@m8t-stack/cli 0.2.84 → 0.2.86

package/dist/cli.js

@@ -10,11 +10,6 @@ var __export = (target, all) => {
 };
 
 // src/lib/errors.ts
-var errors_exports = {};
-__export(errors_exports, {
-  ApiCallError: () => ApiCallError,
-  LocalCliError: () => LocalCliError
-});
 var LocalCliError, ApiCallError;
 var init_errors = __esm({
   "src/lib/errors.ts"() {
@@ -1467,7 +1462,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.84";
+var CLI_VERSION = "0.2.86";
 
 // src/lib/render-error.ts
 init_errors();
@@ -9940,17 +9935,17 @@ var Files2 = class extends APIResource {
   async waitForProcessing(id, { pollInterval = 5e3, maxWait = 30 * 60 * 1e3 } = {}) {
     const TERMINAL_STATES = /* @__PURE__ */ new Set(["processed", "error", "deleted"]);
     const start = Date.now();
-    let file = await this.retrieve(id);
-    while (!file.status || !TERMINAL_STATES.has(file.status)) {
+    let file2 = await this.retrieve(id);
+    while (!file2.status || !TERMINAL_STATES.has(file2.status)) {
       await sleep(pollInterval);
-      file = await this.retrieve(id);
+      file2 = await this.retrieve(id);
       if (Date.now() - start > maxWait) {
         throw new APIConnectionTimeoutError({
           message: `Giving up on waiting for file ${id} to finish processing after ${maxWait} milliseconds.`
         });
       }
     }
-    return file;
+    return file2;
   }
 };
 
@@ -11742,8 +11737,8 @@ var Files3 = class extends APIResource {
    * Attach a file to the given vector store and wait for it to be processed.
    */
   async createAndPoll(vectorStoreId, body, options) {
-    const file = await this.create(vectorStoreId, body, options);
-    return await this.poll(vectorStoreId, file.id, options);
+    const file2 = await this.create(vectorStoreId, body, options);
+    return await this.poll(vectorStoreId, file2.id, options);
   }
   /**
    * Wait for the vector store file to finish processing.
@@ -11763,8 +11758,8 @@ var Files3 = class extends APIResource {
       const fileResponse = await this.retrieve(fileID, {
         vector_store_id: vectorStoreID
       }, { ...options, headers }).withResponse();
-      const file = fileResponse.data;
-      switch (file.status) {
+      const file2 = fileResponse.data;
+      switch (file2.status) {
         case "in_progress":
           let sleepInterval = 5e3;
           if (options?.pollIntervalMs) {
@@ -11782,7 +11777,7 @@ var Files3 = class extends APIResource {
           break;
         case "failed":
         case "completed":
-          return file;
+          return file2;
       }
     }
   }
@@ -11792,15 +11787,15 @@ var Files3 = class extends APIResource {
    * Note the file will be asynchronously processed (you can use the alternative
    * polling helper method to wait for processing to complete).
    */
-  async upload(vectorStoreId, file, options) {
-    const fileInfo = await this._client.files.create({ file, purpose: "assistants" }, options);
+  async upload(vectorStoreId, file2, options) {
+    const fileInfo = await this._client.files.create({ file: file2, purpose: "assistants" }, options);
     return this.create(vectorStoreId, { file_id: fileInfo.id }, options);
   }
   /**
    * Add a file to a vector store and poll until processing is complete.
    */
-  async uploadAndPoll(vectorStoreId, file, options) {
-    const fileInfo = await this.upload(vectorStoreId, file, options);
+  async uploadAndPoll(vectorStoreId, file2, options) {
+    const fileInfo = await this.upload(vectorStoreId, file2, options);
     return await this.poll(vectorStoreId, fileInfo.id, options);
   }
   /**
@@ -13205,9 +13200,9 @@ async function readConfig() {
   }
 }
 async function writeConfig(cfg) {
-  const dir = configDir();
+  const dir2 = configDir();
   const configPath = getConfigPath();
-  await fs.mkdir(dir, { recursive: true });
+  await fs.mkdir(dir2, { recursive: true });
   const yaml = stringifyYaml(cfg, { indent: 2 });
   const tmp = `${configPath}.tmp`;
   await fs.writeFile(tmp, yaml, "utf8");
@@ -14676,11 +14671,11 @@ function orgFileSegment(org) {
   return org.replace(/[^A-Za-z0-9-]+/g, "-");
 }
 function brainAppFilePaths(home, org, appId) {
-  const dir = path4.join(home, ".m8t");
+  const dir2 = path4.join(home, ".m8t");
   const stem = `github-app-${orgFileSegment(org)}-${appId}`;
   return {
-    pemPath: path4.join(dir, `${stem}.pem`),
-    sidecarPath: path4.join(dir, `${stem}.json`)
+    pemPath: path4.join(dir2, `${stem}.pem`),
+    sidecarPath: path4.join(dir2, `${stem}.json`)
   };
 }
 function isPreservable(v) {
@@ -15290,15 +15285,15 @@ function agentYamlPath(agentName, home = os3.homedir()) {
   return path7.join(home, ".m8t", "foundry", `${agentName}.yaml`);
 }
 function readAgentYaml(agentName, home) {
-  const file = agentYamlPath(agentName, home);
-  if (!fs6.existsSync(file)) return null;
-  const text = fs6.readFileSync(file, "utf8");
+  const file2 = agentYamlPath(agentName, home);
+  if (!fs6.existsSync(file2)) return null;
+  const text = fs6.readFileSync(file2, "utf8");
   return parseYaml3(text);
 }
 function writeAgentYaml(agentName, data, home) {
-  const file = agentYamlPath(agentName, home);
-  fs6.mkdirSync(path7.dirname(file), { recursive: true });
-  fs6.writeFileSync(file, stringifyYaml3(data), { mode: 384 });
+  const file2 = agentYamlPath(agentName, home);
+  fs6.mkdirSync(path7.dirname(file2), { recursive: true });
+  fs6.writeFileSync(file2, stringifyYaml3(data), { mode: 384 });
 }
 function patchAgentYaml(agentName, patch, home) {
   const current = readAgentYaml(agentName, home);
@@ -15881,9 +15876,9 @@ var AGENT_DIR = "agent";
 var AGENT_SEED_DIRS = [...SEED_PATHS, "memory"];
 var AGENT_SEED_FILES = ["NOTICE"];
 var PERSONA_REL = `${AGENT_DIR}/persona.md`;
-function walk(base, dir, out) {
-  for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
-    const abs = path11.join(dir, entry.name);
+function walk(base, dir2, out) {
+  for (const entry of fs11.readdirSync(dir2, { withFileTypes: true })) {
+    const abs = path11.join(dir2, entry.name);
     if (entry.isDirectory()) walk(base, abs, out);
     else if (entry.isFile()) out.push(path11.relative(base, abs).split(path11.sep).join("/"));
   }
@@ -15899,13 +15894,13 @@ function collectAgentContent(repoDir) {
   }
   const rels = [];
   walk(repoDir, path11.join(repoDir, AGENT_DIR), rels);
-  for (const dir of AGENT_SEED_DIRS) {
-    const abs = path11.join(repoDir, dir);
+  for (const dir2 of AGENT_SEED_DIRS) {
+    const abs = path11.join(repoDir, dir2);
     if (fs11.existsSync(abs) && fs11.statSync(abs).isDirectory()) walk(repoDir, abs, rels);
   }
-  for (const file of AGENT_SEED_FILES) {
-    const abs = path11.join(repoDir, file);
-    if (fs11.existsSync(abs) && fs11.statSync(abs).isFile()) rels.push(file);
+  for (const file2 of AGENT_SEED_FILES) {
+    const abs = path11.join(repoDir, file2);
+    if (fs11.existsSync(abs) && fs11.statSync(abs).isFile()) rels.push(file2);
   }
   const files = /* @__PURE__ */ new Map();
   for (const rel of rels) files.set(rel, fs11.readFileSync(path11.join(repoDir, rel)));
@@ -16161,8 +16156,8 @@ async function derivePin(args) {
 // src/lib/brain-seed.ts
 function resolveSeed(name) {
   const root = resolvePlatformRepoRoot("Seeding a brain", ["brain-seeds"]);
-  const dir = path13.join(root, "brain-seeds", name);
-  if (!fs13.existsSync(dir)) {
+  const dir2 = path13.join(root, "brain-seeds", name);
+  if (!fs13.existsSync(dir2)) {
     throw new LocalCliError({
       code: "SEED_NOT_FOUND",
       message: `--seed "${name}": no brain-seeds/${name}/ directory found.`,
@@ -16172,7 +16167,7 @@ function resolveSeed(name) {
       hint: agentContentHint(root, name) ?? "Seeds live under brain-seeds/. Check the name, or omit --seed for an unseeded brain."
     });
   }
-  return dir;
+  return dir2;
 }
 function materializeBrainTree(opts) {
   fs13.cpSync(opts.templateSrc, opts.destDir, { recursive: true });
@@ -16657,20 +16652,20 @@ function resolveScaffoldCommit(repoRoot, env) {
     return "(scaffold)";
   }
 }
-function stageAsGitRepo(dir) {
+function stageAsGitRepo(dir2) {
   const steps = [
     { args: ["init", "-b", "main"], label: "git init" },
     { args: ["add", "."], label: "git add" },
     { args: ["commit", "-m", "Initial commit from brain-template"], label: "git commit" }
   ];
   for (const { args, label } of steps) {
-    const r = spawnSync("git", args, { cwd: dir, encoding: "utf8" });
+    const r = spawnSync("git", args, { cwd: dir2, encoding: "utf8" });
     if (r.status !== 0) {
       const exitCode = r.status !== null ? r.status.toString() : "<null>";
       const detail = r.stderr.trim() || r.stdout.trim() || `exit ${exitCode}`;
       throw new LocalCliError({
         code: "BRAIN_GIT_INIT_FAILED",
-        message: `${label} failed in ${dir}: ${detail}`
+        message: `${label} failed in ${dir2}: ${detail}`
       });
     }
   }
@@ -17634,13 +17629,13 @@ import * as fs16 from "fs";
 import * as path16 from "path";
 import { parse as parseYaml7 } from "yaml";
 function findAncestorContaining(hint, rel) {
-  let dir = path16.resolve(hint);
-  const fsRoot = path16.parse(dir).root;
+  let dir2 = path16.resolve(hint);
+  const fsRoot = path16.parse(dir2).root;
   for (; ; ) {
-    if (fs16.existsSync(path16.join(dir, rel))) return dir;
-    const parent = path16.dirname(dir);
-    if (parent === dir || dir === fsRoot) return null;
-    dir = parent;
+    if (fs16.existsSync(path16.join(dir2, rel))) return dir2;
+    const parent = path16.dirname(dir2);
+    if (parent === dir2 || dir2 === fsRoot) return null;
+    dir2 = parent;
   }
 }
 function findPersonasRoot(hint) {
@@ -17884,7 +17879,7 @@ async function awaitDataPlaneReady(opts) {
   const consecutive = opts.consecutive ?? 3;
   const attempts = opts.attempts ?? 60;
   const intervalMs = opts.intervalMs ?? 5e3;
-  const sleep5 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let streak = 0;
   for (let i = 1; i <= attempts; i++) {
     const r = await opts.probe();
@@ -17906,7 +17901,7 @@ async function awaitDataPlaneReady(opts) {
       streak = 0;
       opts.onProgress?.(`data-plane not ready (${forcedRetryable ? `status ${(r.status ?? 0).toString()}` : cls.category}), waiting\u2026`);
     }
-    if (i < attempts) await sleep5(intervalMs);
+    if (i < attempts) await sleep4(intervalMs);
   }
   return { ready: false, attempts };
 }
@@ -18622,9 +18617,9 @@ import { createHash as createHash3 } from "crypto";
 import * as fs20 from "fs";
 import * as os8 from "os";
 import * as path19 from "path";
-function readVersionFrontmatter(file) {
-  if (!fs20.existsSync(file)) return "";
-  const text = fs20.readFileSync(file, "utf8");
+function readVersionFrontmatter(file2) {
+  if (!fs20.existsSync(file2)) return "";
+  const text = fs20.readFileSync(file2, "utf8");
   if (!text.startsWith("---")) return "";
   const closeIdx = text.indexOf("\n---", 3);
   if (closeIdx < 0) return "";
@@ -19103,7 +19098,7 @@ init_errors();
 async function deployHostedWorker(args) {
   const onProgress = args.onProgress ?? ((_m) => {
   });
-  const sleep5 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const timeout = args.pollTimeoutMs ?? 8 * 60 * 1e3;
   const interval = args.pollIntervalMs ?? 1e4;
@@ -19155,7 +19150,7 @@ async function deployHostedWorker(args) {
         hint: "Provisioning can take 2\u20135 min; re-run with the same name to resume, or check the version status in the Foundry portal."
       });
     }
-    await sleep5(interval);
+    await sleep4(interval);
   }
 }
 
@@ -19164,21 +19159,21 @@ import * as fs22 from "fs";
 import * as path22 from "path";
 import { parse as parseYaml10 } from "yaml";
 function findRepoRoot(startDir) {
-  let dir = path22.resolve(startDir);
+  let dir2 = path22.resolve(startDir);
   for (; ; ) {
-    if (fs22.existsSync(path22.join(dir, "personas"))) return dir;
-    const parent = path22.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
+    if (fs22.existsSync(path22.join(dir2, "personas"))) return dir2;
+    const parent = path22.dirname(dir2);
+    if (parent === dir2) return null;
+    dir2 = parent;
   }
 }
 function resolvePersona(persona, cwd = process.cwd()) {
   const root = findRepoRoot(cwd);
   if (!root) return { persona, personaVersion: null };
-  const file = path22.join(root, "personas", persona, "persona.md");
+  const file2 = path22.join(root, "personas", persona, "persona.md");
   let raw;
   try {
-    raw = fs22.readFileSync(file, "utf-8");
+    raw = fs22.readFileSync(file2, "utf-8");
   } catch {
     return { persona, personaVersion: null };
   }
@@ -20407,13 +20402,13 @@ function manifestSourceForVersionTag(channelUrl, version) {
 }
 var POINTER_SEGMENT = /\/releases\/(?:latest\/download|download\/[^/]+)\//;
 async function fetchManifest(source, deps = {}) {
-  const readFile9 = deps.readFile ?? ((p) => fs23.readFileSync(p, "utf8"));
+  const readFile10 = deps.readFile ?? ((p) => fs23.readFileSync(p, "utf8"));
   const fetchImpl = deps.fetchImpl ?? fetch;
   const ghToken = deps.ghToken ?? getGhToken;
   let raw;
   if ("file" in source) {
     try {
-      raw = readFile9(source.file);
+      raw = readFile10(source.file);
     } catch (e) {
       throw new LocalCliError({ code: "PLATFORM_MANIFEST_READ_FAILED", message: `Could not read manifest file '${source.file}': ${e.message}` });
     }
@@ -21653,11 +21648,11 @@ function mergeThreeWay(ours, base, theirs) {
     return { ok: false, merged: "" };
   }
   const lf = (s) => s.replace(/\r\n/g, "\n");
-  const dir = fs27.mkdtempSync(path28.join(os11.tmpdir(), "seed-merge-"));
+  const dir2 = fs27.mkdtempSync(path28.join(os11.tmpdir(), "seed-merge-"));
   try {
-    const o = path28.join(dir, "ours");
-    const b = path28.join(dir, "base");
-    const t = path28.join(dir, "theirs");
+    const o = path28.join(dir2, "ours");
+    const b = path28.join(dir2, "base");
+    const t = path28.join(dir2, "theirs");
     fs27.writeFileSync(o, lf(ours));
     fs27.writeFileSync(b, lf(base));
     fs27.writeFileSync(t, lf(theirs));
@@ -21674,7 +21669,7 @@ function mergeThreeWay(ours, base, theirs) {
     }
     return { ok: false, merged: "" };
   } finally {
-    fs27.rmSync(dir, { recursive: true, force: true });
+    fs27.rmSync(dir2, { recursive: true, force: true });
   }
 }
 var skip = (path47, skipReason) => ({ path: path47, kind: "skip", skipReason });
@@ -21728,9 +21723,9 @@ function composeSeedPrBody(s) {
 }
 
 // src/lib/seed-refresh.ts
-function readIf(dir, rel) {
-  if (!dir) return null;
-  const abs = path29.join(dir, rel);
+function readIf(dir2, rel) {
+  if (!dir2) return null;
+  const abs = path29.join(dir2, rel);
   return fs28.existsSync(abs) ? fs28.readFileSync(abs, "utf8") : null;
 }
 async function assembleCandidates(args) {
@@ -21864,8 +21859,8 @@ function dedupeBrainRepos(agents) {
 function seedContentDir(contentRoot, manifest, seedName) {
   const items = manifest.components.brainSeeds.items;
   if (!Object.hasOwn(items, seedName)) return null;
-  const dir = path30.join(contentRoot, items[seedName].path);
-  return fs29.existsSync(dir) ? dir : null;
+  const dir2 = path30.join(contentRoot, items[seedName].path);
+  return fs29.existsSync(dir2) ? dir2 : null;
 }
 function bindRepoApi(token, repo) {
   return {
@@ -22028,8 +22023,8 @@ async function buildConvergeDeps(args) {
           message: `applyAgent called with non-hosted component '${a.component}'`
         });
       }
-      const dir = HOSTED_AGENT_PERSONA_DIR[a.component];
-      const agentName = dir ? discovered[dir] : void 0;
+      const dir2 = HOSTED_AGENT_PERSONA_DIR[a.component];
+      const agentName = dir2 ? discovered[dir2] : void 0;
       if (!agentName) {
         warn(`hosted agent for component '${a.component}' is not deployed on this install \u2014 skipping.`);
         return "absent";
@@ -22048,6 +22043,13 @@ async function buildConvergeDeps(args) {
       const target = infraTargetSha(ctx.manifest, args.tree);
       const infraTable = await openInfraParamsTable({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
       const stamped = (await readInfraParams(infraTable))?.bicep;
+      if (!stamped) {
+        throw new LocalCliError({
+          code: "PLATFORM_INFRA_PARAMS_MISSING",
+          message: "This install has no stamped system/infra-params row, so the updater cannot converge infra: the row is the only place the real tenantId/clientId/Foundry endpoint survive, and they cannot be reconstructed from scratch.",
+          hint: "Run `m8t platform enable-auto-update` against this deployment (it captures the full bicep parameter set), then let the next tick retry."
+        });
+      }
       args.onProgress?.("subscription-scoped modules skipped: updater is RG-scoped; sub-level changes require a founder-run CLI converge.");
       const gatewayName = args.suffix ? `m8t-gateway-${args.suffix}` : void 0;
       const voiceInternalSecret = gatewayName ? await readLiveVoiceInternalSecret({
@@ -22063,17 +22065,18 @@ async function buildConvergeDeps(args) {
       const opts = {
         suffix: args.suffix,
         assignSubscriptionRoles: false,
-        ...stamped ? {
-          tenantId: stamped.tenantId,
-          clientId: stamped.clientId,
-          foundryEndpoint: stamped.foundryProjectEndpoint,
-          foundryResourceId: stamped.foundryResourceId,
-          acrPullIdentity: stamped.acrPullIdentityResourceId,
-          acrResourceId: stamped.acrResourceId,
-          ...stamped.foundryTracingMode ? { foundryTracingMode: stamped.foundryTracingMode } : {},
-          ...stamped.channelUrl ? { channelUrl: stamped.channelUrl } : {},
-          ...stamped.location ? { location: stamped.location } : {}
-        } : {},
+        // Unconditional: the guard above has already refused an absent row. The
+        // ternary that used to be here read as "these are optional" — which is
+        // how the empty-endpoint death got written in the first place.
+        tenantId: stamped.tenantId,
+        clientId: stamped.clientId,
+        foundryEndpoint: stamped.foundryProjectEndpoint,
+        foundryResourceId: stamped.foundryResourceId,
+        acrPullIdentity: stamped.acrPullIdentityResourceId,
+        acrResourceId: stamped.acrResourceId,
+        ...stamped.foundryTracingMode ? { foundryTracingMode: stamped.foundryTracingMode } : {},
+        ...stamped.channelUrl ? { channelUrl: stamped.channelUrl } : {},
+        ...stamped.location ? { location: stamped.location } : {},
         ...voiceInternalSecret ? { voiceInternalSecret } : {}
       };
       return applyInfraDeploy(a, ctx, target, opts);
@@ -22084,8 +22087,8 @@ async function buildConvergeDeps(args) {
         if (a.component === "personas" && a.personaName) {
           agentName = discovered[a.personaName];
         } else if (a.component === "codingAgent" || a.component === "azureExecutor") {
-          const dir = HOSTED_AGENT_PERSONA_DIR[a.component];
-          agentName = dir ? discovered[dir] : void 0;
+          const dir2 = HOSTED_AGENT_PERSONA_DIR[a.component];
+          agentName = dir2 ? discovered[dir2] : void 0;
         }
         if (!agentName) continue;
         await awaitAgentQueryable({ credential: args.credential, projectEndpoint: args.project.endpoint, agentName, onProgress: args.onProgress });
@@ -22624,7 +22627,21 @@ async function rollbackOrHold(args, notify, error) {
     return "held";
   }
   if (rollbackTarget) {
-    await reconvergeToPrevious(args, rollbackTarget);
+    try {
+      await reconvergeToPrevious(args, rollbackTarget);
+    } catch (e) {
+      const clip = (s) => s.length > 4e3 ? `${s.slice(0, 4e3)} \u2026[truncated]` : s;
+      const combined = `${clip(error)} \u2014 and the rollback to ${rollbackTarget} failed: ${clip(e.message)} \u2014 the rollback may have partially applied; check the installed stamp's components before retrying.`;
+      await patchApplyRequest(args.client, (r) => ({
+        ...r,
+        status: "held",
+        breaker: "held",
+        result: { appliedVersion: r.result?.appliedVersion ?? null, error: combined },
+        updatedAt: args.now().toISOString()
+      }));
+      await notify({ outcome: "held", target, error: combined });
+      return "held";
+    }
   }
   await patchApplyRequest(args.client, (r) => ({
     ...r,
@@ -22865,6 +22882,9 @@ var PlatformConvergeCommand = class extends M8tCommand {
       channelUrl: ctx.channelUrl,
       repoRoot,
       now: () => /* @__PURE__ */ new Date()
+    }).catch(async (e) => {
+      await failIfStillInFlight(client, now, e.message);
+      throw e;
     });
     log(`converge outcome: ${outcome}.`);
     return outcome === "success" ? 0 : 1;
@@ -27361,9 +27381,9 @@ function isAbsentCursorError(e) {
   const anyE = e;
   return anyE.statusCode === 404 || anyE.code === "ResourceNotFound" || anyE.code === "TableNotFound" || anyE.details?.errorCode === "TableNotFound" || anyE.details?.errorCode === "ResourceNotFound";
 }
-function absentCursor(canonical) {
+function absentCursor(canonical2) {
   return {
-    worker: canonical,
+    worker: canonical2,
     watermarks: {},
     safetyLagSeconds: DEFAULT_SAFETY_LAG_SECONDS,
     engineVersion: ENGINE_VERSION
@@ -27382,19 +27402,19 @@ var TableCursor = class {
    * Any other error (e.g. 403 RBAC) propagates raw.
    */
   async read(worker) {
-    const canonical = canonicalWorker(worker);
+    const canonical2 = canonicalWorker(worker);
     let row;
     try {
-      row = await this.client.getEntity(CURSOR_PARTITION_KEY, canonical);
+      row = await this.client.getEntity(CURSOR_PARTITION_KEY, canonical2);
     } catch (e) {
       if (isAbsentCursorError(e))
-        return absentCursor(canonical);
+        return absentCursor(canonical2);
       throw e;
     }
     const watermarks = row.watermarks ? JSON.parse(row.watermarks) : {};
     const fetchFailures = row.fetchFailures ? JSON.parse(row.fetchFailures) : void 0;
     return {
-      worker: canonical,
+      worker: canonical2,
       watermarks,
       ...fetchFailures && Object.keys(fetchFailures).length > 0 ? { fetchFailures } : {},
       safetyLagSeconds: row.safetyLagSeconds ?? DEFAULT_SAFETY_LAG_SECONDS,
@@ -27410,11 +27430,11 @@ var TableCursor = class {
    * (Table cells are scalar — same rationale as agent-ledger's `artifacts`).
    */
   async advance(worker, cursor) {
-    const canonical = canonicalWorker(worker);
+    const canonical2 = canonicalWorker(worker);
     await this.ensureTable();
     const entity = {
       partitionKey: CURSOR_PARTITION_KEY,
-      rowKey: canonical,
+      rowKey: canonical2,
       watermarks: JSON.stringify(cursor.watermarks),
       safetyLagSeconds: cursor.safetyLagSeconds,
       engineVersion: cursor.engineVersion
@@ -27499,10 +27519,10 @@ function formatCursorPreview(cursor) {
 
 // ../../packages/brain/engine/dist/esm/ledger-source.js
 function physicalPksFor(worker) {
-  const canonical = canonicalWorker(worker);
-  const pks = /* @__PURE__ */ new Set([canonical]);
+  const canonical2 = canonicalWorker(worker);
+  const pks = /* @__PURE__ */ new Set([canonical2]);
   for (const [physical, mapped] of Object.entries(WORKER_ALIASES)) {
-    if (mapped === canonical)
+    if (mapped === canonical2)
       pks.add(physical);
   }
   return [...pks];
@@ -27590,7 +27610,7 @@ function mapItems(raw) {
   return acc.reverse();
 }
 function makeConversationSource(client, opts = {}) {
-  const sleep5 = opts.sleep ?? defaultSleep;
+  const sleep4 = opts.sleep ?? defaultSleep;
   return {
     async items(conversationId) {
       for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
@@ -27608,7 +27628,7 @@ function makeConversationSource(client, opts = {}) {
             throw new ConvFetchError("auth", `auth failed reading ${conversationId}`);
           const retryable = status === void 0 || status === TRANSIENT;
           if (retryable && attempt < MAX_ATTEMPTS - 1) {
-            await sleep5(attempt);
+            await sleep4(attempt);
             continue;
           }
           throw new ConvFetchError("terminal", `exhausted ${String(MAX_ATTEMPTS)} retries reading ${conversationId}: ${e?.message ?? String(e)}`);
@@ -28412,7 +28432,7 @@ function extractJson(text) {
   return JSON.parse(candidate2.slice(start, end + 1));
 }
 async function propose(model, system, user, opts = {}) {
-  const sleep5 = opts.sleep ?? defaultSleep2;
+  const sleep4 = opts.sleep ?? defaultSleep2;
   const modelName = opts.model ?? MODEL_NAME_FALLBACK;
   let inputTokens = 0;
   let outputTokens = 0;
@@ -28428,7 +28448,7 @@ async function propose(model, system, user, opts = {}) {
     } catch (e) {
       lastErr = `parse: ${e.message}`;
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep5(attempt);
+        await sleep4(attempt);
         continue;
       }
       break;
@@ -28437,7 +28457,7 @@ async function propose(model, system, user, opts = {}) {
     if (!Array.isArray(rawDeltas)) {
       lastErr = "schema: top-level { deltas: [] } missing";
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep5(attempt);
+        await sleep4(attempt);
         continue;
       }
       break;
@@ -29198,9 +29218,9 @@ async function discoverLedgerResources(opts) {
 }
 
 // src/lib/dream-context.ts
-function physicalPksFor2(canonical) {
-  const aliases = Object.entries(WORKER_ALIASES).filter(([, c]) => c === canonical).map(([physical]) => physical);
-  return [canonical, ...aliases];
+function physicalPksFor2(canonical2) {
+  const aliases = Object.entries(WORKER_ALIASES).filter(([, c]) => c === canonical2).map(([physical]) => physical);
+  return [canonical2, ...aliases];
 }
 function rgFromScope(scope) {
   const m = /\/resourceGroups\/([^/]+)/i.exec(scope);
@@ -29209,7 +29229,7 @@ function rgFromScope(scope) {
 }
 async function resolveDreamContext(opts) {
   const { credential: credential2 } = opts;
-  const canonical = opts.worker.toLowerCase();
+  const canonical2 = opts.worker.toLowerCase();
   const account = await getAzAccount();
   const subscriptionId = opts.subscription ?? account.subscriptionId;
   const project = await resolveFoundryProject({
@@ -29226,11 +29246,11 @@ async function resolveDreamContext(opts) {
     resourceGroup
   });
   return {
-    worker: canonical,
+    worker: canonical2,
     projectEndpoint: project.endpoint,
     ledgerTableEndpoint,
     workspaceId,
-    physicalPks: physicalPksFor2(canonical)
+    physicalPks: physicalPksFor2(canonical2)
   };
 }
 
@@ -30832,7 +30852,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.62";
+var DEFAULT_INSTALLER_TAG = "v0.1.63";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -31054,15 +31074,15 @@ async function getAciState(opts) {
 }
 
 // src/lib/bootstrap-finalize.ts
-import * as fs38 from "fs/promises";
-import * as os19 from "os";
-import * as path43 from "path";
+import * as fs39 from "fs/promises";
+import * as os20 from "os";
+import * as path44 from "path";
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
 import { closeSync, openSync, readFileSync as readFileSync24 } from "fs";
-import * as os16 from "os";
-import * as path38 from "path";
+import * as os17 from "os";
+import * as path39 from "path";
 init_errors();
 
 // src/lib/onboarding-profile.ts
@@ -31497,7 +31517,11 @@ function renderCompanyProfile(block, now = (/* @__PURE__ */ new Date()).toISOStr
     ``,
     `# Company profile`,
     ``,
-    `_Seeded from the onboarding questionnaire._`,
+    // Named the questionnaire until the questionnaire stopped existing. There is no
+    // intake conversation any more — `m8t bootstrap profile` confirms two contact
+    // facts and nothing about the company — so the old line described a thing that
+    // never happened to this founder.
+    `_Seeded at install._`,
     ``,
     ...bullet("Company", block.company_name),
     ...bullet("Stage", block.company_stage),
@@ -31523,6 +31547,45 @@ function renderCompanyProfile(block, now = (/* @__PURE__ */ new Date()).toISOStr
 var FOUNDER_RECORD_PATH = "memory/founder.md";
 var NOT_CAPTURED = "_not captured yet \u2014 just tell me and I'll add it_";
 var REGION_UNKNOWN_AT_INTAKE = "_not known at intake \u2014 filled in when the request is filed_";
+var FOUNDER_BULLET_LABELS = {
+  name: "- **Founder:** ",
+  email: "- **Founder email (company_email):** ",
+  advisor: "- **Microsoft Startup Advisor (SA):** ",
+  subscription: "- **Azure subscription:** "
+};
+function updateFounderContacts(existing, block, inputs) {
+  if (!existing.includes(FOUNDER_BULLET_LABELS.email)) return null;
+  const advisorName = (block.advisor_name ?? "").trim();
+  const advisorEmail = (block.advisor_email ?? "").trim();
+  const advisor = inputs.advisorCleared === true ? renderAdvisor(advisorName, advisorEmail, NOT_CAPTURED) : renderAdvisor(advisorName, advisorEmail, "");
+  const replacements = [];
+  const add = (prefix, value) => {
+    if (value) replacements.push([prefix, prefix + value]);
+  };
+  add(FOUNDER_BULLET_LABELS.name, (block.founder_name ?? "").trim());
+  add(FOUNDER_BULLET_LABELS.email, (block.founder_email ?? "").trim());
+  add(FOUNDER_BULLET_LABELS.advisor, advisor);
+  add(FOUNDER_BULLET_LABELS.subscription, (inputs.subscriptionId ?? "").trim());
+  return existing.split("\n").map((line2) => {
+    const cr = line2.endsWith("\r") ? "\r" : "";
+    const bare = cr ? line2.slice(0, -1) : line2;
+    const hit = replacements.find(([prefix]) => bare.startsWith(prefix));
+    return hit ? hit[1] + cr : line2;
+  }).join("\n");
+}
+function renderAdvisor(name, email, absent) {
+  if (!name && !email) return absent;
+  return [name, email ? `<${email}>` : ""].filter(Boolean).join(" ");
+}
+function readAdvisorFromRecord(existing) {
+  const line2 = existing.split("\n").map((l) => l.endsWith("\r") ? l.slice(0, -1) : l).find((l) => l.startsWith(FOUNDER_BULLET_LABELS.advisor));
+  if (line2 === void 0) return null;
+  const value = line2.slice(FOUNDER_BULLET_LABELS.advisor.length).trim();
+  if (!value || value === NOT_CAPTURED) return null;
+  const email = /<([^>]+)>/.exec(value)?.[1]?.trim() ?? "";
+  const name = value.replace(/<[^>]*>/, "").trim();
+  return name || email ? { name, email } : null;
+}
 function renderFounderRecord(block, inputs, now = (/* @__PURE__ */ new Date()).toISOString()) {
   const pick = (...vals) => vals.map((v) => v?.trim()).find(Boolean) ?? "";
   const founderName = pick(block.founder_name, inputs.azIdentity?.name);
@@ -31530,7 +31593,7 @@ function renderFounderRecord(block, inputs, now = (/* @__PURE__ */ new Date()).t
   const advisorName = (block.advisor_name ?? "").trim();
   const advisorEmail = (block.advisor_email ?? "").trim();
   const subscription = (inputs.subscriptionId ?? "").trim();
-  const advisorRendered = advisorName || advisorEmail ? [advisorName, advisorEmail ? `<${advisorEmail}>` : ""].filter(Boolean).join(" ") : NOT_CAPTURED;
+  const advisorRendered = renderAdvisor(advisorName, advisorEmail, NOT_CAPTURED);
   const request = block.pending_requests?.[0];
   const requestLines2 = request === void 0 ? [] : (() => {
     const modelLabel = request.model.trim() ? `\`${request.model.trim()}\`` : "(model not recorded)";
@@ -31565,7 +31628,7 @@ function renderFounderRecord(block, inputs, now = (/* @__PURE__ */ new Date()).t
     ``,
     `# Founder & install context`,
     ``,
-    `_Seeded at onboarding from your Azure identity + the questionnaire. Authoritative \u2014 read it; don't rewrite it (origin: operator)._`,
+    `_Seeded at install from your Azure identity + what you confirmed. Authoritative \u2014 read it; don't rewrite it (origin: operator)._`,
     ``,
     `- **Founder:** ${founderName || NOT_CAPTURED}`,
     `- **Founder email (company_email):** ${founderEmail || NOT_CAPTURED}`,
@@ -31581,168 +31644,7 @@ function renderFounderRecord(block, inputs, now = (/* @__PURE__ */ new Date()).t
   return { founderMd, memoryIndexLine };
 }
 
-// src/lib/model-cascade.ts
-var WHITELIST = [
-  { model: "gpt-5.6-luna", format: "OpenAI", version: "2026-07-09", capacity: 100 },
-  { model: "gpt-5.6-sol", format: "OpenAI", version: "2026-07-09", capacity: 100 },
-  { model: "gpt-5.6-terra", format: "OpenAI", version: "2026-07-09", capacity: 100 },
-  { model: "gpt-5.4", format: "OpenAI", version: "2026-03-05", capacity: 100 },
-  { model: "grok-4.3", format: "xAI", version: "1", capacity: 100 },
-  { model: "gpt-4.1-mini", format: "OpenAI", version: "2025-04-14", capacity: 50 }
-];
-var GLOBAL_STANDARD = "GlobalStandard";
-function planCascade(whitelist, catalog, quota) {
-  if (!catalog.ok) {
-    return {
-      candidates: [],
-      skipped: whitelist.map((r) => ({ model: r.model, outcome: "catalog-unverified", detail: catalog.error }))
-    };
-  }
-  const rowsByName = /* @__PURE__ */ new Map();
-  for (const row of catalog.rows) {
-    const list = rowsByName.get(row.name);
-    if (list) list.push(row);
-    else rowsByName.set(row.name, [row]);
-  }
-  const candidates = [];
-  const skipped = [];
-  for (const rung of whitelist) {
-    const rows = rowsByName.get(rung.model);
-    if (!rows || rows.length === 0) {
-      skipped.push({ model: rung.model, outcome: "not-in-catalog" });
-      continue;
-    }
-    const agentRows = rows.filter((r) => r.agentsV2);
-    if (agentRows.length === 0) {
-      skipped.push({ model: rung.model, outcome: "not-agent-eligible" });
-      continue;
-    }
-    if (!agentRows.some((r) => r.skus.includes(GLOBAL_STANDARD))) {
-      skipped.push({ model: rung.model, outcome: "no-global-standard" });
-      continue;
-    }
-    if (modelQuotaVerdict(quota, rung.model).verdict === "no_quota") {
-      skipped.push({ model: rung.model, outcome: "no-quota" });
-      continue;
-    }
-    candidates.push(rung);
-  }
-  return { candidates, skipped };
-}
-var QUOTA_RE = /insufficient\s*quota|not enough quota|quota limit|quota\b[^.]{0,40}exceed|exceed\w*\b[^.]{0,40}quota|capacity[^.]{0,40}exceed|exceed\w*\b[^.]{0,40}capacity/i;
-var REGION_RE = /not available in|not supported in|NotAvailableInRegion|InvalidResourceLocation/i;
-var CONFLICT_RE = /\bconflict\b|\b409\b/i;
-function classifyDeployError(message) {
-  if (QUOTA_RE.test(message)) return "deploy-rejected-quota";
-  if (REGION_RE.test(message)) return "deploy-rejected-region";
-  return "deploy-unverified";
-}
-async function walkCascade(whitelist, plan, deploy, opts) {
-  const outcomes = /* @__PURE__ */ new Map();
-  for (const s of plan.skipped) outcomes.set(s.model, s);
-  let chosen = null;
-  let aborted = false;
-  for (const rung of plan.candidates) {
-    if (chosen) break;
-    if (opts.now() >= opts.deadlineAt) {
-      aborted = true;
-      break;
-    }
-    let row;
-    try {
-      await deploy(rung);
-      row = { model: rung.model, outcome: "deployed" };
-      chosen = rung;
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      if (CONFLICT_RE.test(msg)) {
-        try {
-          await deploy(rung);
-          row = { model: rung.model, outcome: "deployed" };
-          chosen = rung;
-        } catch (e2) {
-          const msg2 = e2 instanceof Error ? e2.message : String(e2);
-          row = {
-            model: rung.model,
-            outcome: CONFLICT_RE.test(msg2) ? "deploy-unverified" : classifyDeployError(msg2),
-            detail: msg2
-          };
-        }
-      } else {
-        row = { model: rung.model, outcome: classifyDeployError(msg), detail: msg };
-      }
-    }
-    outcomes.set(rung.model, row);
-    opts.onRung?.(row.model, row.outcome);
-  }
-  const trace = whitelist.map(
-    (r) => outcomes.get(r.model) ?? { model: r.model, outcome: aborted ? "aborted-deadline" : "not-reached" }
-  );
-  return { chosen, trace };
-}
-var QUOTA_INVITATION = "You can offer to help request that quota.";
-var CERTAIN_UNAVAILABLE = /* @__PURE__ */ new Set([
-  "not-in-catalog",
-  "not-agent-eligible",
-  "no-global-standard",
-  "deploy-rejected-region"
-]);
-var QUOTA_BLOCKED = /* @__PURE__ */ new Set(["no-quota", "deploy-rejected-quota"]);
-function decideNote(whitelist, result2) {
-  const chosenIdx = result2.chosen ? whitelist.findIndex((r) => r.model === result2.chosen?.model) : whitelist.length;
-  const better = result2.trace.slice(0, Math.max(chosenIdx, 0));
-  const runningModel = result2.chosen?.model ?? null;
-  if (chosenIdx === 0) {
-    return { status: "top", runningModel, pitchModel: null, unavailableAbovePitch: [] };
-  }
-  const pitch = better.find((t) => QUOTA_BLOCKED.has(t.outcome));
-  if (pitch) {
-    const pitchIdx = better.findIndex((t) => t.model === pitch.model);
-    return {
-      status: "lesser-quota",
-      runningModel,
-      pitchModel: pitch.model,
-      unavailableAbovePitch: better.slice(0, pitchIdx).filter((t) => CERTAIN_UNAVAILABLE.has(t.outcome)).map((t) => t.model)
-    };
-  }
-  const allCertain = better.length > 0 && better.every((t) => CERTAIN_UNAVAILABLE.has(t.outcome));
-  return {
-    status: allCertain ? "lesser-unavailable" : "lesser-unverified",
-    runningModel,
-    pitchModel: null,
-    unavailableAbovePitch: []
-  };
-}
-var listNames = (names) => names.length <= 1 ? names[0] ?? "" : `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
-function renderChosenModelNote(d) {
-  const subject = d.runningModel ? `You are running on ${d.runningModel}.` : "You are running on this install's default model.";
-  switch (d.status) {
-    case "top":
-      return `${subject} That is the best available model for this install.`;
-    case "lesser-quota": {
-      const aside = d.unavailableAbovePitch.length > 0 ? ` ${listNames(d.unavailableAbovePitch)} ${d.unavailableAbovePitch.length > 1 ? "are" : "is"} not offered for this install.` : "";
-      return `${subject} A stronger model, ${d.pitchModel ?? ""}, is offered here, but this subscription has no quota for it.${aside} ${QUOTA_INVITATION}`;
-    }
-    case "lesser-unavailable":
-      return `${subject} No stronger model is offered for this install right now.`;
-    case "lesser-unverified":
-      return `${subject} It was not possible to check which stronger models this subscription can run, so do not make claims about what is or is not available.`;
-  }
-}
-
 // src/lib/founder-identity.ts
-var INVENTORY_INVITATION = "You can offer to walk the founder through these resources.";
-var NOTE_INVITATIONS = [QUOTA_INVITATION, INVENTORY_INVITATION];
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function stripNoteInvitations(value) {
-  let out = value;
-  for (const sentence of NOTE_INVITATIONS) {
-    out = out.replace(new RegExp(escapeRegExp(sentence), "gi"), " ");
-  }
-  return out.replace(/\s{2,}/g, " ").trim();
-}
 function deriveEmailCandidate(raw) {
   const mail = (raw.mail ?? "").trim();
   if (mail) return mail;
@@ -31773,21 +31675,80 @@ async function getSignedInUserIdentity(runAzImpl = runAz) {
     return { name: "", email: "" };
   }
 }
-function composeFounderIdentityNote(id) {
-  const name = stripNoteInvitations(id.name);
-  const email = stripNoteInvitations(id.email);
-  if (name && email) {
-    return `You're speaking with **${name}**, signed in to Azure (their email looks like **${email}**). Open by confirming both, in your own voice \u2014 e.g. "I see you're signed in as ${name}, and I'll use ${email} for your advisor handoffs and cost reports \u2014 is that right, or should I change either?" Record exactly what they approve or correct.`;
+
+// src/lib/onboarding-profile-store.ts
+import * as fs35 from "fs/promises";
+import * as os16 from "os";
+import * as path38 from "path";
+var ONBOARDING_PROFILE_FILE = "onboarding-profile.json";
+function dir(home) {
+  return path38.join(home, ".m8t");
+}
+function file(home) {
+  return path38.join(dir(home), ONBOARDING_PROFILE_FILE);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonBlankString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function canonical(value) {
+  if (!isRecord3(value)) return null;
+  if (value.schemaVersion !== 1) return null;
+  if (!nonBlankString(value.founderEmail)) return null;
+  if (typeof value.founderName !== "string") return null;
+  if (typeof value.collectedAt !== "string") return null;
+  if (value.advisor === void 0) return null;
+  let advisor = null;
+  if (value.advisor !== null) {
+    if (!isRecord3(value.advisor)) return null;
+    if (typeof value.advisor.name !== "string" || typeof value.advisor.email !== "string") return null;
+    advisor = { name: value.advisor.name, email: value.advisor.email };
   }
-  if (name) {
-    return `You're speaking with **${name}** (signed in to Azure). Confirm their name, then ask for the best contact email to reach them (that's where advisor handoffs and cost reports go).`;
+  return {
+    schemaVersion: 1,
+    collectedAt: value.collectedAt,
+    founderName: value.founderName,
+    founderEmail: value.founderEmail,
+    advisor,
+    ...value.advisorCleared === true ? { advisorCleared: true } : {}
+  };
+}
+async function readOnboardingProfile(home = os16.homedir()) {
+  let raw;
+  try {
+    raw = await fs35.readFile(file(home), "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    return canonical(JSON.parse(raw));
+  } catch {
+    return null;
   }
-  return `Ask the founder their name and the best contact email to reach them (that's where advisor handoffs and cost reports go).`;
+}
+async function writeOnboardingProfile(profile, home = os16.homedir()) {
+  await fs35.mkdir(dir(home), { recursive: true });
+  const target = file(home);
+  const tmp = `${target}.tmp`;
+  await fs35.writeFile(tmp, JSON.stringify(profile, null, 2), { encoding: "utf8", mode: 384 });
+  await fs35.rename(tmp, target);
+}
+function toOnboardingBlock(profile) {
+  return {
+    schema_version: "3",
+    context: "",
+    founder_name: profile.founderName,
+    founder_email: profile.founderEmail,
+    advisor_name: profile.advisor?.name ?? "",
+    advisor_email: profile.advisor?.email ?? ""
+  };
 }
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path38.join(os16.homedir(), ".m8t", "github-app.json");
+  const p = credsPath ?? path39.join(os17.homedir(), ".m8t", "github-app.json");
   try {
     return JSON.parse(readFileSync24(p, "utf8"));
   } catch {
@@ -31862,12 +31823,8 @@ async function applyProfileToBrain(args) {
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
+  const contactsOnly = args.contactsOnly === true;
   const { profileMd, memoryIndexLine: companyLine } = renderCompanyProfile(args.block, args.now);
-  const { founderMd, memoryIndexLine: founderLine } = renderFounderRecord(
-    args.block,
-    { subscriptionId: args.subscriptionId, azIdentity: args.azIdentity },
-    args.now
-  );
   const read = (p) => readRepoFileViaApp({
     token,
     repo: args.brainRepo,
@@ -31875,13 +31832,25 @@ async function applyProfileToBrain(args) {
     ref: args.branch,
     fetchImpl: args.fetchImpl
   });
-  const existingProfile = await read(COMPANY_PROFILE_PATH);
+  const existingProfile = contactsOnly ? null : await read(COMPANY_PROFILE_PATH);
   const existingFounder = await read(FOUNDER_RECORD_PATH);
   const existingIndex = await read(MEMORY_INDEX_PATH) ?? DEFAULT_MEMORY_INDEX_HEADER;
-  let nextIndex = upsertMemoryIndexOnce(existingIndex, companyLine, COMPANY_PROFILE_PATH);
+  const keepsExistingAdvisor = contactsOnly && existingFounder !== null && args.advisorCleared !== true && !args.block.advisor_name.trim() && !args.block.advisor_email.trim();
+  const recovered = keepsExistingAdvisor ? readAdvisorFromRecord(existingFounder) : null;
+  const effectiveBlock = recovered ? { ...args.block, advisor_name: recovered.name, advisor_email: recovered.email } : args.block;
+  const { founderMd: freshFounderMd, memoryIndexLine: founderLine } = renderFounderRecord(
+    effectiveBlock,
+    { subscriptionId: args.subscriptionId, azIdentity: args.azIdentity },
+    args.now
+  );
+  const founderMd = contactsOnly && existingFounder !== null ? updateFounderContacts(existingFounder, args.block, {
+    subscriptionId: args.subscriptionId,
+    advisorCleared: args.advisorCleared
+  }) ?? freshFounderMd : freshFounderMd;
+  let nextIndex = contactsOnly ? existingIndex : upsertMemoryIndexOnce(existingIndex, companyLine, COMPANY_PROFILE_PATH);
   nextIndex = upsertMemoryIndexOnce(nextIndex, founderLine, FOUNDER_RECORD_PATH);
   const files = [
-    ...!seededDocumentMatches(existingProfile, profileMd) ? [{ path: COMPANY_PROFILE_PATH, content: profileMd }] : [],
+    ...!contactsOnly && !seededDocumentMatches(existingProfile, profileMd) ? [{ path: COMPANY_PROFILE_PATH, content: profileMd }] : [],
     ...!seededDocumentMatches(existingFounder, founderMd) ? [{ path: FOUNDER_RECORD_PATH, content: founderMd }] : [],
     ...nextIndex !== existingIndex ? [{ path: MEMORY_INDEX_PATH, content: nextIndex }] : []
   ];
@@ -31890,17 +31859,17 @@ async function applyProfileToBrain(args) {
       token,
       repo: args.brainRepo,
       branch: args.branch,
-      message: "seed(brain): founder + company profile from onboarding",
+      message: contactsOnly ? "seed(brain): how to reach the founder" : "seed(brain): founder + company profile from onboarding",
       files,
       fetchImpl: args.fetchImpl
     });
     const [verifiedProfile, verifiedFounder, verifiedIndex] = await Promise.all([
-      read(COMPANY_PROFILE_PATH),
+      contactsOnly ? Promise.resolve(null) : read(COMPANY_PROFILE_PATH),
       read(FOUNDER_RECORD_PATH),
       read(MEMORY_INDEX_PATH)
     ]);
     const mismatches = [
-      ...!seededDocumentMatches(verifiedProfile, profileMd) ? [COMPANY_PROFILE_PATH] : [],
+      ...!contactsOnly && !seededDocumentMatches(verifiedProfile, profileMd) ? [COMPANY_PROFILE_PATH] : [],
       ...!seededDocumentMatches(verifiedFounder, founderMd) ? [FOUNDER_RECORD_PATH] : [],
       ...verifiedIndex !== nextIndex ? [MEMORY_INDEX_PATH] : []
     ];
@@ -31948,7 +31917,7 @@ async function applyProfileToBrains(args) {
   }
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path38.join(os16.homedir(), ".m8t", "seed-profile.log");
+  const logPath = path39.join(os17.homedir(), ".m8t", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -31960,6 +31929,8 @@ function spawnDetachedSeedWatch() {
     closeSync(fd);
   }
 }
+var NO_PROFILE_LINE = `${colors.dim("\u2139 Your advisors don't know how to reach you yet \u2014 run 'm8t bootstrap profile'.")}
+`;
 async function reactiveSeedOnInstallComplete(args) {
   const ctx = await resolveSeedContext({
     endpointOverride: args.endpoint,
@@ -31968,6 +31939,23 @@ async function reactiveSeedOnInstallComplete(args) {
     brainsOverride: args.brains
   });
   if (!ctx) return;
+  const local = await readOnboardingProfile(args.home);
+  if (local) {
+    await applyProfileToBrains({
+      block: toOnboardingBlock(local),
+      brainRepos: ctx.brainRepos,
+      branch: "main",
+      appCreds: ctx.appCreds,
+      subscriptionId: ctx.subscriptionId,
+      azIdentity: { name: local.founderName, email: local.founderEmail },
+      contactsOnly: true,
+      advisorCleared: local.advisorCleared === true,
+      fetchImpl: args.fetchImpl
+    });
+    args.stdout(`${colors.success("\u2713")} Your advisors now know how to reach you (seeded ${ctx.brainRepos.join(", ")}).
+`);
+    return;
+  }
   const token = await (args.getFoundryTokenImpl ?? getFoundryToken)();
   const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token, fetchImpl: args.fetchImpl });
   if (block) {
@@ -31985,7 +31973,10 @@ async function reactiveSeedOnInstallComplete(args) {
 `);
     return;
   }
-  if (!hadIntake) return;
+  if (!hadIntake) {
+    args.stdout(NO_PROFILE_LINE);
+    return;
+  }
   (args.spawnWatch ?? spawnDetachedSeedWatch)();
   args.stdout(
     `${colors.dim("\u2139 Your advisors will pick up your company profile when you finish the intake (watching in the background).")}
@@ -32026,16 +32017,16 @@ function renderInstallSummary(args) {
 
 // src/lib/companion-install.ts
 import { constants as constants2 } from "fs";
-import * as fs36 from "fs/promises";
-import * as path40 from "path";
+import * as fs37 from "fs/promises";
+import * as path41 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import { execFile, spawn as spawn7 } from "child_process";
 
 // src/lib/companion-artifact.ts
 import { createHash as createHash7 } from "crypto";
 import { constants } from "fs";
-import * as fs35 from "fs/promises";
-import * as path39 from "path";
+import * as fs36 from "fs/promises";
+import * as path40 from "path";
 var SHA256 = /^[a-f0-9]{64}$/u;
 var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u;
 function exactKeys(value, expected) {
@@ -32043,23 +32034,23 @@ function exactKeys(value, expected) {
   return actual.length === expected.length && actual.every((key2, index) => key2 === [...expected].sort()[index]);
 }
 function normalizedRelative(value) {
-  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path39.posix.isAbsolute(value)) {
+  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path40.posix.isAbsolute(value)) {
     throw new Error("Artifact path must be a normalized relative POSIX path");
   }
-  const normalized = path39.posix.normalize(value);
+  const normalized = path40.posix.normalize(value);
   if (normalized !== value || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     throw new Error("Artifact path escapes the payload root");
   }
   return value;
 }
 function validateLink(entryPath, target) {
-  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path39.posix.isAbsolute(target)) {
+  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path40.posix.isAbsolute(target)) {
     throw new Error("Artifact symlink target must be relative");
   }
-  const resolved = path39.posix.normalize(
-    path39.posix.join(path39.posix.dirname(entryPath), target)
+  const resolved = path40.posix.normalize(
+    path40.posix.join(path40.posix.dirname(entryPath), target)
   );
-  if (resolved === ".." || resolved.startsWith("../") || path39.posix.isAbsolute(resolved)) {
+  if (resolved === ".." || resolved.startsWith("../") || path40.posix.isAbsolute(resolved)) {
     throw new Error("Artifact symlink target escapes the payload root");
   }
   return target;
@@ -32140,17 +32131,17 @@ function parseArtifactManifest(value) {
   };
 }
 async function sha256File2(filePath) {
-  return createHash7("sha256").update(await fs35.readFile(filePath)).digest("hex");
+  return createHash7("sha256").update(await fs36.readFile(filePath)).digest("hex");
 }
 async function walk2(root, relative4 = "") {
-  const directory = path39.join(root, ...relative4.split("/").filter(Boolean));
-  const children = await fs35.readdir(directory, { withFileTypes: true });
+  const directory = path40.join(root, ...relative4.split("/").filter(Boolean));
+  const children = await fs36.readdir(directory, { withFileTypes: true });
   const entries = [];
   for (const child of children.sort((left, right) => left.name.localeCompare(right.name))) {
     const childRelative = relative4 ? `${relative4}/${child.name}` : child.name;
     normalizedRelative(childRelative);
-    const childPath = path39.join(directory, child.name);
-    const stat5 = await fs35.lstat(childPath);
+    const childPath = path40.join(directory, child.name);
+    const stat5 = await fs36.lstat(childPath);
     if (stat5.isDirectory()) {
       entries.push(...await walk2(root, childRelative));
     } else if (stat5.isFile()) {
@@ -32162,7 +32153,7 @@ async function walk2(root, relative4 = "") {
         sha256: await sha256File2(childPath)
       });
     } else if (stat5.isSymbolicLink()) {
-      const target = await fs35.readlink(childPath);
+      const target = await fs36.readlink(childPath);
       entries.push({
         type: "symlink",
         path: childRelative,
@@ -32175,19 +32166,19 @@ async function walk2(root, relative4 = "") {
   return entries;
 }
 async function ensureRealDirectory(root) {
-  const stat5 = await fs35.lstat(root);
+  const stat5 = await fs36.lstat(root);
   if (stat5.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
   if (!stat5.isDirectory()) throw new Error("Artifact root is not a directory");
 }
 async function validateResolvedLinks(root, entries) {
-  const realRoot = await fs35.realpath(root);
+  const realRoot = await fs36.realpath(root);
   for (const entry of entries) {
     if (entry.type !== "symlink") continue;
     try {
-      const linkPath = path39.join(root, ...entry.path.split("/"));
-      const resolved = await fs35.realpath(linkPath);
-      const relative4 = path39.relative(realRoot, resolved);
-      if (relative4 === ".." || relative4.startsWith(`..${path39.sep}`) || path39.isAbsolute(relative4)) {
+      const linkPath = path40.join(root, ...entry.path.split("/"));
+      const resolved = await fs36.realpath(linkPath);
+      const relative4 = path40.relative(realRoot, resolved);
+      if (relative4 === ".." || relative4.startsWith(`..${path40.sep}`) || path40.isAbsolute(relative4)) {
         throw new Error("Artifact symlink chain escapes the payload root");
       }
     } catch (error) {
@@ -32217,13 +32208,13 @@ async function buildArtifactManifest(payloadRoot, input) {
   return manifest;
 }
 async function readArtifactManifest(manifestPath) {
-  const before = await fs35.lstat(manifestPath);
+  const before = await fs36.lstat(manifestPath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Artifact manifest is a symbolic link or non-file");
   }
   let handle;
   try {
-    handle = await fs35.open(
+    handle = await fs36.open(
       manifestPath,
       constants.O_RDONLY | constants.O_NOFOLLOW
     );
@@ -32240,9 +32231,9 @@ async function readArtifactManifest(manifestPath) {
   }
 }
 function ensureContainedEntry(root, entryPath) {
-  const absolute = path39.join(root, ...entryPath.split("/"));
-  const relative4 = path39.relative(root, absolute);
-  if (relative4.startsWith("..") || path39.isAbsolute(relative4)) {
+  const absolute = path40.join(root, ...entryPath.split("/"));
+  const relative4 = path40.relative(root, absolute);
+  if (relative4.startsWith("..") || path40.isAbsolute(relative4)) {
     throw new Error("Artifact entry escapes payload root");
   }
   return absolute;
@@ -32281,27 +32272,27 @@ async function verifyArtifactPayload(payloadRoot, manifest) {
 async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
   await verifyArtifactSource(sourceRoot, manifest);
   try {
-    const targetStat = await fs35.lstat(targetRoot);
+    const targetStat = await fs36.lstat(targetRoot);
     if (targetStat.isSymbolicLink()) {
       throw new Error("Install target is a symbolic link");
     }
     if (!targetStat.isDirectory()) throw new Error("Install target is not a directory");
-    if ((await fs35.readdir(targetRoot)).length > 0) {
+    if ((await fs36.readdir(targetRoot)).length > 0) {
       throw new Error("Install staging target is not empty");
     }
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
-    await fs35.mkdir(targetRoot, { recursive: false, mode: 448 });
+    await fs36.mkdir(targetRoot, { recursive: false, mode: 448 });
   }
   for (const entry of manifest.entries) {
     const source = ensureContainedEntry(sourceRoot, entry.path);
     const target = ensureContainedEntry(targetRoot, entry.path);
-    await fs35.mkdir(path39.dirname(target), { recursive: true, mode: 448 });
+    await fs36.mkdir(path40.dirname(target), { recursive: true, mode: 448 });
     if (entry.type === "file") {
-      await fs35.copyFile(source, target);
-      await fs35.chmod(target, entry.mode);
+      await fs36.copyFile(source, target);
+      await fs36.chmod(target, entry.mode);
     } else {
-      await fs35.symlink(entry.target, target);
+      await fs36.symlink(entry.target, target);
     }
   }
   await verifyArtifactPayload(targetRoot, manifest);
@@ -32317,18 +32308,18 @@ function commandError(error, message) {
   if (code !== void 0) wrapped.code = code;
   return wrapped;
 }
-function execFileAsync(file, args) {
+function execFileAsync(file2, args) {
   return new Promise((resolve6, reject) => {
-    execFile(file, [...args], { windowsHide: true }, (error) => {
+    execFile(file2, [...args], { windowsHide: true }, (error) => {
       if (error) reject(commandError(error, "Login-item command failed"));
       else resolve6();
     });
   });
 }
-function execFileOutput(file, args) {
+function execFileOutput(file2, args) {
   return new Promise((resolve6, reject) => {
     execFile(
-      file,
+      file2,
       [...args],
       { windowsHide: true },
       (error, stdout) => {
@@ -32340,25 +32331,25 @@ function execFileOutput(file, args) {
 }
 async function setCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const launchAgents = path40.join(input.homeDirectory, "Library", "LaunchAgents");
-    const registration = path40.join(
+    const launchAgents = path41.join(input.homeDirectory, "Library", "LaunchAgents");
+    const registration = path41.join(
       launchAgents,
       "com.m8t.companion.plist"
     );
     await assertNotSymlink(registration, "Start-at-login registration");
     if (!input.enabled) {
-      await fs36.rm(registration, { force: true });
+      await fs37.rm(registration, { force: true });
       return;
     }
-    await fs36.mkdir(launchAgents, { recursive: true, mode: 448 });
+    await fs37.mkdir(launchAgents, { recursive: true, mode: 448 });
     const plist = '<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.m8t.companion</string><key>ProgramArguments</key><array><string>' + xmlEscape(input.executable) + "</string></array><key>RunAtLoad</key><true/></dict></plist>\n";
     await atomicWriteText(registration, plist, 384);
     return;
   }
   if (input.platform === "win32") {
     const key2 = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
-    const run2 = input.runCommand ?? (async (file, args) => {
-      await execFileAsync(file, args);
+    const run2 = input.runCommand ?? (async (file2, args) => {
+      await execFileAsync(file2, args);
       return "";
     });
     if (input.enabled) {
@@ -32402,7 +32393,7 @@ async function setCompanionStartAtLogin(input) {
 }
 async function getCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const registration = path40.join(
+    const registration = path41.join(
       input.homeDirectory,
       "Library",
       "LaunchAgents",
@@ -32464,26 +32455,26 @@ function assertSupported(options) {
 }
 function companionInstallPaths(options) {
   assertSupported(options);
-  const companionState = path40.join(
+  const companionState = path41.join(
     options.homeDirectory,
     ".m8t",
     "companion"
   );
-  const targetRoot = options.platform === "darwin" ? path40.join(
+  const targetRoot = options.platform === "darwin" ? path41.join(
     options.homeDirectory,
     "Applications",
     "m8t Companion.app"
-  ) : path40.join(
-    options.localAppData ?? path40.join(options.homeDirectory, "AppData", "Local"),
+  ) : path41.join(
+    options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local"),
     "m8t",
     "companion",
     "app"
   );
   return {
     targetRoot,
-    installManifest: path40.join(companionState, "install-v1.json"),
-    runtimeBinding: path40.join(companionState, "runtime-v1.json"),
-    preferences: path40.join(companionState, "preferences-v1.json")
+    installManifest: path41.join(companionState, "install-v1.json"),
+    runtimeBinding: path41.join(companionState, "runtime-v1.json"),
+    preferences: path41.join(companionState, "preferences-v1.json")
   };
 }
 function exactKeys2(value, keys) {
@@ -32494,7 +32485,7 @@ function parseInstallManifest(value) {
     throw new Error("Install manifest schema is invalid");
   }
   const record = value;
-  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path40.isAbsolute(record.ownedTargetRoot)) {
+  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path41.isAbsolute(record.ownedTargetRoot)) {
     throw new Error("Install manifest schema is invalid");
   }
   return record;
@@ -32504,7 +32495,7 @@ function parseRuntimeBinding(value, platform) {
     throw new Error("Runtime binding schema is invalid");
   }
   const record = value;
-  const paths = platform === "win32" ? path40.win32 : path40.posix;
+  const paths = platform === "win32" ? path41.win32 : path41.posix;
   if (!exactKeys2(record, RUNTIME_KEYS) || record.schemaVersion !== 1 || typeof record.nodeExecutable !== "string" || !paths.isAbsolute(record.nodeExecutable) || typeof record.cliEntry !== "string" || !paths.isAbsolute(record.cliEntry) || typeof record.gatewayOrigin !== "string") {
     throw new Error("Runtime binding schema is invalid");
   }
@@ -32529,7 +32520,7 @@ function validateGatewayOrigin(value) {
 }
 async function assertNotSymlink(filePath, kind) {
   try {
-    if ((await fs36.lstat(filePath)).isSymbolicLink()) {
+    if ((await fs37.lstat(filePath)).isSymbolicLink()) {
       throw new Error(`${kind} is a symbolic link`);
     }
   } catch (error) {
@@ -32538,20 +32529,20 @@ async function assertNotSymlink(filePath, kind) {
   }
 }
 async function assertOwnedDirectoryChain(anchor, targetDirectory) {
-  const relative4 = path40.relative(anchor, targetDirectory);
-  if (relative4 === ".." || relative4.startsWith(`..${path40.sep}`) || path40.isAbsolute(relative4)) {
+  const relative4 = path41.relative(anchor, targetDirectory);
+  if (relative4 === ".." || relative4.startsWith(`..${path41.sep}`) || path41.isAbsolute(relative4)) {
     throw new Error("Companion owned directory escapes its trusted anchor");
   }
-  const segments = relative4.split(path40.sep).filter(Boolean);
+  const segments = relative4.split(path41.sep).filter(Boolean);
   let current = anchor;
-  const anchorStatus = await fs36.lstat(anchor);
+  const anchorStatus = await fs37.lstat(anchor);
   if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
     throw new Error("Companion owned directory anchor is unsafe");
   }
   for (const segment of segments) {
-    current = path40.join(current, segment);
+    current = path41.join(current, segment);
     try {
-      const status = await fs36.lstat(current);
+      const status = await fs37.lstat(current);
       if (status.isSymbolicLink() || !status.isDirectory()) {
         throw new Error("Companion owned directory contains a symbolic link");
       }
@@ -32564,19 +32555,19 @@ async function assertOwnedDirectoryChain(anchor, targetDirectory) {
 async function assertOwnedParents(options, paths) {
   await assertOwnedDirectoryChain(
     options.homeDirectory,
-    path40.dirname(paths.installManifest)
+    path41.dirname(paths.installManifest)
   );
-  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path40.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
-  await assertOwnedDirectoryChain(targetAnchor, path40.dirname(paths.targetRoot));
+  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
+  await assertOwnedDirectoryChain(targetAnchor, path41.dirname(paths.targetRoot));
 }
 async function readRegularText(filePath, maxBytes) {
-  const before = await fs36.lstat(filePath);
+  const before = await fs37.lstat(filePath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Companion state file is not a regular file");
   }
   let handle;
   try {
-    handle = await fs36.open(
+    handle = await fs37.open(
       filePath,
       constants2.O_RDONLY | constants2.O_NOFOLLOW
     );
@@ -32599,27 +32590,27 @@ async function atomicWriteJson(filePath, value) {
 }
 async function atomicWriteText(filePath, contents, mode) {
   await assertNotSymlink(filePath, "Companion state file");
-  await fs36.mkdir(path40.dirname(filePath), {
+  await fs37.mkdir(path41.dirname(filePath), {
     recursive: true,
     mode: 448
   });
   const temporary = `${filePath}.${randomUUID3()}.tmp`;
   try {
-    await fs36.writeFile(temporary, contents, {
+    await fs37.writeFile(temporary, contents, {
       mode,
       flag: "wx"
     });
-    await fs36.rename(temporary, filePath);
-    await fs36.chmod(filePath, mode).catch(() => void 0);
+    await fs37.rename(temporary, filePath);
+    await fs37.chmod(filePath, mode).catch(() => void 0);
   } finally {
-    await fs36.rm(temporary, { force: true }).catch(() => void 0);
+    await fs37.rm(temporary, { force: true }).catch(() => void 0);
   }
 }
 async function realRegularFile(filePath, executable) {
-  const real = await fs36.realpath(filePath);
-  const stat5 = await fs36.stat(real);
+  const real = await fs37.realpath(filePath);
+  const stat5 = await fs37.stat(real);
   if (!stat5.isFile()) throw new Error("Companion launch target is not a file");
-  await fs36.access(real, executable ? constants2.X_OK : constants2.R_OK);
+  await fs37.access(real, executable ? constants2.X_OK : constants2.R_OK);
   return real;
 }
 function defaultLaunch(executable) {
@@ -32635,7 +32626,7 @@ async function companionIsRunning(platform, executable) {
   if (platform !== "win32") return false;
   let handle;
   try {
-    handle = await fs36.open(executable, "r+");
+    handle = await fs37.open(executable, "r+");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return false;
@@ -32716,7 +32707,7 @@ async function statusCompanion(options) {
       realRegularFile(runtime.nodeExecutable, options.platform !== "win32"),
       realRegularFile(runtime.cliEntry, false)
     ]);
-    const executable = path40.join(
+    const executable = path41.join(
       paths.targetRoot,
       ...install.entryRelativePath.split("/")
     );
@@ -32749,7 +32740,7 @@ async function snapshotFile(filePath) {
 }
 async function restoreFile(filePath, bytes) {
   if (bytes === null) {
-    await fs36.rm(filePath, { force: true });
+    await fs37.rm(filePath, { force: true });
   } else {
     await atomicWriteJson(filePath, JSON.parse(bytes.toString("utf8")));
   }
@@ -32764,8 +32755,8 @@ async function converge(options, force) {
   if (artifactManifest.platform !== options.platform || artifactManifest.architecture !== options.architecture) {
     throw new Error("Companion artifact does not match this OS and architecture");
   }
-  const payloadRoot = path40.join(
-    path40.dirname(options.artifactManifestPath),
+  const payloadRoot = path41.join(
+    path41.dirname(options.artifactManifestPath),
     "payload"
   );
   await verifyArtifactSource(payloadRoot, artifactManifest);
@@ -32785,7 +32776,7 @@ async function converge(options, force) {
   if (priorInstalled) {
     await assertCompanionNotRunning(
       options,
-      path40.join(
+      path41.join(
         priorInstalled.paths.targetRoot,
         ...priorInstalled.install.entryRelativePath.split("/")
       )
@@ -32793,7 +32784,7 @@ async function converge(options, force) {
   }
   if (current.state === "not-installed") {
     try {
-      await fs36.lstat(paths.targetRoot);
+      await fs37.lstat(paths.targetRoot);
       throw new Error(
         "The fixed companion target exists without an owned install manifest"
       );
@@ -32804,7 +32795,7 @@ async function converge(options, force) {
   const stage = `${paths.targetRoot}.m8t-stage-${randomUUID3()}`;
   const backup = `${paths.targetRoot}.m8t-backup-${randomUUID3()}`;
   const copy = options.copyPayload ?? copyArtifactPayload;
-  await fs36.mkdir(path40.dirname(paths.targetRoot), {
+  await fs37.mkdir(path41.dirname(paths.targetRoot), {
     recursive: true,
     mode: 448
   });
@@ -32821,12 +32812,12 @@ async function converge(options, force) {
   try {
     await copy(payloadRoot, stage, artifactManifest);
     try {
-      await fs36.rename(paths.targetRoot, backup);
+      await fs37.rename(paths.targetRoot, backup);
       movedPrior = true;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    await fs36.rename(stage, paths.targetRoot);
+    await fs37.rename(stage, paths.targetRoot);
     installedStage = true;
     const nodeExecutable = await realRegularFile(
       options.nodeExecutable,
@@ -32868,7 +32859,7 @@ async function converge(options, force) {
       await readClosedJson(paths.runtimeBinding),
       options.platform
     );
-    const executable = path40.join(
+    const executable = path41.join(
       paths.targetRoot,
       ...artifactManifest.entryRelativePath.split("/")
     );
@@ -32878,7 +32869,7 @@ async function converge(options, force) {
       platform: options.platform,
       executable: ownedExecutable
     }));
-    priorLoginExecutable = priorInstalled ? path40.join(
+    priorLoginExecutable = priorInstalled ? path41.join(
       priorInstalled.paths.targetRoot,
       ...priorInstalled.install.entryRelativePath.split("/")
     ) : executable;
@@ -32889,7 +32880,7 @@ async function converge(options, force) {
     );
     loginChanged = true;
     await (options.launch ?? defaultLaunch)(executable);
-    await fs36.rm(backup, { recursive: true, force: true });
+    await fs37.rm(backup, { recursive: true, force: true });
     return {
       state: "installed",
       version: artifactManifest.version,
@@ -32903,15 +32894,15 @@ async function converge(options, force) {
         () => void 0
       );
     }
-    await fs36.rm(stage, { recursive: true, force: true }).catch(() => void 0);
+    await fs37.rm(stage, { recursive: true, force: true }).catch(() => void 0);
     if (installedStage) {
-      await fs36.rm(paths.targetRoot, {
+      await fs37.rm(paths.targetRoot, {
         recursive: true,
         force: true
       }).catch(() => void 0);
     }
     if (movedPrior) {
-      await fs36.rename(backup, paths.targetRoot).catch(() => void 0);
+      await fs37.rename(backup, paths.targetRoot).catch(() => void 0);
     }
     await Promise.all([
       restoreFile(paths.installManifest, snapshots[0]),
@@ -32937,14 +32928,14 @@ async function uninstallCompanion(options) {
   if (install.ownedTargetRoot !== paths.targetRoot) {
     throw new Error("Refusing to remove a non-owned companion target");
   }
-  const executable = path40.join(
+  const executable = path41.join(
     paths.targetRoot,
     ...install.entryRelativePath.split("/")
   );
   await assertCompanionNotRunning(options, executable);
   await (options.setStartAtLogin ?? (() => Promise.resolve()))(executable, false);
   const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
-    await fs36.rm(ownedPath, { recursive, force: true });
+    await fs37.rm(ownedPath, { recursive, force: true });
   });
   await remove(paths.targetRoot, true);
   await remove(paths.installManifest, false);
@@ -32954,8 +32945,8 @@ async function uninstallCompanion(options) {
 }
 
 // src/commands/companion/install.ts
-import * as os18 from "os";
-import * as path42 from "path";
+import * as os19 from "os";
+import * as path43 from "path";
 import { Command as Command59, Option as Option56 } from "clipanion";
 
 // src/lib/companion-channel.ts
@@ -32973,9 +32964,9 @@ async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps =
 // src/lib/companion-download.ts
 import { createHash as createHash8 } from "crypto";
 import { execFile as execFile2 } from "child_process";
-import * as fs37 from "fs/promises";
-import * as os17 from "os";
-import * as path41 from "path";
+import * as fs38 from "fs/promises";
+import * as os18 from "os";
+import * as path42 from "path";
 init_errors();
 var MAX_ASSET_BYTES = 512 * 1024 * 1024;
 function extractArchive(archive, into) {
@@ -33028,20 +33019,20 @@ async function downloadCompanionArtifact(component, deps = {}) {
       hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
     });
   }
-  const root = await (deps.makeTemporaryDirectory ?? (() => fs37.mkdtemp(path41.join(os17.tmpdir(), "m8t-companion-"))))();
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs38.mkdtemp(path42.join(os18.tmpdir(), "m8t-companion-"))))();
   const dispose = async () => {
-    await fs37.rm(root, { recursive: true, force: true }).catch(() => void 0);
+    await fs38.rm(root, { recursive: true, force: true }).catch(() => void 0);
   };
   try {
-    const archive = path41.join(root, pinned.asset);
-    await fs37.writeFile(archive, bytes, { mode: 384 });
-    const unpacked = path41.join(root, "unpacked");
-    await fs37.mkdir(unpacked, { recursive: false, mode: 448 });
+    const archive = path42.join(root, pinned.asset);
+    await fs38.writeFile(archive, bytes, { mode: 384 });
+    const unpacked = path42.join(root, "unpacked");
+    await fs38.mkdir(unpacked, { recursive: false, mode: 448 });
     await (deps.extract ?? extractArchive)(archive, unpacked);
-    await fs37.rm(archive, { force: true });
+    await fs38.rm(archive, { force: true });
     return {
       version: component.version,
-      artifactManifestPath: path41.join(unpacked, "artifact-v1.json"),
+      artifactManifestPath: path42.join(unpacked, "artifact-v1.json"),
       dispose
     };
   } catch (error) {
@@ -33054,7 +33045,7 @@ async function downloadCompanionArtifact(component, deps = {}) {
 function defaultLocalCompanionInstallOptions() {
   const cliEntry = process.argv[1];
   if (!cliEntry) throw new Error("Cannot resolve the installed CLI entry");
-  const homeDirectory = os18.homedir();
+  const homeDirectory = os19.homedir();
   const platform = process.platform;
   return {
     homeDirectory,
@@ -33072,7 +33063,7 @@ async function convergeCompanionFromChannel(converge2, options = {}) {
   let artifactManifestPath;
   let dispose = () => Promise.resolve();
   if (stagedDirectory !== void 0) {
-    artifactManifestPath = path42.resolve(stagedDirectory, "artifact-v1.json");
+    artifactManifestPath = path43.resolve(stagedDirectory, "artifact-v1.json");
   } else {
     const release = await readCompanionRelease(
       platformVersion !== void 0 ? { channel: true, version: platformTag(platformVersion) } : { url: CHANNEL_LATEST_URL }
@@ -33148,9 +33139,9 @@ function resolveRepoRootMarker(args) {
   if (args.existing !== null && args.existing !== "") return args.existing;
   return args.cwd;
 }
-async function looksLikeCheckout(dir) {
+async function looksLikeCheckout(dir2) {
   try {
-    return (await fs38.stat(path43.join(dir, "brain-template"))).isDirectory();
+    return (await fs39.stat(path44.join(dir2, "brain-template"))).isDirectory();
   } catch {
     return false;
   }
@@ -33166,21 +33157,21 @@ var defaultDeps3 = {
   convergeCompanion: (platformVersion) => convergeCompanionFromChannel(installCompanion, {
     ...platformVersion !== void 0 ? { platformVersion } : {}
   }),
-  homedir: () => os19.homedir()
+  homedir: () => os20.homedir()
 };
 async function finalizeInstall(args, deps = defaultDeps3) {
-  const markerDir = path43.join(deps.homedir(), ".m8t");
-  const markerPath = path43.join(markerDir, "repo-root");
+  const markerDir = path44.join(deps.homedir(), ".m8t");
+  const markerPath = path44.join(markerDir, "repo-root");
   const cwd = process.cwd();
-  const existing = await fs38.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
+  const existing = await fs39.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
   const repoRoot = resolveRepoRootMarker({
     ...args.repoRoot !== void 0 ? { explicit: args.repoRoot } : {},
     cwd,
     cwdIsCheckout: await looksLikeCheckout(cwd),
     existing
   });
-  await fs38.mkdir(markerDir, { recursive: true });
-  await fs38.writeFile(markerPath, `${repoRoot}
+  await fs39.mkdir(markerDir, { recursive: true });
+  await fs39.writeFile(markerPath, `${repoRoot}
 `, "utf8");
   let webappUrl;
   try {
@@ -33258,7 +33249,7 @@ async function finalizeInstall(args, deps = defaultDeps3) {
   }
   let brainOrg = null;
   try {
-    const credsRaw = await fs38.readFile(path43.join(markerDir, "github-app.json"), "utf8");
+    const credsRaw = await fs39.readFile(path44.join(markerDir, "github-app.json"), "utf8");
     const creds = JSON.parse(credsRaw);
     brainOrg = typeof creds.org === "string" ? creds.org : null;
   } catch {
@@ -33371,7 +33362,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
       typeof this.output === "string" ? this.output : void 0,
       this.context.stdout
     );
-    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
     const watch = this.watch === true;
     const invokedPath = this.path ?? [];
     const viaFinishAlias = invokedPath[invokedPath.length - 1] === "finish";
@@ -33404,7 +33395,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
           }
           if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
 `);
-          await sleep5(1e4);
+          await sleep4(1e4);
           continue;
         }
         throw e;
@@ -33440,7 +33431,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         );
         return 1;
       }
-      await sleep5(1e4);
+      await sleep4(1e4);
     }
   }
   /**
@@ -33690,18 +33681,13 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import * as fs40 from "fs";
-import * as os21 from "os";
-import * as path45 from "path";
 import { Command as Command62, Option as Option59 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
-init_errors();
 
 // src/lib/bootstrap-ui.ts
-import * as fs39 from "fs";
+import * as fs40 from "fs";
 import * as net from "net";
-import * as os20 from "os";
-import * as path44 from "path";
+import * as os21 from "os";
+import * as path45 from "path";
 import { randomBytes as randomBytes3 } from "crypto";
 import { spawn as spawn8, spawnSync as spawnSync6 } from "child_process";
 init_errors();
@@ -33709,475 +33695,32 @@ init_rbac();
 
 // src/lib/intake-agent.ts
 init_esm();
-var INTAKE_PERSONA = "ezra-intake";
-var INTAKE_AGENT = INTAKE_AGENT_NAME;
-var ADVISOR_TO_INTAKE_CODE = /* @__PURE__ */ new Map([
-  ["ADVISOR_PERSONA_MISSING", "INTAKE_PERSONA_MISSING"],
-  ["ADVISOR_PERSONA_EMPTY", "INTAKE_PERSONA_EMPTY"],
-  ["ADVISOR_NO_MODEL", "INTAKE_NO_MODEL"],
-  ["ADVISOR_BAD_EFFORT", "INTAKE_BAD_EFFORT"],
-  ["ADVISOR_BAD_TOOLS", "INTAKE_BAD_TOOLS"]
-]);
-async function deployIntakeAgent(args) {
-  try {
-    return await deployPromptAdvisor({
-      credential: args.credential,
-      endpoint: args.endpoint,
-      repoRoot: args.repoRoot,
-      persona: INTAKE_PERSONA,
-      agentName: INTAKE_AGENT,
-      model: args.model,
-      fieldOverrides: args.fieldOverrides
-    });
-  } catch (e) {
-    if (e && typeof e === "object" && "code" in e) {
-      const err = e;
-      const intakeCode = ADVISOR_TO_INTAKE_CODE.get(err.code);
-      if (intakeCode) {
-        const { LocalCliError: LocalCliError2 } = await Promise.resolve().then(() => (init_errors(), errors_exports));
-        throw new LocalCliError2({
-          code: intakeCode,
-          message: err.message,
-          hint: err.hint,
-          cause: err.cause
-        });
-      }
-    }
-    throw e;
-  }
-}
 
 // src/lib/bootstrap-ui.ts
-function sleep3(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
-}
-function isAuthorizationShapedError(error) {
-  const seen = /* @__PURE__ */ new Set();
-  let current = error;
-  while (current != null && !seen.has(current)) {
-    seen.add(current);
-    if (typeof current === "object") {
-      const record = current;
-      if (record.statusCode === 403) return true;
-      if (typeof record.message === "string" && /403|Forbidden|PermissionDenied|not authorized/i.test(record.message)) return true;
-      current = record.cause;
-      continue;
-    }
-    if (typeof current === "string" && /403|Forbidden|PermissionDenied|not authorized/i.test(current)) return true;
-    break;
-  }
-  return false;
-}
-async function deployIntakeAgentWithRetry(args) {
-  const maxWaitMs = args.maxWaitMs ?? 3e5;
-  const intervalMs = args.intervalMs ?? 1e4;
-  const deadline = Date.now() + maxWaitMs;
-  for (; ; ) {
-    try {
-      return await deployIntakeAgent({
-        credential: args.credential,
-        endpoint: args.endpoint,
-        repoRoot: args.repoRoot,
-        model: args.model,
-        fieldOverrides: args.fieldOverrides
-      });
-    } catch (error) {
-      if (!isAuthorizationShapedError(error)) throw error;
-      const remainingMs = deadline - Date.now();
-      if (remainingMs <= 0) {
-        throw new LocalCliError({
-          code: "BOOTSTRAP_UI_ROLE_PROPAGATION_TIMEOUT",
-          message: "Timed out waiting for Azure role propagation before deploying the intake agent.",
-          hint: "Azure role propagation can take a few minutes - re-run 'm8t bootstrap ui' (idempotent).",
-          cause: error
-        });
-      }
-      args.onWait?.("waiting for Azure role propagation...");
-      await sleep3(Math.min(intervalMs, remainingMs));
-    }
-  }
-}
-function renderNotReadyHint(resourceGroup, excluded) {
-  const lines = ["Check 'm8t bootstrap status --watch' \u2014 the install may have stalled in foundry-create."];
-  if (resourceGroup) {
-    if (excluded.length > 0) {
-      const count = excluded.length === 1 ? "1 project" : `${excluded.length.toString()} projects`;
-      const verb = excluded.length === 1 ? "was" : "were";
-      lines.push(
-        `Discovery is scoped to this install's resource group (${resourceGroup}) on purpose, so it can`,
-        `never deploy into someone else's project. ${count} elsewhere in this subscription ${verb}`,
-        "skipped:",
-        ...excluded.map((c) => `  ${c.endpoint}`)
-      );
-    }
-    lines.push(
-      "If ~/.m8t/bootstrap.json names a different install than the one you meant, re-run with",
-      "--endpoint <projectEndpoint>."
-    );
-  }
-  return lines.join("\n");
-}
-async function resolveFoundryEndpointWithWait(args, opts = {}) {
-  const pollMs = opts.pollMs ?? 1e4;
-  const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
-  const deadline = Date.now() + timeoutMs;
-  let excluded = [];
-  for (; ; ) {
-    try {
-      excluded = [];
-      const p = await resolveFoundryProject({
-        credential: args.credential,
-        subscriptionId: args.subscriptionId,
-        interactive: false,
-        // When the install's own resource group holds multiple projects, an
-        // explicit endpoint disambiguates instead of FOUNDRY_PROJECT_MULTIPLE.
-        // Omitted → single-project auto-discovery within that group.
-        endpoint: args.endpoint,
-        resourceGroup: args.resourceGroup,
-        onScopedOut: (dropped) => {
-          excluded = dropped;
-        }
-      });
-      return { endpoint: p.endpoint, accountScope: p.accountScope };
-    } catch (e) {
-      if (e instanceof LocalCliError && e.code === "FOUNDRY_PROJECT_MULTIPLE") {
-        throw new LocalCliError({
-          code: "BOOTSTRAP_UI_MULTIPLE_PROJECTS",
-          message: `${e.message} bootstrap ui can't pick one safely (it must not deploy the intake agent into the wrong project).`,
-          hint: [
-            "Re-run naming the project you want:",
-            'm8t bootstrap ui --repo-root "$(pwd)" --endpoint <projectEndpoint>',
-            "'m8t bootstrap status' prints this install's endpoint (result.foundryEndpoint)."
-          ].join("\n"),
-          cause: e
-        });
-      }
-      if (!(e instanceof LocalCliError && e.code === "FOUNDRY_PROJECT_ZERO")) {
-        throw e;
-      }
-      if (Date.now() >= deadline) {
-        throw new LocalCliError({
-          code: "BOOTSTRAP_UI_FOUNDRY_NOT_READY",
-          message: args.resourceGroup ? `Foundry is not ready yet \u2014 no AI project appeared in resource group ${args.resourceGroup} before the timeout.` : "Foundry is not ready yet \u2014 no AI project appeared in your subscription before the timeout.",
-          hint: renderNotReadyHint(args.resourceGroup, excluded),
-          cause: e
-        });
-      }
-      opts.onWait?.("waiting for Foundry-create to finish\u2026");
-      await sleep3(pollMs);
-    }
-  }
-}
-async function getSignedInUserOid() {
-  const oid = (await runAz(["ad", "signed-in-user", "show", "--query", "id", "-o", "tsv"])).trim();
-  if (!oid) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_NO_SIGNED_IN_USER",
-      message: "Could not resolve the signed-in user (az ad signed-in-user show returned nothing).",
-      hint: "Personal Microsoft accounts can't be resolved this way \u2014 sign in with a work/school account."
-    });
-  }
-  return oid;
-}
-async function ensureFounderFoundryRole(args) {
-  await grantFoundryUser({
-    credential: args.credential,
-    subscriptionId: args.subscriptionId,
-    accountScope: args.accountScope,
-    principalId: args.principalId,
-    principalType: "User"
-  });
-}
-function writeWebEnvLocal(args) {
-  const envPath = path44.join(args.repoRoot, "apps", "web", ".env.local");
-  let prior = "";
-  if (fs39.existsSync(envPath)) {
-    prior = fs39.readFileSync(envPath, "utf8");
-    fs39.copyFileSync(envPath, envPath + ".bak");
-  }
-  const priorSecret = readValidInternalSecret(prior);
-  const internalSecret = priorSecret ?? (args.randomBytesImpl ?? randomBytes3)(32).toString("base64url");
-  if (!isValidInternalSecret(internalSecret)) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_INTERNAL_SECRET_GENERATION_FAILED",
-      message: "Could not generate a valid local internal service secret."
-    });
-  }
-  const body = [
-    "# Written by `m8t bootstrap ui` \u2014 local onboarding run (the onboarding intake agent).",
-    "# Text-first: the intake voice stack is off unless the run passed --voice.",
-    "# STORAGE unset \u2192 gateway boot skipped; the webapp forwards your MSAL token to Foundry.",
-    `AZURE_TENANT_ID=${args.tenantId}`,
-    `AZURE_CLIENT_ID=${args.clientId}`,
-    `FOUNDRY_PROJECT_ENDPOINT=${args.foundryEndpoint}`,
-    ...args.voice ? ["VOICE_RELAY_PUBLIC_URL=ws://localhost:8790", "NEXT_PUBLIC_M8T_INTAKE_VOICE=1"] : [],
-    "STORAGE_ACCOUNT_NAME=",
-    `M8T_INTERNAL_SECRET=${internalSecret}`,
-    "M8T_SINGLE_GATEWAY_PROCESS=1",
-    "M8T_DISABLE_WORKER=1",
-    "M8T_ONBOARDING=1",
-    "NEXT_PUBLIC_M8T_ONBOARDING=1",
-    ""
-  ].join("\n");
-  fs39.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
-  try {
-    fs39.chmodSync(envPath, 384);
-  } catch {
-  }
-  return envPath;
-}
-function isValidInternalSecret(value) {
-  if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value)) return false;
-  const decoded = Buffer.from(value, "base64url");
-  return decoded.length === 32 && decoded.toString("base64url") === value;
-}
-function readValidInternalSecret(envText) {
-  const values = envText.split(/\r?\n/).filter((line2) => line2.startsWith("M8T_INTERNAL_SECRET=")).map((line2) => line2.slice("M8T_INTERNAL_SECRET=".length));
-  if (values.length !== 1) return void 0;
-  return isValidInternalSecret(values[0]) ? values[0] : void 0;
-}
-function readWebInternalSecret(repoRoot) {
-  const envPath = path44.join(repoRoot, "apps", "web", ".env.local");
-  let secret;
-  try {
-    secret = readValidInternalSecret(fs39.readFileSync(envPath, "utf8"));
-  } catch {
-    secret = void 0;
-  }
-  if (!secret) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_INTERNAL_SECRET_MISSING",
-      message: "The local web environment has no valid internal service secret.",
-      hint: "Re-run 'm8t bootstrap ui' so the web app and voice relay receive the same secret."
-    });
-  }
-  return secret;
-}
-function assertNodeVersion(versionString = process.version) {
-  const major = Number(/^v?(\d+)\./.exec(versionString)?.[1] ?? "0");
-  if (major < 20) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_NODE_TOO_OLD",
-      message: `apps/web needs Node 20+, but this is ${versionString}.`,
-      hint: "Install Node 20+ (see install/prereqs-*.md), then re-run 'm8t bootstrap ui'."
-    });
-  }
-}
-function runInherit(cmd, cmdArgs, cwd, failCode) {
-  return new Promise((resolve6, reject) => {
-    const child = spawn8(cmd, cmdArgs, { cwd, stdio: "inherit", shell: process.platform === "win32" });
-    child.on("error", (e) => {
-      reject(new LocalCliError({ code: failCode, message: `Failed to start '${cmd}': ${e.message}` }));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve6();
-      } else {
-        const opts = {
-          code: failCode,
-          message: `'${cmd} ${cmdArgs.join(" ")}' exited with code ${String(code)}.`
-        };
-        if (cmd === "pnpm") {
-          opts.hint = "Fix the pnpm error above, then re-run 'm8t bootstrap ui' (it's idempotent).";
-        }
-        reject(new LocalCliError(opts));
-      }
-    });
-  });
-}
-async function installWebDeps(repoRoot) {
-  assertNodeVersion();
-  await runInherit("corepack", ["enable"], repoRoot, "BOOTSTRAP_UI_COREPACK_FAILED").catch(() => {
-  });
-  await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
-}
-function onboardingUiPaths(home = os20.homedir()) {
-  const dir = path44.join(home, ".m8t");
+function onboardingUiPaths(home = os21.homedir()) {
+  const dir2 = path45.join(home, ".m8t");
   return {
-    logPath: path44.join(dir, "onboarding-ui.log"),
-    pidPath: path44.join(dir, "onboarding-ui.pid")
+    logPath: path45.join(dir2, "onboarding-ui.log"),
+    pidPath: path45.join(dir2, "onboarding-ui.pid")
   };
 }
-function onboardingRelayPaths(home = os20.homedir()) {
-  const dir = path44.join(home, ".m8t");
+function onboardingRelayPaths(home = os21.homedir()) {
+  const dir2 = path45.join(home, ".m8t");
   return {
-    logPath: path44.join(dir, "onboarding-relay.log"),
-    pidPath: path44.join(dir, "onboarding-relay.pid")
+    logPath: path45.join(dir2, "onboarding-relay.log"),
+    pidPath: path45.join(dir2, "onboarding-relay.pid")
   };
 }
-function isLocalPortOpen(port) {
-  return new Promise((resolve6) => {
-    const s = net.createConnection({ host: "127.0.0.1", port });
-    s.setTimeout(1e3);
-    s.on("connect", () => {
-      s.destroy();
-      resolve6(true);
-    });
-    s.on("error", () => {
-      resolve6(false);
-    });
-    s.on("timeout", () => {
-      s.destroy();
-      resolve6(false);
-    });
-  });
-}
-function removePidFile(pidPath) {
-  try {
-    fs39.unlinkSync(pidPath);
-  } catch {
-  }
-}
 function parseManagedPid(text) {
   if (!/^[1-9]\d*$/.test(text)) return null;
   const pid = Number(text);
   if (!Number.isSafeInteger(pid) || pid < 2 || pid === process.pid || pid === process.ppid) return null;
   return pid;
 }
-function readLiveManagedPid(pidPath) {
-  let text;
-  try {
-    text = fs39.readFileSync(pidPath, "utf8").trim();
-  } catch {
-    return null;
-  }
-  const pid = parseManagedPid(text);
-  if (pid == null) {
-    removePidFile(pidPath);
-    return null;
-  }
-  try {
-    process.kill(pid, 0);
-    return pid;
-  } catch (error) {
-    const code = error.code;
-    if (code === "ESRCH") {
-      removePidFile(pidPath);
-      return null;
-    }
-    if (code === "EPERM") return pid;
-    throw error;
-  }
-}
-async function serveOnboardingUiDetached(args) {
-  const { logPath, pidPath } = onboardingUiPaths();
-  const portNum = Number(args.port);
-  const isPortOpen = () => isLocalPortOpen(portNum);
-  const portOpen = await isPortOpen();
-  const managedPid = readLiveManagedPid(pidPath);
-  if (portOpen && managedPid != null) {
-    return { alreadyRunning: true, logPath };
-  }
-  if (portOpen) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_PORT_IN_USE",
-      message: `Port ${args.port} is occupied by a process not started by m8t bootstrap.`,
-      hint: `Stop the process using port ${args.port}, then re-run 'm8t bootstrap ui'.`
-    });
-  }
-  if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs39.mkdirSync(path44.dirname(logPath), { recursive: true });
-  const fd = fs39.openSync(logPath, "a");
-  const child = spawn8("pnpm", ["--filter", "web", "dev"], {
-    cwd: args.repoRoot,
-    detached: true,
-    stdio: ["ignore", fd, fd],
-    env: { ...process.env, PORT: args.port, M8T_SINGLE_GATEWAY_PROCESS: "1" },
-    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
-    shell: process.platform === "win32"
-  });
-  fs39.closeSync(fd);
-  if (child.pid == null) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_DEV_SPAWN_FAILED",
-      message: "Could not start the web dev server (pnpm did not spawn).",
-      hint: "Check that pnpm + Node 20+ are installed; see the log at " + logPath + "."
-    });
-  }
-  child.unref();
-  fs39.writeFileSync(pidPath, String(child.pid), "utf8");
-  const deadline = Date.now() + 45e3;
-  const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
-  while (Date.now() < deadline) {
-    await sleep5(500);
-    if (await isPortOpen()) break;
-  }
-  return { alreadyRunning: false, logPath };
-}
-async function serveOnboardingRelayDetached(args) {
-  const { logPath, pidPath } = onboardingRelayPaths();
-  const portNum = 8790;
-  if (args.webInternalBaseUrl !== "http://localhost:3000") {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_INTERNAL_BASE_URL_INVALID",
-      message: "The local voice relay internal base URL must be http://localhost:3000."
-    });
-  }
-  const internalSecret = readWebInternalSecret(args.repoRoot);
-  const portOpen = await isLocalPortOpen(portNum);
-  const managedPid = readLiveManagedPid(pidPath);
-  if (portOpen && managedPid != null) {
-    return { alreadyRunning: true, logPath };
-  }
-  if (portOpen) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_RELAY_PORT_IN_USE",
-      message: "Port 8790 is occupied by a process not started by m8t bootstrap.",
-      hint: "Stop the process using port 8790, then re-run 'm8t bootstrap ui'."
-    });
-  }
-  if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs39.mkdirSync(path44.dirname(logPath), { recursive: true });
-  const fd = fs39.openSync(logPath, "a");
-  const child = spawn8("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
-    cwd: args.repoRoot,
-    detached: true,
-    stdio: ["ignore", fd, fd],
-    env: {
-      ...process.env,
-      FOUNDRY_PROJECT_ENDPOINT: args.foundryEndpoint,
-      AZURE_TENANT_ID: args.tenantId,
-      AZURE_CLIENT_ID: args.clientId,
-      RELAY_ALLOWED_ORIGINS: "http://localhost:3000",
-      RELAY_PORT: "8790",
-      M8T_INTERNAL_SECRET: internalSecret,
-      WEB_INTERNAL_BASE_URL: args.webInternalBaseUrl
-    },
-    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
-    shell: process.platform === "win32"
-  });
-  fs39.closeSync(fd);
-  if (child.pid == null) {
-    throw new LocalCliError({
-      code: "BOOTSTRAP_UI_RELAY_SPAWN_FAILED",
-      message: "Could not start the voice relay (pnpm did not spawn).",
-      hint: "Check that pnpm + Node 20+ are installed; see the log at " + logPath + "."
-    });
-  }
-  child.unref();
-  fs39.writeFileSync(pidPath, String(child.pid), "utf8");
-  const deadline = Date.now() + 45e3;
-  const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
-  while (Date.now() < deadline) {
-    await sleep5(500);
-    if (await isLocalPortOpen(portNum)) break;
-  }
-  return { alreadyRunning: false, logPath };
-}
-function autoOpenOnboardingUi(url, open3 = tryOpenUrl) {
-  try {
-    const result2 = open3(url);
-    if (result2 instanceof Promise) {
-      result2.catch(() => {
-      });
-    }
-  } catch {
-  }
-}
 function stopPidFile(pidPath) {
   let pidStr;
   try {
-    pidStr = fs39.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs40.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -34194,551 +33737,386 @@ function stopPidFile(pidPath) {
     }
   }
   try {
-    fs39.unlinkSync(pidPath);
+    fs40.unlinkSync(pidPath);
   } catch {
   }
   return true;
 }
-function stopOnboardingUi(home = os20.homedir()) {
+function stopOnboardingUi(home = os21.homedir()) {
   const uiStopped = stopPidFile(onboardingUiPaths(home).pidPath);
   const relayStopped = stopPidFile(onboardingRelayPaths(home).pidPath);
   return uiStopped || relayStopped;
 }
-function buildIntakeFieldOverrides(args) {
-  return {
-    founder_identity_note: args.founderIdentityNote,
-    chosen_model_note: args.chosenModelNote,
-    ...args.inventoryNote ? { subscription_inventory_note: args.inventoryNote } : {}
-  };
-}
 
-// src/lib/model-catalog.ts
-async function listAgentModels(region) {
-  let out;
-  try {
-    out = await runAz(["cognitiveservices", "model", "list", "-l", region, "--output", "json"]);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    const denied = /AuthorizationFailed|Forbidden|\b403\b|does not have authorization/i.test(msg);
-    return { ok: false, error: denied ? "denied" : "unavailable" };
-  }
-  let raw;
-  try {
-    raw = JSON.parse(out);
-  } catch {
-    return { ok: false, error: "malformed" };
-  }
-  if (!Array.isArray(raw) || raw.some((e) => typeof e !== "object" || e === null)) {
-    return { ok: false, error: "malformed" };
-  }
-  try {
-    const rows = raw.map((e) => ({
-      format: e.model?.format ?? "",
-      name: e.model?.name ?? "",
-      version: e.model?.version ?? "",
-      skus: [...new Set((e.model?.skus ?? []).map((s) => s.name ?? "").filter(Boolean))],
-      agentsV2: e.model?.capabilities?.agentsV2 === "true"
-    }));
-    return { ok: true, rows };
-  } catch {
-    return { ok: false, error: "malformed" };
-  }
+// src/commands/bootstrap/ui.ts
+function renderDeprecationNotice() {
+  return `${colors.error("\u26A0")} 'm8t bootstrap ui' is deprecated and does nothing \u2014 the local onboarding chat is gone for good.
+  Your details + chat while you wait: ${colors.field("m8t bootstrap profile")} \xB7 Your own Ezra, once installed: ${colors.field("m8t open")}
+`;
 }
+var BootstrapUiCommand = class extends M8tCommand {
+  static paths = [["bootstrap", "ui"]];
+  static usage = Command62.Usage({
+    description: "DEPRECATED \u2014 does nothing. Use `m8t bootstrap profile` instead.",
+    details: [
+      "The local onboarding chat has been retired. Your details are collected by",
+      "`m8t bootstrap profile`, which also opens the hosted Ezra to talk to while the",
+      "install runs; `m8t open` reaches your own Ezra once the install finishes.",
+      "",
+      "This command deploys nothing, serves nothing, and changes nothing. Every flag",
+      "below is accepted and ignored, so an older runbook or script still exits cleanly.",
+      "`--stop` is the one exception: it still shuts down a chat server left running by",
+      "an earlier version of this command."
+    ].join("\n"),
+    examples: [
+      ["Collect your details and open Ezra instead", "$0 bootstrap profile"],
+      ["Stop a chat UI an older CLI left running", "$0 bootstrap ui --stop"]
+    ]
+  });
+  // Accepted and ignored, deliberately: removing them would turn an old script's
+  // harmless no-op into an "unknown option" failure mid-install. CLI-rewrite: drop
+  // the whole surface when the rewrite lands.
+  repoRoot = Option59.String("--repo-root", { description: "Ignored (deprecated)." });
+  port = Option59.String("--port", "3000", { description: "Ignored (deprecated)." });
+  endpoint = Option59.String("--endpoint", { description: "Ignored (deprecated)." });
+  prepOnly = Option59.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
+  skipInstall = Option59.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
+  foreground = Option59.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
+  voice = Option59.Boolean("--voice", false, { description: "Ignored (deprecated)." });
+  stop = Option59.Boolean("--stop", false, {
+    description: "Shut down a local chat UI left running by an earlier version of this command."
+  });
+  // Not `async`: there is nothing left to await. Everything this command used to
+  // wait on — Foundry, the role grant, the agent deploy, pnpm — is gone.
+  executeCommand() {
+    if (this.stop === true) {
+      const stopped = stopOnboardingUi();
+      this.context.stdout.write(
+        stopped ? `${colors.success("\u2713")} stopped the onboarding chat UI.
+` : `  ${colors.dim("nothing to stop (no onboarding-ui.pid found).")}
+`
+      );
+      return Promise.resolve(0);
+    }
+    this.context.stdout.write(renderDeprecationNotice());
+    return Promise.resolve(0);
+  }
+};
+
+// src/commands/bootstrap/profile.ts
+import * as readline3 from "readline/promises";
+import { Command as Command63, Option as Option60 } from "clipanion";
 
-// src/lib/intake-model.ts
-var DEFAULT_DEADLINE_MS = 18e4;
-var SCOPE_RE = /\/resourceGroups\/([^/]+)\/providers\/Microsoft\.CognitiveServices\/accounts\/([^/]+)/i;
-function parseAccountScope(scope) {
-  const m = SCOPE_RE.exec(scope);
-  return m ? { resourceGroup: m[1], account: m[2] } : null;
+// src/lib/profile-collect.ts
+init_errors();
+function looksLikeEmail(value) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim());
 }
-function narrate(model, outcome, region) {
-  if (outcome === "deployed") return `${model} - ready`;
-  return `${model} - not available for your subscription in ${region}`;
+function renderEmailQuestion(prefill) {
+  const base = "Your email (Ezra sends your copies of its outbound mail here)";
+  return prefill ? `${base} [${prefill}]: ` : `${base}: `;
 }
-async function accountRegion(account, resourceGroup, fallback) {
-  try {
-    const out = await runAz([
-      "cognitiveservices",
-      "account",
-      "show",
-      "--name",
-      account,
-      "--resource-group",
-      resourceGroup,
-      "--query",
-      "location",
-      "-o",
-      "tsv"
-    ]);
-    return out.trim() || fallback;
-  } catch {
-    return fallback;
-  }
+var ADVISOR_LEAD = "Your Microsoft startup advisor's name + email (Ezra emails them\nonly when you ask it to \u2014 e.g. quota requests). It's OK if you don't\nknow it yet \u2014 skip for now.\n";
+function renderAdvisorQuestion(label, prior) {
+  return prior ? `  ${label} [${prior}] (Enter to keep): ` : `  ${label} (Enter to skip): `;
 }
-async function resolveIntakeModel(args) {
-  const floorTrace = (outcome, detail) => WHITELIST.map((r) => ({ model: r.model, outcome, ...detail === void 0 ? {} : { detail } }));
-  const degradeToFloor = (detail) => {
-    const trace = floorTrace("catalog-unverified", detail);
-    return { model: void 0, note: renderChosenModelNote(decideNote(WHITELIST, { chosen: null, trace })), trace };
-  };
-  const parsed = parseAccountScope(args.accountScope);
-  if (!parsed) return degradeToFloor(`unparseable account scope: ${args.accountScope}`);
-  try {
-    const region = await accountRegion(parsed.account, parsed.resourceGroup, args.fallbackRegion);
-    args.onNarrate?.("choosing the best model your subscription can run...");
-    const [catalog, quota] = await Promise.all([listAgentModels(region), listModelQuota(region)]);
-    const plan = planCascade(WHITELIST, catalog, quota);
-    const deploy = async (rung) => {
-      await ensureDeployment({
-        account: parsed.account,
-        resourceGroup: parsed.resourceGroup,
-        model: rung.model,
-        modelVersion: rung.version,
-        capacity: rung.capacity,
-        format: rung.format
-      });
-    };
-    const start = Date.now();
-    const result2 = await walkCascade(WHITELIST, plan, deploy, {
-      now: () => Date.now(),
-      deadlineAt: start + (args.deadlineMs ?? DEFAULT_DEADLINE_MS),
-      onRung: (model, outcome) => args.onNarrate?.(narrate(model, outcome, region))
-    });
+var ADVISOR_SKIPPED_LINE = "  No advisor recorded \u2014 tell Ezra any time and it'll add them.\n";
+function refuseFounderEmail() {
+  return new LocalCliError({
+    code: "PROFILE_FOUNDER_EMAIL_REQUIRED",
+    message: "I need the founder's email address.\n  Pass --founder-email <you@example.com> \u2014 Ezra sends their copies of its\n  outbound mail there. Confirm it with them; don't guess from the Azure sign-in.",
+    hint: "Ask the founder to confirm the address, then re-run 'm8t bootstrap profile --founder-email <addr>'."
+  });
+}
+function refuseMalformed(flag, value) {
+  return new LocalCliError({
+    code: "PROFILE_EMAIL_MALFORMED",
+    message: `'${value}' doesn't look like an email address. Pass ${flag} <you@example.com>.`
+  });
+}
+async function collectProfile(args) {
+  const { flags, identity, isTty, ask } = args;
+  const previous = args.previous ?? null;
+  const hasAdvisorFlag = (flags.advisorName ?? "").trim() !== "" || (flags.advisorEmail ?? "").trim() !== "";
+  if (flags.noAdvisor && hasAdvisorFlag) {
     return {
-      model: result2.chosen?.model,
-      note: renderChosenModelNote(decideNote(WHITELIST, result2)),
-      trace: result2.trace
+      ok: false,
+      error: new LocalCliError({
+        code: "PROFILE_ADVISOR_FLAGS_CONFLICT",
+        message: "--no-advisor cannot be combined with --advisor-name / --advisor-email.",
+        hint: "Drop --no-advisor to record the advisor, or drop the advisor flags to skip."
+      })
     };
-  } catch (e) {
-    return degradeToFloor(e instanceof Error ? e.message : String(e));
-  }
-}
-
-// src/lib/inventory-summary.ts
-var HEAVY_THRESHOLD = 10;
-var INVENTORY_INVITATION2 = "You can offer to walk the founder through these resources.";
-var NOTABLE_TYPES = {
-  // storage
-  "microsoft.storage/storageaccounts": "storage accounts",
-  // compute
-  "microsoft.compute/virtualmachines": "virtual machines",
-  "microsoft.compute/virtualmachinescalesets": "virtual machine scale sets",
-  "microsoft.app/containerapps": "container apps",
-  "microsoft.containerservice/managedclusters": "Kubernetes clusters",
-  "microsoft.web/sites": "web apps",
-  // data (shared noun)
-  "microsoft.sql/servers": "databases",
-  "microsoft.dbforpostgresql/servers": "databases",
-  "microsoft.dbforpostgresql/flexibleservers": "databases",
-  "microsoft.dbformysql/servers": "databases",
-  "microsoft.dbformysql/flexibleservers": "databases",
-  "microsoft.documentdb/databaseaccounts": "databases",
-  "microsoft.cache/redis": "databases",
-  // AI (shared noun)
-  "microsoft.cognitiveservices/accounts": "AI services",
-  "microsoft.machinelearningservices/workspaces": "AI services",
-  // key vaults
-  "microsoft.keyvault/vaults": "key vaults",
-  // container registries
-  "microsoft.containerregistry/registries": "container registries",
-  // messaging (shared noun)
-  "microsoft.servicebus/namespaces": "messaging namespaces",
-  "microsoft.eventhub/namespaces": "messaging namespaces",
-  // networking (shared noun); public DNS zones only — private zones are plumbing
-  "microsoft.network/virtualnetworks": "networking resources",
-  "microsoft.network/loadbalancers": "networking resources",
-  "microsoft.network/applicationgateways": "networking resources",
-  "microsoft.network/dnszones": "networking resources"
-};
-var MS_PER_DAY = 864e5;
-var REGION_MAJORITY = 0.6;
-var AGE_BUCKETS = [
-  { maxDays: 31, phrase: "all created within the last month" },
-  { maxDays: 93, phrase: "the oldest created a couple of months ago" },
-  { maxDays: 186, phrase: "the oldest created several months ago" },
-  { maxDays: 365, phrase: "the oldest created about a year ago" },
-  { maxDays: 730, phrase: "the oldest created over a year ago" }
-];
-var OLDEST_FALLBACK = "the oldest created a couple of years ago";
-function ageBucket(days) {
-  for (const b of AGE_BUCKETS) if (days <= b.maxDays) return b.phrase;
-  return OLDEST_FALLBACK;
-}
-function summarizeInventory(rows, installResourceGroup, now) {
-  const installRg = installResourceGroup.toLowerCase();
-  const notable = rows.filter(
-    (r) => r.resourceGroup.toLowerCase() !== installRg && Object.hasOwn(NOTABLE_TYPES, r.type.toLowerCase())
-  );
-  const notableCount = notable.length;
-  const byNoun = /* @__PURE__ */ new Map();
-  for (const r of notable) {
-    const noun = NOTABLE_TYPES[r.type.toLowerCase()];
-    byNoun.set(noun, (byNoun.get(noun) ?? 0) + 1);
-  }
-  const categories = [...byNoun.entries()].map(([noun, count]) => ({ noun, count })).sort((a, b) => b.count - a.count || a.noun.localeCompare(b.noun));
-  const byRegion = /* @__PURE__ */ new Map();
-  for (const r of notable) {
-    if (!r.location) continue;
-    const loc = r.location.toLowerCase();
-    byRegion.set(loc, (byRegion.get(loc) ?? 0) + 1);
-  }
-  const regionSpread = byRegion.size;
-  let topRegion = null;
-  for (const [region, count] of byRegion) {
-    if (notableCount > 0 && count / notableCount >= REGION_MAJORITY) {
-      topRegion = region;
-      break;
+  }
+  let founderEmail = (flags.founderEmail ?? "").trim();
+  if (!founderEmail) {
+    const confirmed = previous?.founderEmail.trim() ?? "";
+    const guess = identity.email.trim();
+    if (!isTty) {
+      if (!confirmed) return { ok: false, error: refuseFounderEmail() };
+      founderEmail = confirmed;
+    } else {
+      const prefill = confirmed || guess;
+      const answered = (await ask(renderEmailQuestion(prefill))).trim();
+      founderEmail = answered || prefill;
+      if (!founderEmail) return { ok: false, error: refuseFounderEmail() };
     }
   }
-  let oldestMs = null;
-  for (const r of notable) {
-    if (!r.createdTime) continue;
-    const t = Date.parse(r.createdTime);
-    if (Number.isNaN(t)) continue;
-    if (oldestMs === null || t < oldestMs) oldestMs = t;
+  if (!looksLikeEmail(founderEmail)) {
+    return { ok: false, error: refuseMalformed("--founder-email", founderEmail) };
+  }
+  let advisor;
+  if (flags.noAdvisor) {
+    advisor = null;
+  } else {
+    const prior = previous?.advisor ?? null;
+    let name = (flags.advisorName ?? "").trim();
+    let email = (flags.advisorEmail ?? "").trim();
+    if (!hasAdvisorFlag && isTty) {
+      name = (await ask(ADVISOR_LEAD + renderAdvisorQuestion("Name ", prior?.name ?? ""))).trim();
+      email = (await ask(renderAdvisorQuestion("Email", prior?.email ?? ""))).trim();
+    }
+    name = name || (prior?.name ?? "");
+    email = email || (prior?.email ?? "");
+    if (email && !looksLikeEmail(email)) {
+      return { ok: false, error: refuseMalformed("--advisor-email", email) };
+    }
+    advisor = name || email ? { name, email } : null;
   }
-  const oldestBucket = oldestMs === null ? null : ageBucket((now - oldestMs) / MS_PER_DAY);
   return {
-    verdict: notableCount >= HEAVY_THRESHOLD ? "heavy" : "light",
-    notableCount,
-    categories,
-    topRegion,
-    regionSpread,
-    oldestBucket
+    ok: true,
+    profile: {
+      schemaVersion: 1,
+      collectedAt: args.now(),
+      founderName: identity.name.trim(),
+      founderEmail,
+      advisor,
+      ...flags.noAdvisor ? { advisorCleared: true } : {}
+    }
   };
 }
-var LEAD = "I looked over what's already in this subscription, outside the resources m8t is setting up.";
-var MAX_NOUNS = 4;
-var REGION_NAMES = {
-  eastus: "East US",
-  eastus2: "East US 2",
-  westus: "West US",
-  westus2: "West US 2",
-  westus3: "West US 3",
-  centralus: "Central US",
-  southcentralus: "South Central US",
-  westeurope: "West Europe",
-  northeurope: "North Europe",
-  uksouth: "UK South",
-  swedencentral: "Sweden Central",
-  australiaeast: "Australia East",
-  eastasia: "East Asia",
-  southeastasia: "Southeast Asia"
-};
-function regionDisplay(region) {
-  return REGION_NAMES[region.toLowerCase()] ?? region;
-}
-function joinList(items) {
-  if (items.length <= 1) return items[0] ?? "";
-  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
-}
-function piecesClause(s) {
-  const shown = s.categories.slice(0, MAX_NOUNS).map((c) => `${String(c.count)} ${c.noun}`);
-  if (s.categories.length > MAX_NOUNS) {
-    return `The notable pieces: ${shown.join(", ")}, and a handful of others`;
-  }
-  return `The notable pieces: ${joinList(shown)}`;
-}
-function regionAgeClause(s) {
-  const region = s.topRegion ? `mostly in ${regionDisplay(s.topRegion)}` : s.regionSpread > 1 ? `spread across ${String(s.regionSpread)} regions` : "";
-  const parts = [region, s.oldestBucket ?? ""].filter((p) => p !== "");
-  return parts.length > 0 ? ` \u2014 ${parts.join(", ")}` : "";
-}
-function renderInventoryNote(summary) {
-  const body = summary.notableCount === 0 ? `${LEAD} There are no notable pre-existing resources.` : `${LEAD} ${piecesClause(summary)}${regionAgeClause(summary)}.`;
-  return summary.verdict === "heavy" ? `${body} ${INVENTORY_INVITATION2}` : body;
-}
-
-// src/lib/subscription-inventory.ts
-async function listSubscriptionResources(subscriptionId) {
-  let out;
-  try {
-    out = await runAz(["resource", "list", "--subscription", subscriptionId, "--output", "json"]);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    const denied = /AuthorizationFailed|Forbidden|\b403\b|does not have authorization/i.test(msg);
-    return { ok: false, error: denied ? "denied" : "unavailable" };
-  }
-  let raw;
+
+// src/lib/ezra-guides.ts
+var EZRA_REPO = "m8t-labs/ezra";
+var EZRA_GUIDES_URL = `https://github.com/${EZRA_REPO}/blob/main/guides`;
+
+// src/lib/chat-invite.ts
+var CHAT_INVITE_PATH = ".m8t/chat-invite.json";
+var CHAT_INVITE_TIMEOUT_MS = 3e3;
+var ALLOWED_INVITE_HOSTS = ["m8t.run"];
+function hostAllowed(hostname) {
+  const host = hostname.toLowerCase();
+  return ALLOWED_INVITE_HOSTS.some((allowed) => host === allowed || host.endsWith(`.${allowed}`));
+}
+var SHELL_UNSAFE = /[&|^<>"`$%\\\s]/;
+function chatInviteUrl() {
+  return `https://raw.githubusercontent.com/${EZRA_REPO}/main/${CHAT_INVITE_PATH}`;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function fetchChatInvite(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  let parsed;
   try {
-    raw = JSON.parse(out);
+    const res = await fetchImpl(chatInviteUrl(), {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(deps.timeoutMs ?? CHAT_INVITE_TIMEOUT_MS)
+    });
+    if (!res.ok) return { ok: false, reason: "http-error" };
+    const raw2 = await res.text();
+    try {
+      parsed = JSON.parse(raw2);
+    } catch {
+      return { ok: false, reason: "malformed" };
+    }
   } catch {
-    return { ok: false, error: "malformed" };
-  }
-  if (!Array.isArray(raw) || raw.some((e) => typeof e !== "object" || e === null)) {
-    return { ok: false, error: "malformed" };
-  }
-  const rows = raw.map((e) => ({
-    type: e.type ?? "",
-    resourceGroup: e.resourceGroup ?? "",
-    location: e.location ?? "",
-    createdTime: e.createdTime ?? null
-  }));
-  return { ok: true, rows };
-}
-var DEFAULT_DEADLINE_MS2 = 25e3;
-async function resolveSubscriptionInventory(args) {
-  const now = args.now ?? (() => Date.now());
-  const deadlineMs = args.deadlineMs ?? DEFAULT_DEADLINE_MS2;
-  const scanFn = args.scanImpl ?? listSubscriptionResources;
-  let timer;
+    return { ok: false, reason: "unreachable" };
+  }
+  if (!isRecord4(parsed)) return { ok: false, reason: "malformed" };
+  if (parsed.schemaVersion !== 1) return { ok: false, reason: "unknown-schema" };
+  if (parsed.enabled !== true) return { ok: false, reason: "disabled" };
+  const raw = typeof parsed.inviteUrl === "string" ? parsed.inviteUrl.trim() : "";
+  if (!raw) return { ok: false, reason: "no-url" };
+  let parsedUrl;
   try {
-    args.onNarrate?.("checking what's already in your subscription...");
-    const scan2 = scanFn(args.subscriptionId);
-    void scan2.catch(() => {
-    });
-    const timeout = new Promise((resolve6) => {
-      timer = setTimeout(() => {
-        resolve6("timeout");
-      }, deadlineMs);
-    });
-    const raced = await Promise.race([scan2, timeout]);
-    if (raced === "timeout" || !raced.ok) return {};
-    const summary = summarizeInventory(raced.rows, args.installResourceGroup, now());
-    return { note: renderInventoryNote(summary) };
+    parsedUrl = new URL(raw);
   } catch {
-    return {};
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-
-// src/commands/bootstrap/ui.ts
-function renderDeploySuccess(version, envPath) {
-  return `${colors.success("\u2713")} Ezra is live (${INTAKE_AGENT} v${version}).
-  env: ${envPath}
-  Opening ${colors.field("http://localhost:3000")} in your browser \u2192 Sign in with Microsoft \u2192 chat with Ezra.
-  ${colors.dim("(If it doesn't open, browse to http://localhost:3000 yourself.)")}
-  ${colors.dim("First turn may say 'warming up' for a few minutes while access propagates \u2014 that's expected.")}
+    return { ok: false, reason: "insecure-url" };
+  }
+  if (parsedUrl.protocol !== "https:") return { ok: false, reason: "insecure-url" };
+  if (!hostAllowed(parsedUrl.hostname)) return { ok: false, reason: "insecure-url" };
+  const url = parsedUrl.href;
+  if (SHELL_UNSAFE.test(url)) return { ok: false, reason: "insecure-url" };
+  return { ok: true, url };
+}
+function renderChatPointer(url, opts) {
+  const lead = "While your real Ezra installs in your cloud, talk to our Ezra to see what he can do for you.\n";
+  return opts.print ? `${lead}  Open this: ${url}
+` : `${lead}  ${url}
 `;
 }
-function renderDeployFailure(error) {
-  const hint = error instanceof LocalCliError && error.hint ? error.hint : "Re-run 'm8t bootstrap ui' (idempotent).";
-  return `${colors.error("\u2717")} Ezra deploy failed: ${error.message}
-  ${colors.hint(hint)}
-`;
+var CHAT_UNAVAILABLE_LINE = "  Chat with Ezra isn't available right now \u2014 your install is unaffected.\n";
+async function openChatInvite(deps = {}) {
+  const invite = await fetchChatInvite(deps);
+  if (!invite.ok) return CHAT_UNAVAILABLE_LINE;
+  const print = deps.print === true;
+  if (!print) {
+    const open3 = deps.open ?? tryOpenUrl;
+    try {
+      await open3(invite.url);
+    } catch {
+    }
+  }
+  return renderChatPointer(invite.url, { print });
 }
-var BootstrapUiCommand = class extends M8tCommand {
-  static paths = [["bootstrap", "ui"]];
-  static usage = Command62.Usage({
-    description: "Deploy Ezra + start the local onboarding chat UI in the background (returns immediately).",
+
+// src/commands/bootstrap/profile.ts
+var BootstrapProfileCommand = class extends M8tCommand {
+  static paths = [["bootstrap", "profile"]];
+  static usage = Command63.Usage({
+    description: "Confirm your email + your Microsoft startup advisor, and open Ezra to talk to while the install runs.",
     details: [
-      "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
-      "installer's foundry-create phase, grants you Foundry data-plane access, deploys the no-brain",
-      "onboarding intake agent (ezra-intake), writes apps/web/.env.local (voice relay config is added",
-      "only when --voice is set \u2014 see --voice for what that does and does not affect),",
-      "installs deps, and starts the webapp detached so a coding agent can continue without opening",
-      "a separate terminal.",
+      "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Records the two",
+      "facts your deployed advisors need \u2014 the address Ezra copies you on, and the Microsoft",
+      "startup advisor it can escalate to \u2014 and points you at the hosted Ezra for the wait.",
       "",
-      "The command returns as soon as the server is ready (or after ~45 s if it is still compiling).",
-      "Use `--stop` to shut it down, `--foreground` to keep the old blocking behaviour."
+      "Non-interactive by default: pass the answers as flags and nothing is prompted. With a",
+      "terminal, any answer you did not pass is asked for, with your Azure sign-in offered as",
+      "the default. Idempotent \u2014 re-run it any time to correct or fill in an answer.",
+      "",
+      "Nothing here blocks the install, and chat never fails it."
     ].join("\n"),
     examples: [
-      ["Start the onboarding UI (backgrounds the server, returns)", "$0 bootstrap ui --repo-root /path/to/m8t"],
-      ["Stop the running onboarding UI", "$0 bootstrap ui --stop"],
-      ["Prep only (don't serve at all)", "$0 bootstrap ui --repo-root /path/to/m8t --prep-only"],
-      ["Foreground (blocking, old behaviour)", "$0 bootstrap ui --repo-root /path/to/m8t --foreground"],
-      ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
+      ["Record both answers", "$0 bootstrap profile --founder-email you@example.com --advisor-name 'Sam Lee' --advisor-email sam@example.com"],
+      ["Record the email, skip the advisor", "$0 bootstrap profile --founder-email you@example.com --no-advisor"],
+      ["Answer the questions at a terminal", "$0 bootstrap profile"],
+      ["Skip the browser hand-off", "$0 bootstrap profile --founder-email you@example.com --print"]
     ]
   });
-  repoRoot = Option59.String("--repo-root");
-  port = Option59.String("--port", "3000");
-  endpoint = Option59.String("--endpoint", {
-    description: "Foundry project endpoint to target \u2014 overrides discovery when this install's resource group holds more than one Foundry project."
-  });
-  prepOnly = Option59.Boolean("--prep-only", false);
-  skipInstall = Option59.Boolean("--skip-install", false);
-  stop = Option59.Boolean("--stop", false);
-  foreground = Option59.Boolean("--foreground", false);
-  voice = Option59.Boolean("--voice", false, {
-    description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
-  });
+  founderEmail = Option60.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
+  advisorName = Option60.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
+  advisorEmail = Option60.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
+  noAdvisor = Option60.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
+  noChat = Option60.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
+  print = Option60.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
   async executeCommand() {
-    if (this.stop === true) {
-      const stopped = stopOnboardingUi();
-      if (stopped) {
-        this.context.stdout.write(`${colors.success("\u2713")} stopped the onboarding chat UI.
-`);
-      } else {
-        this.context.stdout.write(`  ${colors.dim("nothing to stop (no onboarding-ui.pid found).")}
-`);
-      }
-      return 0;
-    }
-    const state = await readBootstrapState();
-    if (!state) {
-      throw new LocalCliError({
-        code: "BOOTSTRAP_NO_STATE",
-        message: "No bootstrap is in flight (no ~/.m8t/bootstrap.json).",
-        hint: "Run 'm8t bootstrap launch --location <region>' first."
-      });
-    }
-    const explicitRoot = typeof this.repoRoot === "string" ? this.repoRoot : void 0;
-    const repoRoot = explicitRoot ?? process.cwd();
-    assertPlatformCheckout(repoRoot, "'m8t bootstrap ui'", ["apps/web"], {
-      source: explicitRoot === void 0 ? "the working directory" : "--repo-root",
-      hint: "The local onboarding chat is part of the platform's web app, which is not published, so this step is unavailable today. Nothing else is blocked: let the install finish, then run 'm8t open' to meet Ezra in your deployed web app."
-    });
-    if (this.port !== "3000") {
-      throw new LocalCliError({
-        code: "BOOTSTRAP_UI_PORT_MSAL_LOCKED",
-        message: `--port ${this.port} is not supported: the app registration's redirect URI is fixed to localhost:3000, so Microsoft sign-in only works there.`,
-        hint: "Omit --port (it defaults to 3000). If port 3000 is busy, stop the other process using it."
+    const stdin = this.context.stdin;
+    const stdout = this.context.stdout;
+    const isTty = stdin.isTTY === true;
+    const flags = {
+      founderEmail: typeof this.founderEmail === "string" ? this.founderEmail : void 0,
+      advisorName: typeof this.advisorName === "string" ? this.advisorName : void 0,
+      advisorEmail: typeof this.advisorEmail === "string" ? this.advisorEmail : void 0,
+      noAdvisor: this.noAdvisor === true
+    };
+    const [identity, previous] = await Promise.all([
+      getSignedInUserIdentity(),
+      readOnboardingProfile()
+    ]);
+    const mayAsk = isTty && (!(flags.founderEmail ?? "").trim() || !(flags.noAdvisor || (flags.advisorName ?? "").trim() || (flags.advisorEmail ?? "").trim()));
+    const rl = mayAsk ? readline3.createInterface({ input: stdin, output: stdout }) : null;
+    let collected;
+    try {
+      collected = await collectProfile({
+        flags,
+        identity,
+        previous,
+        isTty,
+        ask: async (question) => rl ? await rl.question(question) : "",
+        now: () => (/* @__PURE__ */ new Date()).toISOString()
       });
+    } finally {
+      rl?.close();
     }
-    const out = (m) => {
-      this.context.stderr.write(`  ${colors.dim(m)}
+    if (!collected.ok) throw collected.error;
+    const profile = collected.profile;
+    await writeOnboardingProfile(profile);
+    this.context.stdout.write(`${colors.success("\u2713")} Recorded \u2014 Ezra will copy you at ${colors.field(profile.founderEmail)}.
 `);
-    };
-    if (fs40.existsSync(path45.join(os21.homedir(), ".m8t", "config.yaml"))) {
-      out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
+    if (profile.advisor === null) this.context.stdout.write(colors.dim(ADVISOR_SKIPPED_LINE));
+    await this.seedIfBrainsExist(profile);
+    if (this.noChat !== true) {
+      this.context.stdout.write(await openChatInvite({ print: this.print === true }));
     }
-    const credential2 = new DefaultAzureCredential25();
-    const account = await getAzAccount();
-    assertNodeVersion();
-    out("waiting for Foundry (the installer's foundry-create phase)\u2026");
-    const { endpoint, accountScope } = await resolveFoundryEndpointWithWait(
-      {
-        credential: credential2,
-        subscriptionId: state.subscriptionId,
-        endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
-        // Scoped to the resource group this install owns — the state file names
-        // it (and the installer was handed the same one), so there is no
-        // guessing between deployments in a shared subscription. Same rationale
-        // as discoverGateway in bootstrap-finalize.ts.
-        resourceGroup: state.resourceGroup
-      },
-      { onWait: out }
-    );
-    out("granting you Foundry data-plane access\u2026");
-    const oid = await getSignedInUserOid();
-    await ensureFounderFoundryRole({ credential: credential2, subscriptionId: state.subscriptionId, principalId: oid, accountScope });
-    const identity = await getSignedInUserIdentity();
-    out("deploying the intake agent (ezra-intake) in the background...");
-    const deployOutcome = (async () => {
-      const [choice, inventory] = await Promise.all([
-        resolveIntakeModel({
-          accountScope,
-          fallbackRegion: state.location,
-          onNarrate: out
-        }),
-        resolveSubscriptionInventory({
-          subscriptionId: state.subscriptionId,
-          installResourceGroup: state.resourceGroup,
-          onNarrate: out
-        })
-      ]);
-      return deployIntakeAgentWithRetry({
-        credential: credential2,
-        endpoint,
-        repoRoot,
-        model: choice.model,
-        fieldOverrides: buildIntakeFieldOverrides({
-          founderIdentityNote: composeFounderIdentityNote(identity),
-          chosenModelNote: choice.note,
-          inventoryNote: inventory.note
-        }),
-        onWait: out
-      });
-    })().then(
-      (version) => ({ ok: true, version }),
-      (error) => ({ ok: false, error: error instanceof Error ? error : new Error(String(error)) })
-    );
-    const envPath = writeWebEnvLocal({
-      repoRoot,
-      tenantId: account.tenantId,
-      clientId: state.appRegClientId,
-      foundryEndpoint: endpoint,
-      voice: this.voice === true
-    });
-    if (!this.skipInstall) {
-      out("installing apps/web dependencies (pnpm)\u2026");
-      await installWebDeps(repoRoot);
-    }
-    if (this.prepOnly === true) {
-      const outcome2 = await deployOutcome;
-      if (!outcome2.ok) throw outcome2.error;
-      this.context.stdout.write(renderDeploySuccess(outcome2.version, envPath));
-      this.context.stdout.write(`  ${colors.hint("serve it yourself:")} pnpm --filter web dev
-`);
-      return 0;
+    return 0;
+  }
+  /**
+   * Seed now if the brains already exist, otherwise say who will.
+   *
+   * Best-effort on purpose. This command runs mid-install by design, when there is
+   * usually nothing to seed yet — `bootstrap status --watch` does it at `done`. But
+   * re-running this after the install should not leave a founder wondering whether
+   * their correction landed, so when the brains ARE there we seed immediately.
+   *
+   * A failure here is reported and swallowed: the answers are already safely on disk,
+   * and the install path will retry the seed on its own.
+   */
+  async seedIfBrainsExist(profile) {
+    let ctx = null;
+    try {
+      ctx = await resolveSeedContext({});
+    } catch {
+      ctx = null;
     }
-    if (this.foreground === true) {
-      if (this.voice === true) {
-        out("starting the voice relay on :8790 in the background\u2026");
-        await serveOnboardingRelayDetached({
-          repoRoot,
-          foundryEndpoint: endpoint,
-          tenantId: account.tenantId,
-          clientId: state.appRegClientId,
-          webInternalBaseUrl: "http://localhost:3000"
-        });
-        out("voice relay on :8790");
-      }
-      const outcome2 = await deployOutcome;
-      if (!outcome2.ok) {
-        this.context.stderr.write(renderDeployFailure(outcome2.error));
-        return 1;
-      }
-      this.context.stdout.write(renderDeploySuccess(outcome2.version, envPath));
-      out("starting the webapp on :3000 (Ctrl-C to stop)\u2026");
-      await runInherit("pnpm", ["--filter", "web", "dev"], repoRoot, "BOOTSTRAP_UI_DEV_FAILED");
-      return 0;
+    if (!ctx) {
+      this.context.stdout.write(
+        `  ${colors.dim("Your advisors will pick this up when the install finishes.")}
+`
+      );
+      return;
     }
-    if (this.voice === true) {
-      out("starting the voice relay on :8790 in the background\u2026");
-      await serveOnboardingRelayDetached({
-        repoRoot,
-        foundryEndpoint: endpoint,
-        tenantId: account.tenantId,
-        clientId: state.appRegClientId,
-        webInternalBaseUrl: "http://localhost:3000"
+    try {
+      await applyProfileToBrains({
+        block: toOnboardingBlock(profile),
+        brainRepos: ctx.brainRepos,
+        branch: "main",
+        appCreds: ctx.appCreds,
+        subscriptionId: ctx.subscriptionId,
+        azIdentity: { name: profile.founderName, email: profile.founderEmail },
+        contactsOnly: true,
+        advisorCleared: profile.advisorCleared === true
       });
-      out("voice relay on :8790");
-    }
-    out("starting the webapp on :3000 in the background\u2026");
-    const { alreadyRunning, logPath } = await serveOnboardingUiDetached({ repoRoot, port: this.port });
-    if (alreadyRunning) {
       this.context.stdout.write(
-        `${colors.success("\u2713")} chat UI already running at http://localhost:${this.port}
+        `${colors.success("\u2713")} Your advisors now know how to reach you (seeded ${ctx.brainRepos.join(", ")}).
 `
       );
-    } else {
-      this.context.stdout.write(
-        `${colors.success("\u2713")} chat UI is live at http://localhost:${this.port}
-  ${colors.dim(`logs: ${logPath} \xB7 stop: m8t bootstrap ui --stop`)}
+    } catch (e) {
+      this.context.stderr.write(
+        `  ${colors.dim(`saved, but the brain seed didn't land yet: ${e instanceof Error ? e.message : String(e)}`)}
+  ${colors.hint("it retries when the install finishes, or run:")} m8t bootstrap seed-profile
 `
       );
     }
-    autoOpenOnboardingUi(`http://localhost:${this.port}`);
-    const outcome = await deployOutcome;
-    if (!outcome.ok) {
-      this.context.stderr.write(renderDeployFailure(outcome.error));
-      return 1;
-    }
-    this.context.stdout.write(renderDeploySuccess(outcome.version, envPath));
-    return 0;
   }
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command63, Option as Option60 } from "clipanion";
+import { Command as Command64, Option as Option61 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command63.Usage({
-    description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
-    details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/ezra-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
+  static usage = Command64.Usage({
+    description: "Seed your advisors' brains with how to reach you, from what you confirmed at `m8t bootstrap profile`.",
+    details: [
+      "Renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines)",
+      "and commits them to the brains this install created, via the GitHub App. Idempotent \u2014",
+      "an unchanged profile is a no-op.",
+      "",
+      "Run `m8t bootstrap profile` first; this is the manual re-run of the seed that",
+      "`m8t bootstrap status --watch` already does when the install completes.",
+      "",
+      "--watch is legacy: it polls for an onboarding conversation from installs made when a",
+      "dedicated intake agent was still deployed. It has nothing to wait for otherwise."
+    ].join("\n"),
     examples: [
-      ["Seed now (idempotent)", "$0 bootstrap seed-profile"],
-      ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
+      ["Seed now (idempotent)", "$0 bootstrap seed-profile"]
     ]
   });
-  endpoint = Option60.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option60.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option60.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option60.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option60.String("--github-app-creds");
+  endpoint = Option61.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option61.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option61.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option61.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option61.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -34750,12 +34128,30 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 `);
       return 0;
     }
+    const local = await readOnboardingProfile();
+    if (local) {
+      await applyProfileToBrains({
+        block: toOnboardingBlock(local),
+        brainRepos: ctx.brainRepos,
+        branch: "main",
+        appCreds: ctx.appCreds,
+        subscriptionId: ctx.subscriptionId,
+        azIdentity: { name: local.founderName, email: local.founderEmail },
+        contactsOnly: true,
+        advisorCleared: local.advisorCleared === true
+      });
+      this.context.stdout.write(
+        `${colors.success("\u2713")} seeded your advisors' brains (${ctx.brainRepos.join(", ")}) with how to reach you.
+`
+      );
+      return 0;
+    }
     const watch = this.watch === true;
     const rawTimeout = typeof this.timeout === "string" ? this.timeout.trim() : "";
     const parsedTimeout = Number(rawTimeout);
     const timeoutMin = rawTimeout !== "" && Number.isFinite(parsedTimeout) ? parsedTimeout : 20;
     const deadline = Date.now() + timeoutMin * 6e4;
-    const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
     for (; ; ) {
       const token = await getFoundryToken();
       const { hadIntake, block, rejection } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
@@ -34782,9 +34178,16 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
           );
           return 3;
         }
-        const why = hadIntake ? "intake not complete yet \u2014 no m8t_onboarding block found." : "no onboarding intake found.";
+        if (!hadIntake) {
+          this.context.stderr.write(
+            `  ${colors.dim("nothing collected yet \u2014 your advisors don't know how to reach you.")}
+  ${colors.hint("run:")} m8t bootstrap profile
+`
+          );
+          return 3;
+        }
         this.context.stderr.write(
-          `  ${colors.dim(why)}
+          `  ${colors.dim("intake not complete yet \u2014 no m8t_onboarding block found.")}
   ${colors.hint("retry:")} m8t bootstrap seed-profile
 `
         );
@@ -34792,7 +34195,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       }
       this.context.stderr.write(`  ${colors.dim("waiting for the intake to complete\u2026")}
 `);
-      await sleep5(2e4);
+      await sleep4(2e4);
     }
   }
 };
@@ -34801,7 +34204,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs41 from "fs";
 import * as os22 from "os";
 import * as path46 from "path";
-import { Command as Command64, Option as Option61 } from "clipanion";
+import { Command as Command65, Option as Option62 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -34820,7 +34223,7 @@ async function defaultToken() {
   const token = out.trim();
   return token.length > 0 ? token : null;
 }
-var sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
 async function enroll(args) {
   const f = args.fetchImpl ?? fetch;
   const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
@@ -34841,7 +34244,7 @@ async function enroll(args) {
       throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
     }
     if (res.status !== 503 || attempt === 3) break;
-    await sleep4(retryDelayMs * attempt);
+    await sleep3(retryDelayMs * attempt);
   }
   if (!res?.ok) {
     const detail = res ? await res.text().catch(() => "") : "";
@@ -34883,7 +34286,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command64.Usage({
+  static usage = Command65.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -34891,11 +34294,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option61.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option61.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option61.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option61.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option61.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option62.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option62.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option62.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option62.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option62.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -34945,7 +34348,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command65, Option as Option62 } from "clipanion";
+import { Command as Command66, Option as Option63 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -34984,7 +34387,7 @@ var VERSION3 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/u;
 function isVersionOrNull(value) {
   return value === null || typeof value === "string" && VERSION3.test(value);
 }
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, keys) {
@@ -35009,11 +34412,11 @@ function isInstantOrNull(value) {
   return value === null || typeof value === "string" && INSTANT_SHAPE.test(value) && Number.isFinite(Date.parse(value));
 }
 function parseDecision(value) {
-  if (!isRecord3(value) || !isBoundedPlainString(value.callId, COMPANION_DECISION_CALL_ID_MAX_LENGTH) || !isBoundedPlainString(value.title, COMPANION_DECISION_TITLE_MAX_LENGTH) || !Array.isArray(value.options) || value.options.length < COMPANION_DECISION_OPTIONS_MIN || value.options.length > COMPANION_DECISION_OPTIONS_MAX) {
+  if (!isRecord5(value) || !isBoundedPlainString(value.callId, COMPANION_DECISION_CALL_ID_MAX_LENGTH) || !isBoundedPlainString(value.title, COMPANION_DECISION_TITLE_MAX_LENGTH) || !Array.isArray(value.options) || value.options.length < COMPANION_DECISION_OPTIONS_MIN || value.options.length > COMPANION_DECISION_OPTIONS_MAX) {
     return eventError();
   }
   const options = value.options.map((option) => {
-    if (!isRecord3(option) || !hasExactKeys(option, ["label", "detail"]) || !isBoundedPlainString(option.label, COMPANION_DECISION_LABEL_MAX_LENGTH) || !isBoundedMessageText(option.detail, COMPANION_DECISION_DETAIL_MAX_CODE_POINTS)) {
+    if (!isRecord5(option) || !hasExactKeys(option, ["label", "detail"]) || !isBoundedPlainString(option.label, COMPANION_DECISION_LABEL_MAX_LENGTH) || !isBoundedMessageText(option.detail, COMPANION_DECISION_DETAIL_MAX_CODE_POINTS)) {
       return eventError();
     }
     return { label: option.label, detail: option.detail };
@@ -35031,7 +34434,7 @@ function parseDecision(value) {
   return { ...base, status: "selected", optionIndex: value.optionIndex };
 }
 function parseArtifact(value) {
-  if (!isRecord3(value) || !isBoundedPlainString(value.name, COMPANION_ARTIFACT_NAME_MAX_LENGTH)) {
+  if (!isRecord5(value) || !isBoundedPlainString(value.name, COMPANION_ARTIFACT_NAME_MAX_LENGTH)) {
     return eventError();
   }
   if (value.sizeBytes === void 0) {
@@ -35050,7 +34453,7 @@ function parseTurnArtifacts(value) {
   return value.map(parseArtifact);
 }
 function parseTurn(value) {
-  if (!isRecord3(value) || !isBoundedPlainString(value.id, COMPANION_TURN_ID_MAX_LENGTH) || value.role !== "user" && value.role !== "mate" || !isInstantOrNull(value.at)) {
+  if (!isRecord5(value) || !isBoundedPlainString(value.id, COMPANION_TURN_ID_MAX_LENGTH) || value.role !== "user" && value.role !== "mate" || !isInstantOrNull(value.at)) {
     return eventError();
   }
   const keys = [
@@ -35129,7 +34532,7 @@ function isValidMateRoute(value) {
   }
 }
 function parseRequest(value) {
-  if (!isRecord3(value)) return requestError();
+  if (!isRecord5(value)) return requestError();
   if (value.type === "roster") {
     if (!hasExactKeys(value, ["type"])) return requestError();
     return { type: "roster" };
@@ -35195,7 +34598,7 @@ function parseRequestLine(line2) {
   }
 }
 function parseMate(value) {
-  if (!isRecord3(value) || !hasExactKeys(value, [
+  if (!isRecord5(value) || !hasExactKeys(value, [
     "personaKey",
     "agentName",
     "displayName",
@@ -35220,7 +34623,7 @@ function parseMate(value) {
   };
 }
 function parseEvent(value) {
-  if (!isRecord3(value)) return eventError();
+  if (!isRecord5(value)) return eventError();
   if (value.type === "update") {
     if (!hasExactKeys(value, ["type", "installed", "available", "severity"]) || !isVersionOrNull(value.installed) || !isVersionOrNull(value.available) || !(value.severity === null || SEVERITIES2.has(value.severity))) {
       return eventError();
@@ -35359,7 +34762,7 @@ var PredispatchFailure = class extends Error {
   }
   reason;
 };
-function isRecord4(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasControlCharacter(value) {
@@ -35429,16 +34832,16 @@ async function readJsonEnvelope(response) {
     if (error instanceof PredispatchFailure) throw error;
     throw new PredispatchFailure("not-connected");
   }
-  if (!isRecord4(envelope) || envelope.ok !== true || !("data" in envelope)) {
+  if (!isRecord6(envelope) || envelope.ok !== true || !("data" in envelope)) {
     throw new PredispatchFailure("not-connected");
   }
   return envelope.data;
 }
 function decodeAgents(data) {
-  if (!isRecord4(data) || !Array.isArray(data.agents)) {
+  if (!isRecord6(data) || !Array.isArray(data.agents)) {
     throw new PredispatchFailure("mate-unavailable");
   }
-  return data.agents.filter(isRecord4);
+  return data.agents.filter(isRecord6);
 }
 function resolveAgentName(agents, personaKey) {
   const matches = agents.filter(
@@ -35460,18 +34863,18 @@ function requireAgentName(agents, personaKey) {
   return name;
 }
 function decodeConversationId(data) {
-  if (!isRecord4(data) || typeof data.id !== "string" || !OPAQUE_ID.test(data.id)) {
+  if (!isRecord6(data) || typeof data.id !== "string" || !OPAQUE_ID.test(data.id)) {
     throw new PredispatchFailure("not-connected");
   }
   return data.id;
 }
 function decodeLastMessageId(data) {
-  if (!isRecord4(data) || !Array.isArray(data.messages)) {
+  if (!isRecord6(data) || !Array.isArray(data.messages)) {
     throw new PredispatchFailure("not-connected");
   }
   const messages = data.messages;
   const last = messages.at(-1);
-  if (!isRecord4(last) || typeof last.id !== "string" || !OPAQUE_ID.test(last.id)) {
+  if (!isRecord6(last) || typeof last.id !== "string" || !OPAQUE_ID.test(last.id)) {
     return void 0;
   }
   return last.id;
@@ -35557,7 +34960,7 @@ function toCompanionArtifacts(data) {
   const artifacts = [];
   for (const entry of data) {
     if (artifacts.length >= COMPANION_ARTIFACTS_MAX) break;
-    if (!isRecord4(entry) || typeof entry.name !== "string") continue;
+    if (!isRecord6(entry) || typeof entry.name !== "string") continue;
     const name = boundPlainLine(entry.name, COMPANION_ARTIFACT_NAME_MAX_LENGTH);
     if (name.length === 0) continue;
     const size = entry.size_bytes;
@@ -35571,12 +34974,12 @@ function decodeMessageInstant(value) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 && value < EPOCH_SECONDS_LIMIT ? new Date(Math.round(value) * 1e3).toISOString() : null;
 }
 function decodeTurns(data, limit2) {
-  if (!isRecord4(data) || !Array.isArray(data.messages)) {
+  if (!isRecord6(data) || !Array.isArray(data.messages)) {
     throw new PredispatchFailure("not-connected");
   }
   const turns = [];
   for (const entry of data.messages) {
-    if (!isRecord4(entry)) continue;
+    if (!isRecord6(entry)) continue;
     if (entry.role !== "user" && entry.role !== "assistant") continue;
     if (typeof entry.id !== "string" || !OPAQUE_ID.test(entry.id)) continue;
     if (typeof entry.content !== "string") continue;
@@ -35603,12 +35006,12 @@ function decodeDurableDecision(entry) {
   return toCompanionDecision(frame.directive);
 }
 function decodeRichTurns(data, limit2) {
-  if (!isRecord4(data) || !Array.isArray(data.messages)) {
+  if (!isRecord6(data) || !Array.isArray(data.messages)) {
     throw new PredispatchFailure("not-connected");
   }
   const turns = [];
   for (const entry of data.messages) {
-    if (!isRecord4(entry)) continue;
+    if (!isRecord6(entry)) continue;
     if (entry.role !== "user" && entry.role !== "assistant") continue;
     if (typeof entry.id !== "string" || !OPAQUE_ID.test(entry.id)) continue;
     if (typeof entry.content !== "string") continue;
@@ -35744,7 +35147,7 @@ async function drainAcceptedSse(response) {
       continue;
     }
     const parsed = JSON.parse(data);
-    if (!isRecord4(parsed) || typeof parsed.type !== "string" || parsed.type === "error") {
+    if (!isRecord6(parsed) || typeof parsed.type !== "string" || parsed.type === "error") {
       throw new Error("invalid stream event");
     }
   }
@@ -35792,7 +35195,7 @@ async function streamAcceptedSse(response, now, onText, onData) {
       return;
     }
     const parsed = JSON.parse(data);
-    if (!isRecord4(parsed) || typeof parsed.type !== "string" || parsed.type === "error") {
+    if (!isRecord6(parsed) || typeof parsed.type !== "string" || parsed.type === "error") {
       throw new Error("invalid stream event");
     }
     if (parsed.type === "text-delta" && typeof parsed.delta === "string" && parsed.delta.length > 0) {
@@ -36016,7 +35419,7 @@ async function classifyDecideRefusal(response) {
   let reason;
   try {
     const envelope = JSON.parse(await readBoundedText(response));
-    if (isRecord4(envelope) && isRecord4(envelope.error) && isRecord4(envelope.error.details)) {
+    if (isRecord6(envelope) && isRecord6(envelope.error) && isRecord6(envelope.error.details)) {
       reason = envelope.error.details.reason;
     }
   } catch {
@@ -36401,14 +35804,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps4) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command65 {
+var CompanionBridgeCommand = class extends Command66 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option62.Boolean("--serve", false);
+  serve = Option63.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -36426,7 +35829,7 @@ var CompanionBridgeCommand = class extends Command65 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command66 } from "clipanion";
+import { Command as Command67 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -36498,7 +35901,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command66.Usage({
+  static usage = Command67.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -36512,7 +35915,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command67, Option as Option63 } from "clipanion";
+import { Command as Command68, Option as Option64 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -36531,10 +35934,10 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command67.Usage({
+  static usage = Command68.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option63.String("--resource-group", {
+  resourceGroup = Option64.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -36548,7 +35951,7 @@ var CompanionRepairCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command68 } from "clipanion";
+import { Command as Command69 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -36560,7 +35963,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command68.Usage({
+  static usage = Command69.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -36639,6 +36042,7 @@ cli.register(BootstrapLaunchCommand);
 cli.register(BootstrapStatusCommand);
 cli.register(BootstrapReapCommand);
 cli.register(BootstrapUiCommand);
+cli.register(BootstrapProfileCommand);
 cli.register(BootstrapSeedProfileCommand);
 cli.register(TelemetryEnrollCommand);
 cli.register(CompanionBridgeCommand);