join(opts.repoRoot, "deploy", "main.bicep");
   const out = await runAz([
     "deployment",
     "group",
@@ -23216,9 +23739,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path43 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path43));
-    else out.push({ ...d, path: path43 });
+    const path48 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path48));
+    else out.push({ ...d, path: path48 });
   }
   return out;
 }
@@ -23268,52 +23791,52 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command40.Usage({
+  static usage = Command42.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option37.String("--subscription");
-  resourceGroup = Option37.String("--resource-group", "rg-m8t-stack");
-  location = Option37.String("--location", "eastus");
-  suffix = Option37.String("--suffix", "");
-  imageRef = Option37.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option37.String("--acrpull-identity");
-  acrResourceId = Option37.String("--acr-resource-id");
-  foundryEndpoint = Option37.String("--foundry-endpoint");
-  foundryResourceId = Option37.String("--foundry-resource-id");
-  foundryTracing = Option37.String("--foundry-tracing");
+  subscription = Option39.String("--subscription");
+  resourceGroup = Option39.String("--resource-group", "rg-m8t-stack");
+  location = Option39.String("--location", "eastus");
+  suffix = Option39.String("--suffix", "");
+  imageRef = Option39.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option39.String("--acrpull-identity");
+  acrResourceId = Option39.String("--acr-resource-id");
+  foundryEndpoint = Option39.String("--foundry-endpoint");
+  foundryResourceId = Option39.String("--foundry-resource-id");
+  foundryTracing = Option39.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option37.String("--client-id");
-  whatIf = Option37.Boolean("--what-if", false);
+  clientId = Option39.String("--client-id");
+  whatIf = Option39.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option37.Boolean("--redact", false);
-  output = Option37.String("--output");
+  redact = Option39.Boolean("--redact", false);
+  output = Option39.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option37.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option39.String("--assign-subscription-roles");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option37.String("--gateway-cpu");
-  gatewayMemory = Option37.String("--gateway-memory");
-  refereeEnabled = Option37.String("--referee-enabled");
-  refereeBrainRepos = Option37.String("--referee-brain-repos");
-  refereeFeedRepo = Option37.String("--referee-feed-repo");
-  refereeInstallationId = Option37.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option37.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option37.String("--exam-kv-uri");
-  examLaWorkspaceId = Option37.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option37.String("--brain-eval-deployment");
-  brainAppLogin = Option37.String("--brain-app-login");
-  refereeCheckpointDir = Option37.String("--referee-checkpoint-dir");
-  examApiBase = Option37.String("--exam-api-base");
+  gatewayCpu = Option39.String("--gateway-cpu");
+  gatewayMemory = Option39.String("--gateway-memory");
+  refereeEnabled = Option39.String("--referee-enabled");
+  refereeBrainRepos = Option39.String("--referee-brain-repos");
+  refereeFeedRepo = Option39.String("--referee-feed-repo");
+  refereeInstallationId = Option39.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option39.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option39.String("--exam-kv-uri");
+  examLaWorkspaceId = Option39.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option39.String("--brain-eval-deployment");
+  brainAppLogin = Option39.String("--brain-app-login");
+  refereeCheckpointDir = Option39.String("--referee-checkpoint-dir");
+  examApiBase = Option39.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23492,7 +24015,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command43, Option as Option40 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -23517,14 +24040,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command41.Usage({
+  static usage = Command43.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option38.String();
-  skillsDir = Option38.String("--skills-dir");
-  noJudge = Option38.Boolean("--no-judge", false);
-  deployment = Option38.String("--deployment");
-  output = Option38.String("--output");
+  candidate = Option40.String();
+  skillsDir = Option40.String("--skills-dir");
+  noJudge = Option40.Boolean("--no-judge", false);
+  deployment = Option40.String("--deployment");
+  output = Option40.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -23581,9 +24104,9 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync19, existsSync as existsSync16, readdirSync as readdirSync2 } from "fs";
-import { join as join27 } from "path";
-import { Command as Command42, Option as Option39 } from "clipanion";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync22, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
+import { join as join31 } from "path";
+import { Command as Command44, Option as Option41 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -23764,11 +24287,11 @@ function resolveRefereeHome(refereeHomeOut, env) {
   return null;
 }
 function resolveTaskSetDir(base, worker, version) {
-  if (existsSync16(join27(base, version))) return version;
+  if (existsSync20(join31(base, version))) return version;
   const prefixed = `${worker}-${version}`;
-  if (existsSync16(join27(base, prefixed))) return prefixed;
-  if (version === "latest" && existsSync16(base)) {
-    const dirs = readdirSync2(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
+  if (existsSync20(join31(base, prefixed))) return prefixed;
+  if (version === "latest" && existsSync20(base)) {
+    const dirs = readdirSync3(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
     if (dirs.length > 0) return dirs[dirs.length - 1];
   }
   return version;
@@ -23782,11 +24305,11 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
       message: "cannot resolve the referee home to read the sealed-task manifest \u2014 set $REFEREE_HOME (mirroring the Python runner) so the feed can be redacted; refusing to emit a possibly-unredacted feed (Law-1)"
     });
   }
-  const versionDir = resolveTaskSetDir(join27(home, "tasksets", worker), worker, version);
-  const manifestPath = join27(home, "tasksets", worker, versionDir, "manifest.yaml");
+  const versionDir = resolveTaskSetDir(join31(home, "tasksets", worker), worker, version);
+  const manifestPath = join31(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync19(manifestPath, "utf-8");
+    text = readFileSync22(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -23813,24 +24336,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command42.Usage({
+  static usage = Command44.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option39.String();
-  arms = Option39.String("--arms");
-  taskSet = Option39.String("--task-set");
-  examType = Option39.String("--exam-type");
-  skill = Option39.String("--skill");
-  reps = Option39.String("-n,--reps");
-  probes = Option39.String("--probes");
-  pool = Option39.String("--pool");
-  out = Option39.String("--out");
-  dryRun = Option39.Boolean("--dry-run", false);
-  keepArms = Option39.Boolean("--keep-arms", false);
-  allowStub = Option39.Boolean("--allow-stub", false);
-  deployment = Option39.String("--deployment");
-  output = Option39.String("--output");
-  observeWaitS = Option39.String("--observe-wait-s");
+  worker = Option41.String();
+  arms = Option41.String("--arms");
+  taskSet = Option41.String("--task-set");
+  examType = Option41.String("--exam-type");
+  skill = Option41.String("--skill");
+  reps = Option41.String("-n,--reps");
+  probes = Option41.String("--probes");
+  pool = Option41.String("--pool");
+  out = Option41.String("--out");
+  dryRun = Option41.Boolean("--dry-run", false);
+  keepArms = Option41.Boolean("--keep-arms", false);
+  allowStub = Option41.Boolean("--allow-stub", false);
+  deployment = Option41.String("--deployment");
+  output = Option41.String("--output");
+  observeWaitS = Option41.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -23906,10 +24429,10 @@ var EvalExamCommand = class extends M8tCommand {
     const verdict = parseExamVerdict(res.stdout);
     if (out !== void 0) {
       const sealedTaskIds = taskSetVersion ? readSealedTaskIds(taskSetVersion, out) : /* @__PURE__ */ new Set();
-      mkdirSync5(out, { recursive: true });
-      writeFileSync6(join27(out, "verdict.json"), JSON.stringify(verdict, null, 2));
+      mkdirSync6(out, { recursive: true });
+      writeFileSync8(join31(out, "verdict.json"), JSON.stringify(verdict, null, 2));
       const feed = redactForFeed(verdict, sealedTaskIds);
-      writeFileSync6(join27(out, "feed.json"), JSON.stringify(feed, null, 2));
+      writeFileSync8(join31(out, "feed.json"), JSON.stringify(feed, null, 2));
     }
     if (mode === "json") {
       this.context.stdout.write(renderJson(verdict) + "\n");
@@ -23945,10 +24468,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command43.Usage({
+  static usage = Command45.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -23956,8 +24479,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option40.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option40.Boolean("--verbose", false);
+  output = Option42.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option42.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -23988,18 +24511,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command44.Usage({
+  static usage = Command46.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option41.String("--output");
-  verbose = Option41.Boolean("--verbose", false);
-  subscription = Option41.String("--subscription", {
+  output = Option43.String("--output");
+  verbose = Option43.Boolean("--verbose", false);
+  subscription = Option43.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option41.String("--resource-group", {
+  resourceGroup = Option43.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -24064,13 +24587,13 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
 import { spawn as spawn4 } from "child_process";
 function runAzd(args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
@@ -24099,7 +24622,7 @@ function runAzd(args) {
         );
         return;
       }
-      resolve4(Buffer.concat(out).toString("utf8"));
+      resolve6(Buffer.concat(out).toString("utf8"));
     });
   });
 }
@@ -24129,10 +24652,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command45.Usage({
+  static usage = Command47.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option42.String("--output");
+  output = Option44.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24170,11 +24693,11 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
-import * as fs26 from "fs";
-import * as os11 from "os";
-import * as path29 from "path";
+import * as fs31 from "fs";
+import * as os12 from "os";
+import * as path34 from "path";
 
 // src/lib/doctor-checks.ts
 function checkAzSignedIn(az) {
@@ -24653,40 +25176,40 @@ async function resolveAccountLocation(accountId) {
   }
 }
 function probeRepoRoot() {
-  const marker = path29.join(os11.homedir(), ".m8t", "repo-root");
-  if (!fs26.existsSync(marker)) {
+  const marker = path34.join(os12.homedir(), ".m8t", "repo-root");
+  if (!fs31.existsSync(marker)) {
     return { markerExists: false, path: null, isDir: false, isGitCheckout: false };
   }
   let repoPath;
   try {
-    repoPath = fs26.readFileSync(marker, "utf8").trim();
+    repoPath = fs31.readFileSync(marker, "utf8").trim();
   } catch {
     return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   }
   if (!repoPath) return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   let isDir = false;
   try {
-    isDir = fs26.statSync(repoPath).isDirectory();
+    isDir = fs31.statSync(repoPath).isDirectory();
   } catch {
     isDir = false;
   }
-  const isGitCheckout = isDir && fs26.existsSync(path29.join(repoPath, ".git"));
+  const isGitCheckout = isDir && fs31.existsSync(path34.join(repoPath, ".git"));
   return { markerExists: true, path: repoPath, isDir, isGitCheckout };
 }
 function probeLegacyStateDir() {
   return {
-    legacyExists: fs26.existsSync(path29.join(os11.homedir(), ".m8t-stack")),
-    currentExists: fs26.existsSync(path29.join(os11.homedir(), ".m8t"))
+    legacyExists: fs31.existsSync(path34.join(os12.homedir(), ".m8t-stack")),
+    currentExists: fs31.existsSync(path34.join(os12.homedir(), ".m8t"))
   };
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command46.Usage({
+  static usage = Command48.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option43.String("--output");
-  agent = Option43.String("--agent");
-  resourceGroup = Option43.String("--resource-group", {
+  output = Option45.String("--output");
+  agent = Option45.String("--agent");
+  resourceGroup = Option45.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -24822,7 +25345,7 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/prereqs.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 init_errors();
 
 // src/lib/prereq-deps.ts
@@ -25528,7 +26051,7 @@ function renderVerdict(v) {
 }
 var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
-  static usage = Command47.Usage({
+  static usage = Command49.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
     details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
@@ -25539,15 +26062,15 @@ var PrereqsCommand = class extends M8tCommand {
       ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
     ]
   });
-  fix = Option44.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
-  for_ = Option44.String("--for", { description: "UPN or object id of another person. Usage phase only." });
-  phase = Option44.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option44.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
-  model = Option44.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
-  clientId = Option44.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
-  subscription = Option44.String("--subscription");
-  resourceGroup = Option44.String("--resource-group");
-  output = Option44.String("--output");
+  fix = Option46.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option46.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option46.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option46.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
+  model = Option46.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option46.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option46.String("--subscription");
+  resourceGroup = Option46.String("--resource-group");
+  output = Option46.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const json = mode === "json";
@@ -25603,18 +26126,18 @@ var PrereqsCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 
 // src/lib/profiles.ts
-import * as fs27 from "fs/promises";
-import * as path30 from "path";
-import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
+import * as fs32 from "fs/promises";
+import * as path35 from "path";
+import { parse as parseYaml12, stringify as stringifyYaml4 } from "yaml";
 function profilesDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path30.join(home, ".m8t", "profiles");
+  return path35.join(home, ".m8t", "profiles");
 }
 function getProfilePath(name) {
-  return path30.join(profilesDir(), `${path30.basename(name)}.yaml`);
+  return path35.join(profilesDir(), `${path35.basename(name)}.yaml`);
 }
 function slugifyTenant(domainOrId) {
   const base = domainOrId.split(".")[0].toLowerCase();
@@ -25623,7 +26146,7 @@ function slugifyTenant(domainOrId) {
 }
 async function listProfiles() {
   try {
-    const entries = await fs27.readdir(profilesDir());
+    const entries = await fs32.readdir(profilesDir());
     return entries.filter((e) => e.endsWith(".yaml")).map((e) => e.replace(/\.yaml$/, "")).sort();
   } catch (e) {
     if (e.code === "ENOENT") return [];
@@ -25632,8 +26155,8 @@ async function listProfiles() {
 }
 async function readProfile(name) {
   try {
-    const raw = await fs27.readFile(getProfilePath(name), "utf8");
-    const parsed = parseYaml11(raw);
+    const raw = await fs32.readFile(getProfilePath(name), "utf8");
+    const parsed = parseYaml12(raw);
     if (!parsed || typeof parsed !== "object") return null;
     return parsed;
   } catch (e) {
@@ -25643,14 +26166,14 @@ async function readProfile(name) {
 }
 async function exists(p) {
   try {
-    await fs27.stat(p);
+    await fs32.stat(p);
     return true;
   } catch {
     return false;
   }
 }
 async function saveProfile(p) {
-  await fs27.mkdir(profilesDir(), { recursive: true });
+  await fs32.mkdir(profilesDir(), { recursive: true });
   let name = p.name;
   let n = 2;
   while (await exists(getProfilePath(name))) {
@@ -25659,8 +26182,8 @@ async function saveProfile(p) {
   }
   const target = getProfilePath(name);
   const tmp = `${target}.tmp`;
-  await fs27.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
-  await fs27.rename(tmp, target);
+  await fs32.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
+  await fs32.rename(tmp, target);
   return name;
 }
 
@@ -25743,14 +26266,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command48.Usage({
+  static usage = Command50.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option45.String({ required: false });
-  subscription = Option45.String("--subscription");
-  list = Option45.Boolean("--list", false);
-  as = Option45.String("--as");
-  output = Option45.String("--output");
+  profile = Option47.String({ required: false });
+  subscription = Option47.String("--subscription");
+  list = Option47.Boolean("--list", false);
+  as = Option47.String("--as");
+  output = Option47.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25807,7 +26330,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -25853,14 +26376,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command49.Usage({
+  static usage = Command51.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option46.String({ required: false });
-  print = Option46.Boolean("--print", false);
-  output = Option46.String("--output");
-  resourceGroup = Option46.String("--resource-group", {
+  target = Option48.String({ required: false });
+  print = Option48.Boolean("--print", false);
+  output = Option48.String("--output");
+  resourceGroup = Option48.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -25904,7 +26427,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -26890,7 +27413,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path43, allowedPrefix) => allowedPrefix.test(path43) && !path43.split("/").includes("..");
+var isAllowedWritePath = (path48, allowedPrefix) => allowedPrefix.test(path48) && !path48.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
@@ -26933,8 +27456,8 @@ function makeGitDataWriter(args) {
   if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
     throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
   }
-  async function gh(token, method, path43, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path43}`, {
+  async function gh(token, method, path48, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path48}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -26947,8 +27470,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path43) {
-    const encodedPath = path43.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path48) {
+    const encodedPath = path48.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -26964,9 +27487,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path43) {
+    async readFile(path48) {
       const token = await args.mintToken();
-      return readFileWith(token, path43);
+      return readFileWith(token, path48);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -26975,9 +27498,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path43 of paths) {
-        const content = await readFileWith(token, path43);
-        out.push({ path: path43, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path48 of paths) {
+        const content = await readFileWith(token, path48);
+        out.push({ path: path48, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -27416,7 +27939,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path43) => originByPath.get(path43) ?? "worker"
+    originOf: (path48) => originByPath.get(path48) ?? "worker"
   };
 }
 
@@ -27437,14 +27960,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path43, message) {
+  constructor(path48, message) {
     super(message);
-    this.path = path43;
+    this.path = path48;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path43) => /(^|\/)[^/]*_index\.md$/.test(path43);
-var isMemoryIndex = (path43) => path43 === "memory/MEMORY.md";
+var isIndexFile = (path48) => /(^|\/)[^/]*_index\.md$/.test(path48);
+var isMemoryIndex = (path48) => path48 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -27461,29 +27984,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path43 = targetPath(delta);
-  if (path43 === null)
+  const path48 = targetPath(delta);
+  if (path48 === null)
     return { ok: true };
-  if (isIndexFile(path43) && !isMemoryIndex(path43)) {
-    return { ok: false, flagged: { kind: "flagged", path: path43, tension: `refused: ${path43} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path48) && !isMemoryIndex(path48)) {
+    return { ok: false, flagged: { kind: "flagged", path: path48, tension: `refused: ${path48} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path43);
-  const isStructural = path43.startsWith("references/");
+  const target = await lookup(path48);
+  const isStructural = path48.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path43, `supersede/retract OLD target ${path43} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path48, `supersede/retract OLD target ${path48} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path43, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path48, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path43) => path43.split("/").includes("..");
+var hasTraversal = (path48) => path48.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -27590,7 +28113,7 @@ ${inject}
 ---
 ` + body.slice(m[0].length);
 }
-var indexLine = (path43, title, date, tags) => `- \`${path43}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path48, title, date, tags) => `- \`${path48}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -27763,16 +28286,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path43) => Promise.resolve(mem.files.find((f) => f.path === path43) ?? null);
+      const lookup = (path48) => Promise.resolve(mem.files.find((f) => f.path === path48) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path43 = checkPathAllowed(delta);
-          if (!path43.ok) {
-            digest.push(path43.rejected);
+          const path48 = checkPathAllowed(delta);
+          if (!path48.ok) {
+            digest.push(path48.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -27986,7 +28509,7 @@ async function emitDigest(input, deps, digest) {
 }
 
 // ../../packages/brain/engine/dist/esm/dream/config.js
-import { parse as parseYaml12 } from "yaml";
+import { parse as parseYaml13 } from "yaml";
 var DEFAULT_DREAM_MODEL = "gpt-5.4";
 function asCadence(v) {
   return v === "nightly" ? "nightly" : "off";
@@ -27994,7 +28517,7 @@ function asCadence(v) {
 function parseDreamerConfig(rawYaml, env) {
   let parsed;
   try {
-    parsed = parseYaml12(rawYaml);
+    parsed = parseYaml13(rawYaml);
   } catch {
     return { enabled: false, cadence: "off", model: env.M8T_DREAM_MODEL ?? DEFAULT_DREAM_MODEL };
   }
@@ -28008,16 +28531,16 @@ function parseDreamerConfig(rawYaml, env) {
 }
 
 // ../../packages/brain/engine/dist/esm/cost-report/config.js
-import { parse as parseYaml13 } from "yaml";
+import { parse as parseYaml14 } from "yaml";
 
 // ../../packages/brain/engine/dist/esm/librarian/codify/persistence-guard.js
 var ZERO_WIDTH_RE = new RegExp("\u200B|\u200C|\u200D|\uFEFF", "g");
 
 // ../../packages/brain/engine/dist/esm/librarian/janitor/frontmatter.js
-import { parse as parseYaml14, stringify as stringifyYaml5 } from "yaml";
+import { parse as parseYaml15, stringify as stringifyYaml5 } from "yaml";
 
 // ../../packages/brain/engine/dist/esm/librarian/config.js
-import { parse as parseYaml15 } from "yaml";
+import { parse as parseYaml16 } from "yaml";
 
 // src/lib/dream-discovery.ts
 init_http();
@@ -28131,25 +28654,25 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command50.Usage({
+  static usage = Command52.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
-  worker = Option47.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  worker = Option49.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
   // Opting IN to the side effects, rather than opting out of them. This command's
   // own help has always described a dry run, but the bare invocation used to take
   // the live branch — a real model call and a commit to the brain repo — so anyone
   // acting on `--help` got the opposite of what they read.
-  live = Option47.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
-  dryRun = Option47.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
-  since = Option47.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option47.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option47.Boolean("--show-transcripts", false, {
+  live = Option49.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option49.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
+  since = Option49.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option49.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option49.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option47.String("--subscription");
-  endpoint = Option47.String("--endpoint");
-  output = Option47.String("--output");
+  subscription = Option49.String("--subscription");
+  endpoint = Option49.String("--endpoint");
+  output = Option49.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -28497,13 +29020,13 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function deriveAccountName(subscriptionId) {
-  const h = createHash3("sha256").update(subscriptionId).digest("hex").slice(0, 12);
+  const h = createHash4("sha256").update(subscriptionId).digest("hex").slice(0, 12);
   return `m8t${h}`;
 }
 function assertHostedRegion(location) {
@@ -28566,8 +29089,8 @@ async function ensureAccount(args) {
     );
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    const sep3 = "' failed: ";
-    const stderr = msg.includes(sep3) ? msg.slice(msg.indexOf(sep3) + sep3.length) : msg;
+    const sep4 = "' failed: ";
+    const stderr = msg.includes(sep4) ? msg.slice(msg.indexOf(sep4) + sep4.length) : msg;
     if (/CustomDomainInUse|subdomain name .* is not available|already used by a resource/i.test(stderr)) {
       throw new LocalCliError({
         code: "FOUNDRY_ACCOUNT_SUBDOMAIN_CONFLICT",
@@ -28735,7 +29258,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command51.Usage({
+  static usage = Command53.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -28744,16 +29267,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option48.String("--resource-group");
-  location = Option48.String("--location");
-  account = Option48.String("--account");
-  project = Option48.String("--project", "m8t");
-  model = Option48.String("--model", "gpt-4.1-mini");
-  modelVersion = Option48.String("--model-version", "2025-04-14");
-  capacity = Option48.String("--capacity", "50");
-  subscription = Option48.String("--subscription");
-  skipQuotaCheck = Option48.Boolean("--skip-quota-check", false);
-  output = Option48.String("--output");
+  resourceGroup = Option50.String("--resource-group");
+  location = Option50.String("--location");
+  account = Option50.String("--account");
+  project = Option50.String("--project", "m8t");
+  model = Option50.String("--model", "gpt-4.1-mini");
+  modelVersion = Option50.String("--model-version", "2025-04-14");
+  capacity = Option50.String("--capacity", "50");
+  subscription = Option50.String("--subscription");
+  skipQuotaCheck = Option50.Boolean("--skip-quota-check", false);
+  output = Option50.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -28825,22 +29348,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command52.Usage({
+  static usage = Command54.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option49.String("--endpoint");
-  consecutive = Option49.String("--consecutive", "3");
-  attempts = Option49.String("--attempts", "60");
-  interval = Option49.String("--interval", "5");
-  subscription = Option49.String("--subscription");
-  output = Option49.String("--output");
+  endpoint = Option51.String("--endpoint");
+  consecutive = Option51.String("--consecutive", "3");
+  attempts = Option51.String("--attempts", "60");
+  interval = Option51.String("--interval", "5");
+  subscription = Option51.String("--subscription");
+  output = Option51.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -28874,7 +29397,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -28900,9 +29423,9 @@ var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t rece
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
-function ingestUrl(path43) {
+function ingestUrl(path48) {
   const base = INGEST_BASE_URL.replace(/\/+$/, "");
-  return `${base}${path43.startsWith("/") ? path43 : `/${path43}`}`;
+  return `${base}${path48.startsWith("/") ? path48 : `/${path48}`}`;
 }
 
 // src/commands/bootstrap/preflight.ts
@@ -28926,7 +29449,7 @@ function preflightRenderable(results) {
 }
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command53.Usage({
+  static usage = Command55.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
@@ -28935,9 +29458,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option50.String("--client-id");
-  subscription = Option50.String("--subscription");
-  location = Option50.String("--location", {
+  clientId = Option52.String("--client-id");
+  subscription = Option52.String("--subscription");
+  location = Option52.String("--location", {
     description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
   });
   async executeCommand() {
@@ -29034,10 +29557,10 @@ ${colors.error("  " + why)}
 }
 
 // src/commands/bootstrap/launch.ts
-import * as fs30 from "fs";
-import * as os14 from "os";
-import * as path33 from "path";
-import { Command as Command54, Option as Option51 } from "clipanion";
+import * as fs35 from "fs";
+import * as os15 from "os";
+import * as path38 from "path";
+import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -29192,15 +29715,15 @@ async function kickInstaller(s) {
 }
 
 // src/lib/bootstrap-status.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
-import * as fs28 from "fs/promises";
-import * as os12 from "os";
-import * as path31 from "path";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import * as fs33 from "fs/promises";
+import * as os13 from "os";
+import * as path36 from "path";
 init_errors();
 var STATUS_CONTAINER = "status";
 var STATUS_BLOB = "status.json";
 function deriveStatusSaName(resourceGroup, subscriptionId) {
-  const hex = createHash4("sha256").update(resourceGroup + subscriptionId).digest("hex").slice(0, 12);
+  const hex = createHash5("sha256").update(resourceGroup + subscriptionId).digest("hex").slice(0, 12);
   return `m8tinst${hex}`;
 }
 function statusBlobUrl(saName) {
@@ -29234,7 +29757,7 @@ async function readStatusBlob(opts) {
       cause: e
     });
   }
-  const tmpFile = path31.join(os12.tmpdir(), `m8t-status-${randomUUID2()}.json`);
+  const tmpFile = path36.join(os13.tmpdir(), `m8t-status-${randomUUID2()}.json`);
   try {
     await runAz([
       "storage",
@@ -29253,7 +29776,7 @@ async function readStatusBlob(opts) {
       "--no-progress",
       "--only-show-errors"
     ]);
-    const raw = await fs28.readFile(tmpFile, "utf8");
+    const raw = await fs33.readFile(tmpFile, "utf8");
     return JSON.parse(raw.trim());
   } catch (e) {
     throw new LocalCliError({
@@ -29263,34 +29786,34 @@ async function readStatusBlob(opts) {
       cause: e
     });
   } finally {
-    await fs28.rm(tmpFile, { force: true });
+    await fs33.rm(tmpFile, { force: true });
   }
 }
 
 // src/lib/bootstrap-state.ts
-import * as fs29 from "fs/promises";
-import * as os13 from "os";
-import * as path32 from "path";
+import * as fs34 from "fs/promises";
+import * as os14 from "os";
+import * as path37 from "path";
 function stateDir(home) {
-  return path32.join(home, ".m8t");
+  return path37.join(home, ".m8t");
 }
 function statePath(home) {
-  return path32.join(stateDir(home), "bootstrap.json");
+  return path37.join(stateDir(home), "bootstrap.json");
 }
-async function readBootstrapState(home = os13.homedir()) {
+async function readBootstrapState(home = os14.homedir()) {
   try {
-    const raw = await fs29.readFile(statePath(home), "utf8");
+    const raw = await fs34.readFile(statePath(home), "utf8");
     return JSON.parse(raw);
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
   }
 }
-async function writeBootstrapState(state, home = os13.homedir()) {
-  await fs29.mkdir(stateDir(home), { recursive: true });
+async function writeBootstrapState(state, home = os14.homedir()) {
+  await fs34.mkdir(stateDir(home), { recursive: true });
   const tmp = `${statePath(home)}.tmp`;
-  await fs29.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
-  await fs29.rename(tmp, statePath(home));
+  await fs34.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
+  await fs34.rename(tmp, statePath(home));
 }
 
 // src/lib/bootstrap-occupancy.ts
@@ -29402,12 +29925,12 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.57";
+var DEFAULT_INSTALLER_TAG = "v0.1.58";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command54.Usage({
+  static usage = Command56.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
@@ -29418,26 +29941,26 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option51.String("--location");
-  resourceGroup = Option51.String("--resource-group");
-  clientId = Option51.String("--client-id");
-  subscription = Option51.String("--subscription");
-  installerTag = Option51.String("--installer-tag");
+  location = Option53.String("--location");
+  resourceGroup = Option53.String("--resource-group");
+  clientId = Option53.String("--client-id");
+  subscription = Option53.String("--subscription");
+  installerTag = Option53.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option51.String("--installer-image");
-  gatewayImageRef = Option51.String("--gateway-image-ref");
-  githubAppCreds = Option51.String("--github-app-creds");
-  contactEmail = Option51.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option51.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option53.String("--installer-image");
+  gatewayImageRef = Option53.String("--gateway-image-ref");
+  githubAppCreds = Option53.String("--github-app-creds");
+  contactEmail = Option53.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option53.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option51.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option51.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option51.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option53.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option53.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option53.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -29476,13 +29999,13 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 `);
       return 0;
     }
-    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path33.join(os14.homedir(), ".m8t", "github-app.json");
+    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path38.join(os15.homedir(), ".m8t", "github-app.json");
     const skipBrains = this.noBrains === true;
     const requestedOrg = typeof this.org === "string" ? this.org : void 0;
     let githubApp;
     if (skipBrains) {
       out("installing without brain-backed workers; no GitHub App credentials will be used");
-    } else if (!fs30.existsSync(credsPath)) {
+    } else if (!fs35.existsSync(credsPath)) {
       this.context.stderr.write(buildMissingCredsRefusal(credsPath));
       throw new LocalCliError({
         code: "GITHUB_APP_CREDS_MISSING",
@@ -29492,7 +30015,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     } else {
       let parsed;
       try {
-        parsed = JSON.parse(fs30.readFileSync(credsPath, "utf8"));
+        parsed = JSON.parse(fs35.readFileSync(credsPath, "utf8"));
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_CREDS_INVALID",
@@ -29510,7 +30033,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       }
       let pem;
       try {
-        pem = fs30.readFileSync(parsed.pemPath, "utf8");
+        pem = fs35.readFileSync(parsed.pemPath, "utf8");
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_PEM_MISSING",
@@ -29598,7 +30121,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -29624,15 +30147,15 @@ async function getAciState(opts) {
 }
 
 // src/lib/bootstrap-finalize.ts
-import * as fs34 from "fs/promises";
-import * as os18 from "os";
-import * as path39 from "path";
+import * as fs39 from "fs/promises";
+import * as os19 from "os";
+import * as path44 from "path";
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync22 } from "fs";
-import * as os15 from "os";
-import * as path34 from "path";
+import { closeSync, openSync, readFileSync as readFileSync25 } from "fs";
+import * as os16 from "os";
+import * as path39 from "path";
 init_errors();
 
 // src/lib/onboarding-profile.ts
@@ -30357,9 +30880,9 @@ function composeFounderIdentityNote(id) {
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path34.join(os15.homedir(), ".m8t", "github-app.json");
+  const p = credsPath ?? path39.join(os16.homedir(), ".m8t", "github-app.json");
   try {
-    return JSON.parse(readFileSync22(p, "utf8"));
+    return JSON.parse(readFileSync25(p, "utf8"));
   } catch {
     return null;
   }
@@ -30425,7 +30948,7 @@ function upsertMemoryIndexOnce(existing, line2, targetPath2) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync22(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync25(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -30515,7 +31038,7 @@ async function applyProfileToBrains(args) {
   }
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path34.join(os15.homedir(), ".m8t", "seed-profile.log");
+  const logPath = path39.join(os16.homedir(), ".m8t", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -30589,16 +31112,16 @@ function renderInstallSummary(args) {
 
 // src/lib/companion-install.ts
 import { constants as constants2 } from "fs";
-import * as fs32 from "fs/promises";
-import * as path36 from "path";
+import * as fs37 from "fs/promises";
+import * as path41 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import { execFile, spawn as spawn7 } from "child_process";
 
 // src/lib/companion-artifact.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { constants } from "fs";
-import * as fs31 from "fs/promises";
-import * as path35 from "path";
+import * as fs36 from "fs/promises";
+import * as path40 from "path";
 var SHA256 = /^[a-f0-9]{64}$/u;
 var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u;
 function exactKeys(value, expected) {
@@ -30606,23 +31129,23 @@ function exactKeys(value, expected) {
   return actual.length === expected.length && actual.every((key2, index) => key2 === [...expected].sort()[index]);
 }
 function normalizedRelative(value) {
-  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path35.posix.isAbsolute(value)) {
+  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path40.posix.isAbsolute(value)) {
     throw new Error("Artifact path must be a normalized relative POSIX path");
   }
-  const normalized = path35.posix.normalize(value);
+  const normalized = path40.posix.normalize(value);
   if (normalized !== value || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     throw new Error("Artifact path escapes the payload root");
   }
   return value;
 }
 function validateLink(entryPath, target) {
-  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path35.posix.isAbsolute(target)) {
+  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path40.posix.isAbsolute(target)) {
     throw new Error("Artifact symlink target must be relative");
   }
-  const resolved = path35.posix.normalize(
-    path35.posix.join(path35.posix.dirname(entryPath), target)
+  const resolved = path40.posix.normalize(
+    path40.posix.join(path40.posix.dirname(entryPath), target)
   );
-  if (resolved === ".." || resolved.startsWith("../") || path35.posix.isAbsolute(resolved)) {
+  if (resolved === ".." || resolved.startsWith("../") || path40.posix.isAbsolute(resolved)) {
     throw new Error("Artifact symlink target escapes the payload root");
   }
   return target;
@@ -30633,7 +31156,7 @@ function canonicalEntry(entry) {
 `;
 }
 function artifactTreeSha256(entries) {
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   const ordered = [...entries].sort(
     (left, right) => left.path.localeCompare(right.path)
   );
@@ -30703,19 +31226,19 @@ function parseArtifactManifest(value) {
   };
 }
 async function sha256File2(filePath) {
-  return createHash5("sha256").update(await fs31.readFile(filePath)).digest("hex");
+  return createHash6("sha256").update(await fs36.readFile(filePath)).digest("hex");
 }
-async function walk(root, relative3 = "") {
-  const directory = path35.join(root, ...relative3.split("/").filter(Boolean));
-  const children = await fs31.readdir(directory, { withFileTypes: true });
+async function walk2(root, relative4 = "") {
+  const directory = path40.join(root, ...relative4.split("/").filter(Boolean));
+  const children = await fs36.readdir(directory, { withFileTypes: true });
   const entries = [];
   for (const child of children.sort((left, right) => left.name.localeCompare(right.name))) {
-    const childRelative = relative3 ? `${relative3}/${child.name}` : child.name;
+    const childRelative = relative4 ? `${relative4}/${child.name}` : child.name;
     normalizedRelative(childRelative);
-    const childPath = path35.join(directory, child.name);
-    const stat5 = await fs31.lstat(childPath);
+    const childPath = path40.join(directory, child.name);
+    const stat5 = await fs36.lstat(childPath);
     if (stat5.isDirectory()) {
-      entries.push(...await walk(root, childRelative));
+      entries.push(...await walk2(root, childRelative));
     } else if (stat5.isFile()) {
       entries.push({
         type: "file",
@@ -30725,7 +31248,7 @@ async function walk(root, relative3 = "") {
         sha256: await sha256File2(childPath)
       });
     } else if (stat5.isSymbolicLink()) {
-      const target = await fs31.readlink(childPath);
+      const target = await fs36.readlink(childPath);
       entries.push({
         type: "symlink",
         path: childRelative,
@@ -30738,19 +31261,19 @@ async function walk(root, relative3 = "") {
   return entries;
 }
 async function ensureRealDirectory(root) {
-  const stat5 = await fs31.lstat(root);
+  const stat5 = await fs36.lstat(root);
   if (stat5.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
   if (!stat5.isDirectory()) throw new Error("Artifact root is not a directory");
 }
 async function validateResolvedLinks(root, entries) {
-  const realRoot = await fs31.realpath(root);
+  const realRoot = await fs36.realpath(root);
   for (const entry of entries) {
     if (entry.type !== "symlink") continue;
     try {
-      const linkPath = path35.join(root, ...entry.path.split("/"));
-      const resolved = await fs31.realpath(linkPath);
-      const relative3 = path35.relative(realRoot, resolved);
-      if (relative3 === ".." || relative3.startsWith(`..${path35.sep}`) || path35.isAbsolute(relative3)) {
+      const linkPath = path40.join(root, ...entry.path.split("/"));
+      const resolved = await fs36.realpath(linkPath);
+      const relative4 = path40.relative(realRoot, resolved);
+      if (relative4 === ".." || relative4.startsWith(`..${path40.sep}`) || path40.isAbsolute(relative4)) {
         throw new Error("Artifact symlink chain escapes the payload root");
       }
     } catch (error) {
@@ -30763,7 +31286,7 @@ async function validateResolvedLinks(root, entries) {
 }
 async function buildArtifactManifest(payloadRoot, input) {
   await ensureRealDirectory(payloadRoot);
-  const entries = await walk(payloadRoot);
+  const entries = await walk2(payloadRoot);
   await validateResolvedLinks(payloadRoot, entries);
   const manifest = {
     schemaVersion: 1,
@@ -30780,13 +31303,13 @@ async function buildArtifactManifest(payloadRoot, input) {
   return manifest;
 }
 async function readArtifactManifest(manifestPath) {
-  const before = await fs31.lstat(manifestPath);
+  const before = await fs36.lstat(manifestPath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Artifact manifest is a symbolic link or non-file");
   }
   let handle;
   try {
-    handle = await fs31.open(
+    handle = await fs36.open(
       manifestPath,
       constants.O_RDONLY | constants.O_NOFOLLOW
     );
@@ -30803,16 +31326,16 @@ async function readArtifactManifest(manifestPath) {
   }
 }
 function ensureContainedEntry(root, entryPath) {
-  const absolute = path35.join(root, ...entryPath.split("/"));
-  const relative3 = path35.relative(root, absolute);
-  if (relative3.startsWith("..") || path35.isAbsolute(relative3)) {
+  const absolute = path40.join(root, ...entryPath.split("/"));
+  const relative4 = path40.relative(root, absolute);
+  if (relative4.startsWith("..") || path40.isAbsolute(relative4)) {
     throw new Error("Artifact entry escapes payload root");
   }
   return absolute;
 }
 async function verifyArtifactSource(payloadRoot, manifest) {
   await ensureRealDirectory(payloadRoot);
-  const actual = await walk(payloadRoot);
+  const actual = await walk2(payloadRoot);
   await validateResolvedLinks(payloadRoot, actual);
   const declared = new Map(manifest.entries.map((entry) => [entry.path, entry]));
   for (const entry of actual) {
@@ -30829,7 +31352,7 @@ async function verifyArtifactSource(payloadRoot, manifest) {
 }
 async function verifyArtifactPayload(payloadRoot, manifest) {
   await ensureRealDirectory(payloadRoot);
-  const actual = await walk(payloadRoot);
+  const actual = await walk2(payloadRoot);
   await validateResolvedLinks(payloadRoot, actual);
   if (actual.length !== manifest.entries.length || artifactTreeSha256(actual) !== manifest.treeSha256) {
     throw new Error("Artifact payload digest or size does not match manifest");
@@ -30844,27 +31367,27 @@ async function verifyArtifactPayload(payloadRoot, manifest) {
 async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
   await verifyArtifactSource(sourceRoot, manifest);
   try {
-    const targetStat = await fs31.lstat(targetRoot);
+    const targetStat = await fs36.lstat(targetRoot);
     if (targetStat.isSymbolicLink()) {
       throw new Error("Install target is a symbolic link");
     }
     if (!targetStat.isDirectory()) throw new Error("Install target is not a directory");
-    if ((await fs31.readdir(targetRoot)).length > 0) {
+    if ((await fs36.readdir(targetRoot)).length > 0) {
       throw new Error("Install staging target is not empty");
     }
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
-    await fs31.mkdir(targetRoot, { recursive: false, mode: 448 });
+    await fs36.mkdir(targetRoot, { recursive: false, mode: 448 });
   }
   for (const entry of manifest.entries) {
     const source = ensureContainedEntry(sourceRoot, entry.path);
     const target = ensureContainedEntry(targetRoot, entry.path);
-    await fs31.mkdir(path35.dirname(target), { recursive: true, mode: 448 });
+    await fs36.mkdir(path40.dirname(target), { recursive: true, mode: 448 });
     if (entry.type === "file") {
-      await fs31.copyFile(source, target);
-      await fs31.chmod(target, entry.mode);
+      await fs36.copyFile(source, target);
+      await fs36.chmod(target, entry.mode);
     } else {
-      await fs31.symlink(entry.target, target);
+      await fs36.symlink(entry.target, target);
     }
   }
   await verifyArtifactPayload(targetRoot, manifest);
@@ -30881,39 +31404,39 @@ function commandError(error, message) {
   return wrapped;
 }
 function execFileAsync(file, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     execFile(file, [...args], { windowsHide: true }, (error) => {
       if (error) reject(commandError(error, "Login-item command failed"));
-      else resolve4();
+      else resolve6();
     });
   });
 }
 function execFileOutput(file, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     execFile(
       file,
       [...args],
       { windowsHide: true },
       (error, stdout) => {
         if (error) reject(commandError(error, "Login-item query failed"));
-        else resolve4(stdout);
+        else resolve6(stdout);
       }
     );
   });
 }
 async function setCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const launchAgents = path36.join(input.homeDirectory, "Library", "LaunchAgents");
-    const registration = path36.join(
+    const launchAgents = path41.join(input.homeDirectory, "Library", "LaunchAgents");
+    const registration = path41.join(
       launchAgents,
       "com.m8t.companion.plist"
     );
     await assertNotSymlink(registration, "Start-at-login registration");
     if (!input.enabled) {
-      await fs32.rm(registration, { force: true });
+      await fs37.rm(registration, { force: true });
       return;
     }
-    await fs32.mkdir(launchAgents, { recursive: true, mode: 448 });
+    await fs37.mkdir(launchAgents, { recursive: true, mode: 448 });
     const plist = '<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.m8t.companion</string><key>ProgramArguments</key><array><string>' + xmlEscape(input.executable) + "</string></array><key>RunAtLoad</key><true/></dict></plist>\n";
     await atomicWriteText(registration, plist, 384);
     return;
@@ -30965,7 +31488,7 @@ async function setCompanionStartAtLogin(input) {
 }
 async function getCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const registration = path36.join(
+    const registration = path41.join(
       input.homeDirectory,
       "Library",
       "LaunchAgents",
@@ -31027,26 +31550,26 @@ function assertSupported(options) {
 }
 function companionInstallPaths(options) {
   assertSupported(options);
-  const companionState = path36.join(
+  const companionState = path41.join(
     options.homeDirectory,
     ".m8t",
     "companion"
   );
-  const targetRoot = options.platform === "darwin" ? path36.join(
+  const targetRoot = options.platform === "darwin" ? path41.join(
     options.homeDirectory,
     "Applications",
     "m8t Companion.app"
-  ) : path36.join(
-    options.localAppData ?? path36.join(options.homeDirectory, "AppData", "Local"),
+  ) : path41.join(
+    options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local"),
     "m8t",
     "companion",
     "app"
   );
   return {
     targetRoot,
-    installManifest: path36.join(companionState, "install-v1.json"),
-    runtimeBinding: path36.join(companionState, "runtime-v1.json"),
-    preferences: path36.join(companionState, "preferences-v1.json")
+    installManifest: path41.join(companionState, "install-v1.json"),
+    runtimeBinding: path41.join(companionState, "runtime-v1.json"),
+    preferences: path41.join(companionState, "preferences-v1.json")
   };
 }
 function exactKeys2(value, keys) {
@@ -31057,7 +31580,7 @@ function parseInstallManifest(value) {
     throw new Error("Install manifest schema is invalid");
   }
   const record = value;
-  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path36.isAbsolute(record.ownedTargetRoot)) {
+  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path41.isAbsolute(record.ownedTargetRoot)) {
     throw new Error("Install manifest schema is invalid");
   }
   return record;
@@ -31067,7 +31590,7 @@ function parseRuntimeBinding(value, platform) {
     throw new Error("Runtime binding schema is invalid");
   }
   const record = value;
-  const paths = platform === "win32" ? path36.win32 : path36.posix;
+  const paths = platform === "win32" ? path41.win32 : path41.posix;
   if (!exactKeys2(record, RUNTIME_KEYS) || record.schemaVersion !== 1 || typeof record.nodeExecutable !== "string" || !paths.isAbsolute(record.nodeExecutable) || typeof record.cliEntry !== "string" || !paths.isAbsolute(record.cliEntry) || typeof record.gatewayOrigin !== "string") {
     throw new Error("Runtime binding schema is invalid");
   }
@@ -31092,7 +31615,7 @@ function validateGatewayOrigin(value) {
 }
 async function assertNotSymlink(filePath, kind) {
   try {
-    if ((await fs32.lstat(filePath)).isSymbolicLink()) {
+    if ((await fs37.lstat(filePath)).isSymbolicLink()) {
       throw new Error(`${kind} is a symbolic link`);
     }
   } catch (error) {
@@ -31101,20 +31624,20 @@ async function assertNotSymlink(filePath, kind) {
   }
 }
 async function assertOwnedDirectoryChain(anchor, targetDirectory) {
-  const relative3 = path36.relative(anchor, targetDirectory);
-  if (relative3 === ".." || relative3.startsWith(`..${path36.sep}`) || path36.isAbsolute(relative3)) {
+  const relative4 = path41.relative(anchor, targetDirectory);
+  if (relative4 === ".." || relative4.startsWith(`..${path41.sep}`) || path41.isAbsolute(relative4)) {
     throw new Error("Companion owned directory escapes its trusted anchor");
   }
-  const segments = relative3.split(path36.sep).filter(Boolean);
+  const segments = relative4.split(path41.sep).filter(Boolean);
   let current = anchor;
-  const anchorStatus = await fs32.lstat(anchor);
+  const anchorStatus = await fs37.lstat(anchor);
   if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
     throw new Error("Companion owned directory anchor is unsafe");
   }
   for (const segment of segments) {
-    current = path36.join(current, segment);
+    current = path41.join(current, segment);
     try {
-      const status = await fs32.lstat(current);
+      const status = await fs37.lstat(current);
       if (status.isSymbolicLink() || !status.isDirectory()) {
         throw new Error("Companion owned directory contains a symbolic link");
       }
@@ -31127,19 +31650,19 @@ async function assertOwnedDirectoryChain(anchor, targetDirectory) {
 async function assertOwnedParents(options, paths) {
   await assertOwnedDirectoryChain(
     options.homeDirectory,
-    path36.dirname(paths.installManifest)
+    path41.dirname(paths.installManifest)
   );
-  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path36.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
-  await assertOwnedDirectoryChain(targetAnchor, path36.dirname(paths.targetRoot));
+  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
+  await assertOwnedDirectoryChain(targetAnchor, path41.dirname(paths.targetRoot));
 }
 async function readRegularText(filePath, maxBytes) {
-  const before = await fs32.lstat(filePath);
+  const before = await fs37.lstat(filePath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Companion state file is not a regular file");
   }
   let handle;
   try {
-    handle = await fs32.open(
+    handle = await fs37.open(
       filePath,
       constants2.O_RDONLY | constants2.O_NOFOLLOW
     );
@@ -31162,27 +31685,27 @@ async function atomicWriteJson(filePath, value) {
 }
 async function atomicWriteText(filePath, contents, mode) {
   await assertNotSymlink(filePath, "Companion state file");
-  await fs32.mkdir(path36.dirname(filePath), {
+  await fs37.mkdir(path41.dirname(filePath), {
     recursive: true,
     mode: 448
   });
   const temporary = `${filePath}.${randomUUID3()}.tmp`;
   try {
-    await fs32.writeFile(temporary, contents, {
+    await fs37.writeFile(temporary, contents, {
       mode,
       flag: "wx"
     });
-    await fs32.rename(temporary, filePath);
-    await fs32.chmod(filePath, mode).catch(() => void 0);
+    await fs37.rename(temporary, filePath);
+    await fs37.chmod(filePath, mode).catch(() => void 0);
   } finally {
-    await fs32.rm(temporary, { force: true }).catch(() => void 0);
+    await fs37.rm(temporary, { force: true }).catch(() => void 0);
   }
 }
 async function realRegularFile(filePath, executable) {
-  const real = await fs32.realpath(filePath);
-  const stat5 = await fs32.stat(real);
+  const real = await fs37.realpath(filePath);
+  const stat5 = await fs37.stat(real);
   if (!stat5.isFile()) throw new Error("Companion launch target is not a file");
-  await fs32.access(real, executable ? constants2.X_OK : constants2.R_OK);
+  await fs37.access(real, executable ? constants2.X_OK : constants2.R_OK);
   return real;
 }
 function defaultLaunch(executable) {
@@ -31198,7 +31721,7 @@ async function companionIsRunning(platform, executable) {
   if (platform !== "win32") return false;
   let handle;
   try {
-    handle = await fs32.open(executable, "r+");
+    handle = await fs37.open(executable, "r+");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return false;
@@ -31279,7 +31802,7 @@ async function statusCompanion(options) {
       realRegularFile(runtime.nodeExecutable, options.platform !== "win32"),
       realRegularFile(runtime.cliEntry, false)
     ]);
-    const executable = path36.join(
+    const executable = path41.join(
       paths.targetRoot,
       ...install.entryRelativePath.split("/")
     );
@@ -31312,7 +31835,7 @@ async function snapshotFile(filePath) {
 }
 async function restoreFile(filePath, bytes) {
   if (bytes === null) {
-    await fs32.rm(filePath, { force: true });
+    await fs37.rm(filePath, { force: true });
   } else {
     await atomicWriteJson(filePath, JSON.parse(bytes.toString("utf8")));
   }
@@ -31327,8 +31850,8 @@ async function converge(options, force) {
   if (artifactManifest.platform !== options.platform || artifactManifest.architecture !== options.architecture) {
     throw new Error("Companion artifact does not match this OS and architecture");
   }
-  const payloadRoot = path36.join(
-    path36.dirname(options.artifactManifestPath),
+  const payloadRoot = path41.join(
+    path41.dirname(options.artifactManifestPath),
     "payload"
   );
   await verifyArtifactSource(payloadRoot, artifactManifest);
@@ -31348,7 +31871,7 @@ async function converge(options, force) {
   if (priorInstalled) {
     await assertCompanionNotRunning(
       options,
-      path36.join(
+      path41.join(
         priorInstalled.paths.targetRoot,
         ...priorInstalled.install.entryRelativePath.split("/")
       )
@@ -31356,7 +31879,7 @@ async function converge(options, force) {
   }
   if (current.state === "not-installed") {
     try {
-      await fs32.lstat(paths.targetRoot);
+      await fs37.lstat(paths.targetRoot);
       throw new Error(
         "The fixed companion target exists without an owned install manifest"
       );
@@ -31367,7 +31890,7 @@ async function converge(options, force) {
   const stage = `${paths.targetRoot}.m8t-stage-${randomUUID3()}`;
   const backup = `${paths.targetRoot}.m8t-backup-${randomUUID3()}`;
   const copy = options.copyPayload ?? copyArtifactPayload;
-  await fs32.mkdir(path36.dirname(paths.targetRoot), {
+  await fs37.mkdir(path41.dirname(paths.targetRoot), {
     recursive: true,
     mode: 448
   });
@@ -31384,12 +31907,12 @@ async function converge(options, force) {
   try {
     await copy(payloadRoot, stage, artifactManifest);
     try {
-      await fs32.rename(paths.targetRoot, backup);
+      await fs37.rename(paths.targetRoot, backup);
       movedPrior = true;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    await fs32.rename(stage, paths.targetRoot);
+    await fs37.rename(stage, paths.targetRoot);
     installedStage = true;
     const nodeExecutable = await realRegularFile(
       options.nodeExecutable,
@@ -31431,7 +31954,7 @@ async function converge(options, force) {
       await readClosedJson(paths.runtimeBinding),
       options.platform
     );
-    const executable = path36.join(
+    const executable = path41.join(
       paths.targetRoot,
       ...artifactManifest.entryRelativePath.split("/")
     );
@@ -31441,7 +31964,7 @@ async function converge(options, force) {
       platform: options.platform,
       executable: ownedExecutable
     }));
-    priorLoginExecutable = priorInstalled ? path36.join(
+    priorLoginExecutable = priorInstalled ? path41.join(
       priorInstalled.paths.targetRoot,
       ...priorInstalled.install.entryRelativePath.split("/")
     ) : executable;
@@ -31452,7 +31975,7 @@ async function converge(options, force) {
     );
     loginChanged = true;
     await (options.launch ?? defaultLaunch)(executable);
-    await fs32.rm(backup, { recursive: true, force: true });
+    await fs37.rm(backup, { recursive: true, force: true });
     return {
       state: "installed",
       version: artifactManifest.version,
@@ -31466,15 +31989,15 @@ async function converge(options, force) {
         () => void 0
       );
     }
-    await fs32.rm(stage, { recursive: true, force: true }).catch(() => void 0);
+    await fs37.rm(stage, { recursive: true, force: true }).catch(() => void 0);
     if (installedStage) {
-      await fs32.rm(paths.targetRoot, {
+      await fs37.rm(paths.targetRoot, {
         recursive: true,
         force: true
       }).catch(() => void 0);
     }
     if (movedPrior) {
-      await fs32.rename(backup, paths.targetRoot).catch(() => void 0);
+      await fs37.rename(backup, paths.targetRoot).catch(() => void 0);
     }
     await Promise.all([
       restoreFile(paths.installManifest, snapshots[0]),
@@ -31500,14 +32023,14 @@ async function uninstallCompanion(options) {
   if (install.ownedTargetRoot !== paths.targetRoot) {
     throw new Error("Refusing to remove a non-owned companion target");
   }
-  const executable = path36.join(
+  const executable = path41.join(
     paths.targetRoot,
     ...install.entryRelativePath.split("/")
   );
   await assertCompanionNotRunning(options, executable);
   await (options.setStartAtLogin ?? (() => Promise.resolve()))(executable, false);
   const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
-    await fs32.rm(ownedPath, { recursive, force: true });
+    await fs37.rm(ownedPath, { recursive, force: true });
   });
   await remove(paths.targetRoot, true);
   await remove(paths.installManifest, false);
@@ -31517,9 +32040,9 @@ async function uninstallCompanion(options) {
 }
 
 // src/commands/companion/install.ts
-import * as os17 from "os";
-import * as path38 from "path";
-import { Command as Command55, Option as Option52 } from "clipanion";
+import * as os18 from "os";
+import * as path43 from "path";
+import { Command as Command57, Option as Option54 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -31534,18 +32057,18 @@ async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps =
 }
 
 // src/lib/companion-download.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { execFile as execFile2 } from "child_process";
-import * as fs33 from "fs/promises";
-import * as os16 from "os";
-import * as path37 from "path";
+import * as fs38 from "fs/promises";
+import * as os17 from "os";
+import * as path42 from "path";
 init_errors();
 var MAX_ASSET_BYTES = 512 * 1024 * 1024;
 function extractArchive(archive, into) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     execFile2("tar", ["-xzf", archive, "-C", into], { windowsHide: true }, (error) => {
       if (error) reject(new Error(`Could not unpack the companion build: ${error.message}`));
-      else resolve4();
+      else resolve6();
     });
   });
 }
@@ -31583,7 +32106,7 @@ async function downloadCompanionArtifact(component, deps = {}) {
       message: `${pinned.asset} is larger than this command will accept.`
     });
   }
-  const digest = createHash6("sha256").update(bytes).digest("hex");
+  const digest = createHash7("sha256").update(bytes).digest("hex");
   if (digest !== pinned.sha256) {
     throw new LocalCliError({
       code: "COMPANION_ASSET_DIGEST_MISMATCH",
@@ -31591,20 +32114,20 @@ async function downloadCompanionArtifact(component, deps = {}) {
       hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
     });
   }
-  const root = await (deps.makeTemporaryDirectory ?? (() => fs33.mkdtemp(path37.join(os16.tmpdir(), "m8t-companion-"))))();
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs38.mkdtemp(path42.join(os17.tmpdir(), "m8t-companion-"))))();
   const dispose = async () => {
-    await fs33.rm(root, { recursive: true, force: true }).catch(() => void 0);
+    await fs38.rm(root, { recursive: true, force: true }).catch(() => void 0);
   };
   try {
-    const archive = path37.join(root, pinned.asset);
-    await fs33.writeFile(archive, bytes, { mode: 384 });
-    const unpacked = path37.join(root, "unpacked");
-    await fs33.mkdir(unpacked, { recursive: false, mode: 448 });
+    const archive = path42.join(root, pinned.asset);
+    await fs38.writeFile(archive, bytes, { mode: 384 });
+    const unpacked = path42.join(root, "unpacked");
+    await fs38.mkdir(unpacked, { recursive: false, mode: 448 });
     await (deps.extract ?? extractArchive)(archive, unpacked);
-    await fs33.rm(archive, { force: true });
+    await fs38.rm(archive, { force: true });
     return {
       version: component.version,
-      artifactManifestPath: path37.join(unpacked, "artifact-v1.json"),
+      artifactManifestPath: path42.join(unpacked, "artifact-v1.json"),
       dispose
     };
   } catch (error) {
@@ -31617,7 +32140,7 @@ async function downloadCompanionArtifact(component, deps = {}) {
 function defaultLocalCompanionInstallOptions() {
   const cliEntry = process.argv[1];
   if (!cliEntry) throw new Error("Cannot resolve the installed CLI entry");
-  const homeDirectory = os17.homedir();
+  const homeDirectory = os18.homedir();
   const platform = process.platform;
   return {
     homeDirectory,
@@ -31635,7 +32158,7 @@ async function convergeCompanionFromChannel(converge2, options = {}) {
   let artifactManifestPath;
   let dispose = () => Promise.resolve();
   if (stagedDirectory !== void 0) {
-    artifactManifestPath = path38.resolve(stagedDirectory, "artifact-v1.json");
+    artifactManifestPath = path43.resolve(stagedDirectory, "artifact-v1.json");
   } else {
     const release = await readCompanionRelease(
       platformVersion !== void 0 ? { channel: true, version: platformTag(platformVersion) } : { url: CHANNEL_LATEST_URL }
@@ -31677,7 +32200,7 @@ Version: ${state.version}
 }
 var CompanionInstallCommand = class extends M8tCommand {
   static paths = [["companion", "install"]];
-  static usage = Command55.Usage({
+  static usage = Command57.Usage({
     description: "Install the desktop companions for this user from the release channel.",
     examples: [
       ["Install the released build", "$0 companion install"],
@@ -31687,10 +32210,10 @@ var CompanionInstallCommand = class extends M8tCommand {
       ]
     ]
   });
-  from = Option52.String("--from", {
+  from = Option54.String("--from", {
     description: "A locally staged build directory instead of the released one."
   });
-  resourceGroup = Option52.String("--resource-group", {
+  resourceGroup = Option54.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -31713,7 +32236,7 @@ function resolveRepoRootMarker(args) {
 }
 async function looksLikeCheckout(dir) {
   try {
-    return (await fs34.stat(path39.join(dir, "brain-template"))).isDirectory();
+    return (await fs39.stat(path44.join(dir, "brain-template"))).isDirectory();
   } catch {
     return false;
   }
@@ -31729,21 +32252,21 @@ var defaultDeps2 = {
   convergeCompanion: (platformVersion) => convergeCompanionFromChannel(installCompanion, {
     ...platformVersion !== void 0 ? { platformVersion } : {}
   }),
-  homedir: () => os18.homedir()
+  homedir: () => os19.homedir()
 };
 async function finalizeInstall(args, deps = defaultDeps2) {
-  const markerDir = path39.join(deps.homedir(), ".m8t");
-  const markerPath = path39.join(markerDir, "repo-root");
+  const markerDir = path44.join(deps.homedir(), ".m8t");
+  const markerPath = path44.join(markerDir, "repo-root");
   const cwd = process.cwd();
-  const existing = await fs34.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
+  const existing = await fs39.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
   const repoRoot = resolveRepoRootMarker({
     ...args.repoRoot !== void 0 ? { explicit: args.repoRoot } : {},
     cwd,
     cwdIsCheckout: await looksLikeCheckout(cwd),
     existing
   });
-  await fs34.mkdir(markerDir, { recursive: true });
-  await fs34.writeFile(markerPath, `${repoRoot}
+  await fs39.mkdir(markerDir, { recursive: true });
+  await fs39.writeFile(markerPath, `${repoRoot}
 `, "utf8");
   let webappUrl;
   try {
@@ -31821,7 +32344,7 @@ async function finalizeInstall(args, deps = defaultDeps2) {
   }
   let brainOrg = null;
   try {
-    const credsRaw = await fs34.readFile(path39.join(markerDir, "github-app.json"), "utf8");
+    const credsRaw = await fs39.readFile(path44.join(markerDir, "github-app.json"), "utf8");
     const creds = JSON.parse(credsRaw);
     brainOrg = typeof creds.org === "string" ? creds.org : null;
   } catch {
@@ -31903,7 +32426,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
   // runbooks and shakedown recipes that a founder may already be part-way
   // through — it prints a deprecation notice and does the right thing.
   static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
-  static usage = Command56.Usage({
+  static usage = Command58.Usage({
     description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
     examples: [
@@ -31912,12 +32435,12 @@ var BootstrapStatusCommand = class extends M8tCommand {
       ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
     ]
   });
-  watch = Option53.Boolean("--watch", false);
-  output = Option53.String("--output");
-  repoRoot = Option53.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
-  finalize = Option53.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
-  subscription = Option53.String("--subscription");
-  resourceGroup = Option53.String("--resource-group");
+  watch = Option55.Boolean("--watch", false);
+  output = Option55.String("--output");
+  repoRoot = Option55.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option55.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option55.String("--subscription");
+  resourceGroup = Option55.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -32050,7 +32573,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -32144,7 +32667,7 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command57.Usage({
+  static usage = Command59.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
@@ -32154,9 +32677,9 @@ var BootstrapReapCommand = class extends M8tCommand {
       ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  force = Option54.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
-  sweepOrphans = Option54.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
-  yes = Option54.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
+  force = Option56.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option56.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option56.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -32250,18 +32773,18 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import * as fs36 from "fs";
-import * as os20 from "os";
-import * as path41 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
+import * as fs41 from "fs";
+import * as os21 from "os";
+import * as path46 from "path";
+import { Command as Command60, Option as Option57 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
-import * as fs35 from "fs";
+import * as fs40 from "fs";
 import * as net from "net";
-import * as os19 from "os";
-import * as path40 from "path";
+import * as os20 from "os";
+import * as path45 from "path";
 import { randomBytes as randomBytes3 } from "crypto";
 import { spawn as spawn8, spawnSync as spawnSync6 } from "child_process";
 init_errors();
@@ -32319,7 +32842,7 @@ async function deployIntakeAgent(args) {
 
 // src/lib/bootstrap-ui.ts
 function sleep3(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function isAuthorizationShapedError(error) {
   const seen = /* @__PURE__ */ new Set();
@@ -32459,11 +32982,11 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path40.join(args.repoRoot, "apps", "web", ".env.local");
+  const envPath = path45.join(args.repoRoot, "apps", "web", ".env.local");
   let prior = "";
-  if (fs35.existsSync(envPath)) {
-    prior = fs35.readFileSync(envPath, "utf8");
-    fs35.copyFileSync(envPath, envPath + ".bak");
+  if (fs40.existsSync(envPath)) {
+    prior = fs40.readFileSync(envPath, "utf8");
+    fs40.copyFileSync(envPath, envPath + ".bak");
   }
   const priorSecret = readValidInternalSecret(prior);
   const internalSecret = priorSecret ?? (args.randomBytesImpl ?? randomBytes3)(32).toString("base64url");
@@ -32489,9 +33012,9 @@ function writeWebEnvLocal(args) {
     "NEXT_PUBLIC_M8T_ONBOARDING=1",
     ""
   ].join("\n");
-  fs35.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
+  fs40.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
   try {
-    fs35.chmodSync(envPath, 384);
+    fs40.chmodSync(envPath, 384);
   } catch {
   }
   return envPath;
@@ -32507,10 +33030,10 @@ function readValidInternalSecret(envText) {
   return isValidInternalSecret(values[0]) ? values[0] : void 0;
 }
 function readWebInternalSecret(repoRoot) {
-  const envPath = path40.join(repoRoot, "apps", "web", ".env.local");
+  const envPath = path45.join(repoRoot, "apps", "web", ".env.local");
   let secret;
   try {
-    secret = readValidInternalSecret(fs35.readFileSync(envPath, "utf8"));
+    secret = readValidInternalSecret(fs40.readFileSync(envPath, "utf8"));
   } catch {
     secret = void 0;
   }
@@ -32534,14 +33057,14 @@ function assertNodeVersion(versionString = process.version) {
   }
 }
 function runInherit(cmd, cmdArgs, cwd, failCode) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn8(cmd, cmdArgs, { cwd, stdio: "inherit", shell: process.platform === "win32" });
     child.on("error", (e) => {
       reject(new LocalCliError({ code: failCode, message: `Failed to start '${cmd}': ${e.message}` }));
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve4();
+        resolve6();
       } else {
         const opts = {
           code: failCode,
@@ -32561,40 +33084,40 @@ async function installWebDeps(repoRoot) {
   });
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
-function onboardingUiPaths(home = os19.homedir()) {
-  const dir = path40.join(home, ".m8t");
+function onboardingUiPaths(home = os20.homedir()) {
+  const dir = path45.join(home, ".m8t");
   return {
-    logPath: path40.join(dir, "onboarding-ui.log"),
-    pidPath: path40.join(dir, "onboarding-ui.pid")
+    logPath: path45.join(dir, "onboarding-ui.log"),
+    pidPath: path45.join(dir, "onboarding-ui.pid")
   };
 }
-function onboardingRelayPaths(home = os19.homedir()) {
-  const dir = path40.join(home, ".m8t");
+function onboardingRelayPaths(home = os20.homedir()) {
+  const dir = path45.join(home, ".m8t");
   return {
-    logPath: path40.join(dir, "onboarding-relay.log"),
-    pidPath: path40.join(dir, "onboarding-relay.pid")
+    logPath: path45.join(dir, "onboarding-relay.log"),
+    pidPath: path45.join(dir, "onboarding-relay.pid")
   };
 }
 function isLocalPortOpen(port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     const s = net.createConnection({ host: "127.0.0.1", port });
     s.setTimeout(1e3);
     s.on("connect", () => {
       s.destroy();
-      resolve4(true);
+      resolve6(true);
     });
     s.on("error", () => {
-      resolve4(false);
+      resolve6(false);
     });
     s.on("timeout", () => {
       s.destroy();
-      resolve4(false);
+      resolve6(false);
     });
   });
 }
 function removePidFile(pidPath) {
   try {
-    fs35.unlinkSync(pidPath);
+    fs40.unlinkSync(pidPath);
   } catch {
   }
 }
@@ -32607,7 +33130,7 @@ function parseManagedPid(text) {
 function readLiveManagedPid(pidPath) {
   let text;
   try {
-    text = fs35.readFileSync(pidPath, "utf8").trim();
+    text = fs40.readFileSync(pidPath, "utf8").trim();
   } catch {
     return null;
   }
@@ -32646,8 +33169,8 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs35.mkdirSync(path40.dirname(logPath), { recursive: true });
-  const fd = fs35.openSync(logPath, "a");
+  fs40.mkdirSync(path45.dirname(logPath), { recursive: true });
+  const fd = fs40.openSync(logPath, "a");
   const child = spawn8("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
@@ -32656,7 +33179,7 @@ async function serveOnboardingUiDetached(args) {
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
-  fs35.closeSync(fd);
+  fs40.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_DEV_SPAWN_FAILED",
@@ -32665,7 +33188,7 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   child.unref();
-  fs35.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs40.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -32697,8 +33220,8 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs35.mkdirSync(path40.dirname(logPath), { recursive: true });
-  const fd = fs35.openSync(logPath, "a");
+  fs40.mkdirSync(path45.dirname(logPath), { recursive: true });
+  const fd = fs40.openSync(logPath, "a");
   const child = spawn8("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
     cwd: args.repoRoot,
     detached: true,
@@ -32716,7 +33239,7 @@ async function serveOnboardingRelayDetached(args) {
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
-  fs35.closeSync(fd);
+  fs40.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_RELAY_SPAWN_FAILED",
@@ -32725,7 +33248,7 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   child.unref();
-  fs35.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs40.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -32747,7 +33270,7 @@ function autoOpenOnboardingUi(url, open3 = tryOpenUrl) {
 function stopPidFile(pidPath) {
   let pidStr;
   try {
-    pidStr = fs35.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs40.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -32764,12 +33287,12 @@ function stopPidFile(pidPath) {
     }
   }
   try {
-    fs35.unlinkSync(pidPath);
+    fs40.unlinkSync(pidPath);
   } catch {
   }
   return true;
 }
-function stopOnboardingUi(home = os19.homedir()) {
+function stopOnboardingUi(home = os20.homedir()) {
   const uiStopped = stopPidFile(onboardingUiPaths(home).pidPath);
   const relayStopped = stopPidFile(onboardingRelayPaths(home).pidPath);
   return uiStopped || relayStopped;
@@ -33058,9 +33581,9 @@ async function resolveSubscriptionInventory(args) {
     const scan2 = scanFn(args.subscriptionId);
     void scan2.catch(() => {
     });
-    const timeout = new Promise((resolve4) => {
+    const timeout = new Promise((resolve6) => {
       timer = setTimeout(() => {
-        resolve4("timeout");
+        resolve6("timeout");
       }, deadlineMs);
     });
     const raced = await Promise.race([scan2, timeout]);
@@ -33091,7 +33614,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command58.Usage({
+  static usage = Command60.Usage({
     description: "Deploy Ezra + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -33112,16 +33635,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option55.String("--repo-root");
-  port = Option55.String("--port", "3000");
-  endpoint = Option55.String("--endpoint", {
+  repoRoot = Option57.String("--repo-root");
+  port = Option57.String("--port", "3000");
+  endpoint = Option57.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 overrides discovery when this install's resource group holds more than one Foundry project."
   });
-  prepOnly = Option55.Boolean("--prep-only", false);
-  skipInstall = Option55.Boolean("--skip-install", false);
-  stop = Option55.Boolean("--stop", false);
-  foreground = Option55.Boolean("--foreground", false);
-  voice = Option55.Boolean("--voice", false, {
+  prepOnly = Option57.Boolean("--prep-only", false);
+  skipInstall = Option57.Boolean("--skip-install", false);
+  stop = Option57.Boolean("--stop", false);
+  foreground = Option57.Boolean("--foreground", false);
+  voice = Option57.Boolean("--voice", false, {
     description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
   });
   async executeCommand() {
@@ -33156,7 +33679,7 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs36.existsSync(path41.join(os20.homedir(), ".m8t", "config.yaml"))) {
+    if (fs41.existsSync(path46.join(os21.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
     const credential2 = new DefaultAzureCredential24();
@@ -33288,10 +33811,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command61, Option as Option58 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command59.Usage({
+  static usage = Command61.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
     details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/ezra-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
     examples: [
@@ -33299,11 +33822,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option56.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option56.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option56.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option56.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option56.String("--github-app-creds");
+  endpoint = Option58.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option58.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option58.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option58.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option58.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -33363,10 +33886,10 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/telemetry/enroll.ts
-import * as fs37 from "fs";
-import * as os21 from "os";
-import * as path42 from "path";
-import { Command as Command60, Option as Option57 } from "clipanion";
+import * as fs42 from "fs";
+import * as os22 from "os";
+import * as path47 from "path";
+import { Command as Command62, Option as Option59 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -33448,7 +33971,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command60.Usage({
+  static usage = Command62.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -33456,11 +33979,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option57.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option57.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option57.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option57.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option57.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option59.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option59.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option59.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option59.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option59.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -33493,13 +34016,13 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ...company ? { company } : {},
       ...contactEmail ? { contactEmail } : {}
     });
-    const keyDir = fs37.mkdtempSync(path42.join(os21.tmpdir(), "m8t-ingest-key-"));
-    const keyFile = path42.join(keyDir, "key");
+    const keyDir = fs42.mkdtempSync(path47.join(os22.tmpdir(), "m8t-ingest-key-"));
+    const keyFile = path47.join(keyDir, "key");
     try {
-      fs37.writeFileSync(keyFile, ingestKey, { mode: 384 });
+      fs42.writeFileSync(keyFile, ingestKey, { mode: 384 });
       await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);
     } finally {
-      fs37.rmSync(keyDir, { recursive: true, force: true });
+      fs42.rmSync(keyDir, { recursive: true, force: true });
     }
     this.context.stdout.write(
       `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
@@ -33510,7 +34033,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command61, Option as Option58 } from "clipanion";
+import { Command as Command63, Option as Option60 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -34628,14 +35151,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps3) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command61 {
+var CompanionBridgeCommand = class extends Command63 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option58.Boolean("--serve", false);
+  serve = Option60.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -34653,7 +35176,7 @@ var CompanionBridgeCommand = class extends Command61 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command62 } from "clipanion";
+import { Command as Command64 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -34725,7 +35248,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command62.Usage({
+  static usage = Command64.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -34739,7 +35262,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command63, Option as Option59 } from "clipanion";
+import { Command as Command65, Option as Option61 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -34758,10 +35281,10 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command63.Usage({
+  static usage = Command65.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option59.String("--resource-group", {
+  resourceGroup = Option61.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -34775,7 +35298,7 @@ var CompanionRepairCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command64 } from "clipanion";
+import { Command as Command66 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -34787,7 +35310,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command64.Usage({
+  static usage = Command66.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -34836,6 +35359,8 @@ cli.register(BrainOrgsCommand);
 cli.register(BrainShowCommand);
 cli.register(BrainUnlinkCommand);
 cli.register(ArchitectCheckCommand);
+cli.register(AgentContentSyncCommand);
+cli.register(AgentContentPinCommand);
 cli.register(CoderDeployCommand);
 cli.register(CoderTeardownCommand);
 cli.register(AzureExecDeployCommand);