@meetless/mla 0.1.4

package/dist/cli.js

@@ -0,0 +1,828 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dispatch = dispatch;
+exports.runCliBootstrap = runCliBootstrap;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const observability_1 = require("./lib/observability");
+const git_1 = require("./lib/git");
+const consent_1 = require("./lib/analytics/consent");
+const capture_1 = require("./lib/analytics/capture");
+const http_1 = require("./lib/http");
+const config_1 = require("./lib/config");
+const workspace_1 = require("./lib/workspace");
+const init_1 = require("./commands/init");
+const login_1 = require("./commands/login");
+const logout_1 = require("./commands/logout");
+const uninstall_1 = require("./commands/uninstall");
+const whoami_1 = require("./commands/whoami");
+const rewire_1 = require("./commands/rewire");
+const activate_1 = require("./commands/activate");
+const review_1 = require("./commands/review");
+const flush_1 = require("./commands/flush");
+const queue_prune_1 = require("./commands/queue-prune");
+const doctor_1 = require("./commands/doctor");
+const internal_finalize_1 = require("./commands/internal-finalize");
+const internal_active_review_1 = require("./commands/internal-active-review");
+const internal_auto_index_1 = require("./commands/internal-auto-index");
+const internal_evidence_inject_1 = require("./commands/internal-evidence-inject");
+const internal_evidence_correlate_1 = require("./commands/internal-evidence-correlate");
+const internal_evidence_hooks_1 = require("./commands/internal-evidence-hooks");
+const internal_steer_sync_1 = require("./commands/internal-steer-sync");
+const internal_capture_decisions_1 = require("./commands/internal-capture-decisions");
+const internal_pretool_observe_1 = require("./commands/internal-pretool-observe");
+const internal_turn_recap_1 = require("./commands/internal-turn-recap");
+const internal_refresh_1 = require("./commands/internal-refresh");
+const internal_session_nudge_1 = require("./commands/internal-session-nudge");
+const update_notifier_1 = require("./lib/update-notifier");
+const upgrade_apply_1 = require("./lib/upgrade-apply");
+const wire_1 = require("./lib/wire");
+const scan_context_1 = require("./commands/scan-context");
+const kb_1 = require("./commands/kb");
+const enrich_1 = require("./commands/enrich");
+const graph_1 = require("./commands/graph");
+const summary_1 = require("./commands/summary");
+const label_1 = require("./commands/label");
+const stats_1 = require("./commands/stats");
+const turn_1 = require("./commands/turn");
+const ask_1 = require("./commands/ask");
+const session_1 = require("./commands/session");
+const workspace_2 = require("./commands/workspace");
+const debug_1 = require("./commands/debug");
+const mcp_1 = require("./commands/mcp");
+const mcp_supervisor_1 = require("./commands/mcp-supervisor");
+const mcp_restart_1 = require("./lib/mcp-restart");
+const context_1 = require("./commands/context");
+const status_1 = require("./commands/status");
+const evidence_1 = require("./commands/evidence");
+const rules_1 = require("./commands/rules");
+// `mla` dispatcher (§3 hour 6).
+//
+// Commands:
+//   mla init [flags]
+//   mla rewire [flags]
+//   mla activate [--name <name>] [--note <text>] [--here|--create|--repair] [--bootstrap <fast|agentic|full>]
+//   mla deactivate [--yes] [--from-root|--marker <path>]
+//   mla mute | mla unmute
+//   mla review [--plain] [--no-flush]
+//   mla review <id>
+//   mla flush [--all|--session <sid>] [--quiet] [--gc|--reap-only]
+//   mla doctor
+//   mla _internal finalize-session <sessionId>
+//   mla _internal auto-index [--session <sid>]
+const USAGE = `mla: Meetless Agent CLI
+
+usage:
+  mla init [--control-url <url>] [--control-token <token>] [--intel-url <url>]
+          [--actor <id>] [--no-post-tool-use] [--skill-only]
+          (machine setup + credential update. Defaults to logged-out (auth.mode
+           none): run 'mla login' next to sign in. Pass --control-token only for a
+           headless shared-key install. A tokenless re-run preserves a live login.
+           No workspace binding here; use 'mla activate' to bind a folder.)
+  mla rewire [--no-post-tool-use] [--no-install-flock] [--skill-only]
+          (idempotent re-wiring after binary upgrade; no token needed)
+  mla upgrade [--check] [--force]
+          (self-upgrade to the latest signed release: verifies the release
+           manifest's Ed25519 signature, enforces the downgrade guard, and
+           atomically swaps the binary (curl installs only; brew/npm are
+           redirected to their package manager). --check reports without
+           installing; --force allows a same-version or downgrade reinstall.)
+  mla login [--no-browser] [--console-url <url>] [--port <n>]
+                    (browser login: opens the Console authorize page, captures a
+                     user session into cli-config.json. --no-browser prints the URL
+                     for SSH/headless and REQUIRES --port (the forwarded loopback
+                     port). No-op when already logged in with >24h of refresh
+                     runway; force re-login with 'mla logout && mla login'.)
+  mla logout
+                    (revoke the current user session server-side and clear it from
+                     cli-config.json (auth.mode -> none). A network failure still
+                     clears locally; NEVER restores a prior shared key. No --all.)
+  mla uninstall [--dry-run] [--yes]
+                    (remove the entire local Meetless footprint: ~/.meetless,
+                     the Claude hook + MCP entries, and the /mla skill. Prints
+                     how to remove the binary. Local only; server data and other
+                     repos' .meetless.json markers are untouched.)
+  mla whoami
+                    (print the identity behind the current cli-config.json: a
+                     user session resolves live via the control /auth/me endpoint;
+                     a shared key prints its mode without a network call. Exit 1
+                     when not configured.)
+  mla activate [--name <name>] [--note <text>]
+                    (provision-or-bind a workspace for this folder: no marker in
+                     the tree provisions a new one named after the dir; a marker
+                     present binds to it)
+  mla activate --here
+                    (in-Git subdir override: bind/provision THIS subdir, shadowing
+                     any parent marker via nearest-wins)
+  mla activate --create
+                    (non-Git override: provision a workspace in a directory that
+                     is not inside a Git repository)
+  mla activate --repair
+                    (re-check the existing binding's membership + connectivity;
+                     never mints a new id)
+  mla activate --bootstrap <fast|agentic|full>
+                    (bootstrap tier for the activation preview: fast (default) shows
+                     the deterministic review bundle; agentic ALSO emits a deep-read
+                     scout mission to hand a coding agent; full adds the temporal
+                     legacy-note graph (not built yet, falls back to agentic))
+  mla deactivate [--yes] [--from-root|--marker <path>]
+                    (REMOVE this folder's workspace binding: deletes the nearest
+                     .meetless.json. Confirms first (--yes to skip); from a subdir
+                     it refuses to delete a parent marker unless --from-root or
+                     --marker <path>. For per-session silencing use 'mla mute'.)
+  mla mute
+                    (per-session: silence capture + Push for the CURRENT Claude
+                     Code session only; does not touch .meetless.json)
+  mla unmute
+                    (per-session: re-enable capture for the CURRENT session;
+                     does not touch .meetless.json)
+  mla workspace [show]
+                    (print the workspace bound to this folder + its health)
+  mla review [--plain] [--no-flush]
+  mla review <id>
+  mla session show [sessionId] [--json] [--last <N>]
+  mla session reconcile [--dry-run] [--json]
+                    (archive sessions whose Claude Code transcript was deleted
+                     on disk; reversible, fail-safe, skips anything uncertain)
+  mla ask "<query>" [--mode answer|search|canonical|compare] [--workspace <id>]
+                    [--as-of <date>] [--max <n>] [--min <n>] [--plain]
+                    (--as-of YYYY-MM-DD answers point-in-time: relations not yet
+                     valid at that instant are excluded. The validity axis is
+                     SEPARATE from posture/relationship; see \`mla kb help\`.)
+  mla mcp
+                    (start the Meetless MCP server over stdio, authenticated as
+                     the logged-in human (cli-config user-token) and scoped to
+                     the marker workspace. No service key, no MEETLESS_WORKSPACE_ID
+                     pin. Wire it into an MCP client's config as the command.)
+  mla kb summary [--json]
+  mla kb dump [--markdown] [--json]
+  mla kb add <path> --mode file|corpus --provenance <kind>
+                    [--workspace <id>] [--profile <p>] [--glob <g>]
+                    [--vault-root <dir>] [--ingest-run-id <id>]
+                    [--queue] [--open]
+                    (<kind>: human_authored | agent_distilled | tool_emitted |
+                     external_imported | external_scraped. --provenance is now
+                     ADVISORY: the server derives trust from the capture path, so
+                     every ingest is born PENDING (reviewOutcome=PENDING) and is
+                     readable but not yet trusted for knowledge-use until accepted
+                     via \`kb accept\` / Console review. Trust (reviewOutcome) is a
+                     SEPARATE axis from relationship review (\`kb pending\`/\`kb
+                     review\`). See \`mla kb help\`.)
+  mla kb show <kbdoc:<id>|note:<path>|<path>>
+                    [--workspace <id>] [--posture both|LIVE|SHADOW] [--as-of <date>]
+                    [--include-tombstoned] [--all] [--audit-all] [--json]
+                    [--open]
+                    (--as-of YYYY-MM-DD renders the doc as of that instant:
+                     relations not yet valid then, or on an untrusted clock, are
+                     excluded. Same validity axis as \`mla ask --as-of\`. Each
+                     promoted relation also prints its valid-time window and
+                     whether its clock is trusted.)
+  mla kb reingest <kbdoc:<id>|note:<path>|<path>>
+                    [--workspace <id>] [--path <new-path>] [--profile <p>]
+                    [--ingest-run-id <id>] [--reason <s>]
+  mla kb forget <kbdoc:<id>|note:<path>|<path>>
+                    [--workspace <id>] [--reason <s>]
+  mla kb purge <kbdoc:<id>|note:<path>|<path>> --reason <s>
+                    [--workspace <id>] [--force]
+  mla kb move <kbdoc:<id>|note:<path>|<path>> <new-path>
+                    [--workspace <id>] [--reason <s>] [--allow-file-missing]
+  mla kb retime <source-item-id> --effective-date <date>
+                    [--reason <s>] [--anchor-type <t>] [--json]
+                    (correct the source item's effective date and regenerate its
+                     derived relations via the Phase 4 correction path. Edits the
+                     SOURCE ITEM, not a relation: an accepted relation is never
+                     edited in place nor deleted. The corrected date re-drives
+                     valid-time, the same axis \`mla kb show --as-of\` filters on.)
+  mla kb pending [--doc <id>] [--json]
+                    (list PENDING_REVIEW relationship candidates to decide on;
+                     canonical home for this is now \`mla graph pending\`)
+  mla kb review <candidate-id> --accept | --reject [--note <text>] [--agent]
+                    (record a verdict; --accept is human-only, an agent proxy
+                     may --reject only mechanically-invalid candidates;
+                     canonical home for this is now \`mla graph review\`)
+  mla kb promote <doc-id> | mla kb promote --reject <doc-id>
+                    (flip a SHADOW Personal-KB doc to LIVE so the workspace grounds
+                     on it; --reject declines and leaves it SHADOW)
+  mla kb personal list | mla kb personal show <id>
+                    (this actor's own SHADOW Personal-KB docs)
+  mla kb help
+                    (full KB catalog + the posture-vs-relationship-review model)
+  mla graph review [scope] [--json] | mla graph review <id> --accept|--reject
+  mla graph pending [scope]
+  mla graph help    (alias: mla cg)
+                    (the coordination graph: relationship review (typed edges
+                     SUPERSEDES / CONTRADICTS / REFINES / REFERENCES between docs).
+                     Same handlers as \`mla kb review\`/\`kb pending\`, given the
+                     relationship axis its own home so it stops hiding under the
+                     storage noun \`kb\`. Document ingestion + grounding (posture)
+                     stay under \`mla kb\`; doc verbs typed here redirect there.)
+  mla summary [--last <n>] [--json] [--all]
+                    (defaults to the current session; --all for every session)
+  mla label [<trace_id>] [--useful] [--noisy] [--harmful]
+                    [--prevented-mistake] [--note <text>]
+                    (mark an enrichment's operator_label; no trace_id labels the
+                     latest trace in the current session)
+  mla stats [evidence] [--window <Nd>] [--json] [--verbose] [--global]
+                    (usefulness-first dashboard from local events.jsonl: evidence
+                     followthrough, contradictions caught, coverage gaps. default
+                     window 30d. \`evidence\` is the focused adoption join below.)
+  mla turn [N] [--session <sid>] [--json]
+                    (per-turn assist recap: did mla run this turn and did it help?
+                     no N recaps the latest completed turn of the current session;
+                     N recaps turn N. The per-turn analog of \`mla stats\`; also
+                     reachable as \`mla stats --turn [N]\`.)
+  mla adoption [--last <n>] [--window <w>] [--json] [--all]
+                    (A1 evidence-followthrough: did the agent pull or cite the
+                     evidence we injected? alias of \`mla stats evidence\`;
+                     defaults to the current session)
+  mla flush [--all|--session <sid>] [--quiet] [--gc|--reap-only]
+                    (--gc drains the spool(s) then reaps stale-session litter;
+                     --reap-only reaps stale litter without draining)
+  mla queue prune [--yes] [--dry-run] [--no-flush] [--max-age-hours N] [--session SID]
+                    (reclaim orphaned queue files from dead sessions; previews
+                     unless --yes. Unlike flush --gc it also reclaims non-empty
+                     stranded tails, flushing them best-effort first)
+  mla doctor
+                    (health check; reports both lifecycles distinctly: workspace
+                     binding (activated / not) and session capture (active / muted))
+  mla status
+                    (show whether Meetless is active for this repo and print
+                     scan-cache counts: confirmed rules injected, pending review
+                     items, inventory)
+  mla context <accept|dismiss> <id> | mla context list
+                    (accept or dismiss a stale-context review item; list shows all
+                     pending items. Verdicts are local; a rescan runs immediately
+                     so the next session's injected context reflects the change.)
+  mla context advisory
+                    (list the untracked agent-memory rules the cold-start scan
+                     discovered. These are machine_inferred and NEVER auto-injected;
+                     they ride a review-only worklist until a human attests them in a
+                     tracked instruction file. Read-only by design.)
+  mla debug bundle --trace-id <id> [--out <path>] [--no-backend]
+                    [--include-prompts] [--include-diffs] [--yes|-y]
+                    [--command <name>] [--run-id <id>] [--session-id <id>] [-q]
+                    (write a local, inspectable .zip for a trace_id so you can
+                     attach it to an issue by choice. Nothing uploads. Raw
+                     payloads (prompts, bodies, diffs) are EXCLUDED by default;
+                     the include flags require an interactive confirm or --yes.
+                     Manifest-first + mandatory redaction report; offline-capable.
+                     Default output: ~/.meetless/debug/<trace_id>.zip)
+  mla evidence ce0-export
+  mla evidence ce0-import-labels <file>
+                    (the human-only CE0 evidence-consultation labeling workflow:
+                     ce0-export writes the JSONL of deadline-claimed obligations
+                     with the deterministic machine baseline; ce0-import-labels
+                     reads a labeled file back and CAS-finalizes each obligation
+                     with the human's terminal outcome. Local only, no egress.)
+  mla help
+  mla _internal finalize-session <sessionId>
+  mla _internal auto-index [--session <sid>]
+                    (Zone 2: index this session's produced docs into the owner's
+                     Personal KB as SHADOW; fired detached from the Stop hook)
+  mla _internal evidence-correlate
+                    (close pending evidence-inject windows and append
+                     mla_evidence_outcome; fired detached from the Stop hook)
+  mla _internal evidence-turn-open
+                    (CE0 RECORD_ONLY: classify the turn's memory requirement and
+                     open its obligation; fired from the UserPromptSubmit hook)
+  mla _internal evidence-capture
+                    (CE0 RECORD_ONLY: record a governed-memory pull as a
+                     ConsultationAttempt; fired from the PostToolUse hook)
+  mla _internal evidence-stop
+                    (CE0 RECORD_ONLY: freeze the turn obligation's eligibility
+                     boundary; fired from the Stop hook)
+  mla _internal steer-sync --session <sid>
+                    (pull pending cross-session steers into the local cache and
+                     mark the surfaced ones injected; invoked by flush.sh)
+  mla _internal capture-decisions --source <post_tool_use|stop_transcript_scan>
+                    --session <id> [--transcript <path>] [--spool <path>]
+                    (normalize AskUserQuestion Q&A into agent_decision_captured
+                     spool events; post_tool_use reads the hook payload from
+                     stdin, stop_transcript_scan scans the session transcript)
+  mla _internal pretool-observe
+                    (observe-only PreToolUse hook entrypoint; reads the raw
+                     PreToolUse payload from stdin, records a side-channel
+                     observation, and always emits the empty {} pass-through body
+                     so it can never change a permission decision)
+  mla _internal turn-recap [--session <sid>] [--turn <n>]
+                    [--style footer|block|block-context] [--json] [--emit-langfuse]
+                    (the machine-facing per-turn assist recap; shelled out by the
+                     UserPromptSubmit hook (block-context injection) and stop.sh
+                     (--emit-langfuse). Fail-soft: prints nothing and exits 0 on any
+                     non-argv error so it can never disturb the hook.)
+  mla _internal refresh [--quiet] [--if-expiring-within <secs>]
+                    (trigger the concurrency-safe user-token refresh and map the
+                     outcome to a sysexits code (0 refreshed / 75 busy / 77 dead
+                     refresh -> mla login / 64 wrong mode); shelled out by the
+                     auth hooks to self-heal an expired access token.)
+  mla _internal session-nudge [--cwd <dir>]
+                    (SessionStart hook helper: in a logged-in git repo that is
+                     NOT activated, prints a one-line 'Meetless installed but
+                     inactive here' additionalContext for Claude Code. Silent and
+                     exits 0 otherwise. Reuses the same resolver as mla mcp.)
+  mla _internal update-check
+                    (detached, throttled background version check; fetches the
+                     latest release and caches it for the upgrade nag. Honors
+                     MLA_NO_UPDATE_NOTIFIER; always exits 0.)
+`;
+// Build-stamped version string. dist/build-info.json is generated by
+// scripts/gen-build-info.js as the second step of `pnpm build`, so the running
+// binary reports the exact commit + build time it was compiled from. Under
+// ts-node (dev) the file is absent; fall back to the bare package version.
+// This is the antidote to the stale-dist footgun: `mla --version` no longer
+// returns a frozen "0.1.0" that never moves across rebuilds.
+function versionString() {
+    const pkg = require("../package.json");
+    const base = pkg.version ?? "0.0.0";
+    try {
+        const info = JSON.parse(fs.readFileSync(path.join(__dirname, "build-info.json"), "utf8"));
+        const dirty = info.dirty ? "-dirty" : "";
+        return `${base} (${info.sha ?? "unknown"}${dirty}, built ${info.builtAt ?? "?"})`;
+    }
+    catch {
+        return `${base} (dev build, no build-info.json)`;
+    }
+}
+async function dispatch(argv) {
+    const [cmd, sub, ...rest] = argv;
+    if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
+        console.log(USAGE);
+        return 0;
+    }
+    if (cmd === "--version" || cmd === "-v") {
+        console.log(versionString());
+        return 0;
+    }
+    switch (cmd) {
+        case "init":
+            return (0, init_1.runInit)(argv.slice(1));
+        case "rewire":
+            return (0, rewire_1.runRewire)(argv.slice(1));
+        case "login":
+            return (0, login_1.runLogin)(argv.slice(1));
+        case "logout":
+            return (0, logout_1.runLogout)(argv.slice(1));
+        case "uninstall":
+            return (0, uninstall_1.runUninstall)(argv.slice(1));
+        case "whoami":
+            return (0, whoami_1.runWhoami)(argv.slice(1));
+        case "activate":
+            return (0, activate_1.runActivate)(argv.slice(1));
+        case "deactivate":
+            return (0, activate_1.runDeactivate)(argv.slice(1));
+        case "mute":
+            return (0, activate_1.runMute)(argv.slice(1));
+        case "unmute":
+            return (0, activate_1.runUnmute)(argv.slice(1));
+        case "workspace":
+            return (0, workspace_2.runWorkspace)(argv.slice(1));
+        case "doctor":
+            return (0, doctor_1.runDoctor)(argv.slice(1));
+        case "status":
+            return (0, status_1.runStatus)(argv.slice(1));
+        case "context":
+            return (0, context_1.runContext)(argv.slice(1));
+        case "flush":
+            return (0, flush_1.runFlush)(argv.slice(1));
+        case "queue": {
+            if (sub === "prune")
+                return (0, queue_prune_1.runQueuePrune)(rest);
+            console.error(`Unknown queue subcommand: ${sub ?? "(none)"}\n\n${USAGE}`);
+            return 2;
+        }
+        case "rules": {
+            // `list` reads durable R0 observations in the active runtime scope; `activity` is the R2-LOCAL
+            // accountability projection (per LIVE rule: observed N, violated M, denied; proposal §2.6 / §3.7);
+            // `attest` mints the LIVE notes-location version from an observed snapshot (R1, proposal §10.2 /
+            // §2.4); `revoke` is the kill switch that disarms a LIVE rule so the enforce seam fails open;
+            // `publish` projects the LIVE attested set in the active scope into control so the console Rules
+            // page surfaces it (the local-store -> backend bridge, idempotent + reconcile-by-omission).
+            if (sub === "list")
+                return (0, rules_1.runRulesList)(rest);
+            if (sub === "activity")
+                return (0, rules_1.runRulesActivity)(rest);
+            if (sub === "attest")
+                return (0, rules_1.runRulesAttest)(rest);
+            if (sub === "revoke")
+                return (0, rules_1.runRulesRevoke)(rest);
+            if (sub === "publish")
+                return (0, rules_1.runRulesPublish)(rest);
+            console.error(`Unknown rules subcommand: ${sub ?? "(none)"}\n\n${USAGE}`);
+            return 2;
+        }
+        case "review": {
+            // `mla review`               -> current session, no positional, only flags.
+            // `mla review <id>`          -> deep-link emission, exactly one positional.
+            // Old `latest` / `by-session` are intentionally removed; surface a clear
+            // pointer instead of silently routing the operator to the wrong path.
+            if (sub === undefined || sub.startsWith("--")) {
+                return (0, review_1.runReview)(argv.slice(1));
+            }
+            if (sub === "latest") {
+                console.error("`mla review latest` was removed. Run `mla review` inside a Claude Code " +
+                    "session, or open the queues at /relationships and /cases in the console.");
+                return 2;
+            }
+            if (sub === "by-session") {
+                console.error("`mla review by-session <sid>` was removed. The current session is the only " +
+                    "session `mla review` will surface; open the console queues to browse others.");
+                return 2;
+            }
+            return (0, review_1.runReviewById)([sub, ...rest]);
+        }
+        case "cases": {
+            console.error("`mla cases` was removed. Open the cases queue in the console, or run " +
+                "`mla review <id>` to get a deep link for a specific case.");
+            return 2;
+        }
+        case "session": {
+            if (sub === "show")
+                return (0, session_1.runSessionShow)(rest);
+            if (sub === "reconcile")
+                return (0, session_1.runSessionReconcile)(rest);
+            // `distill` + `remember` were removed (dogfood scaffold; the learning
+            // loop captures agent output directly per turn). See
+            // notes/20260531-agent-review-retraction-and-pending-items-loop.md §2.
+            console.error(`Unknown session subcommand: ${sub ?? "(none)"}\n\n${USAGE}`);
+            return 2;
+        }
+        case "ask":
+            // `mla ask` loads @meetless/ask-core. ask-core is ESM-only, so it ships as
+            // a CJS bundle the binary loads via require() (scripts/bundle-esm.js);
+            // runAsk handles bundle-vs-source resolution. Works in the binary and from
+            // a source/npm install alike, so no binary gate here.
+            return (0, ask_1.runAsk)(argv.slice(1));
+        case "kb":
+            return (0, kb_1.runKb)(argv.slice(1));
+        // `mla enrich`: agent-orchestrated onboarding enrichment. `enrich plan` scans the
+        // repo into an immutable run record + prints the plan the agent reads; `enrich
+        // ingest` validates + persists the scouts' candidates born PENDING. The agent
+        // dispatches the read-only scouts in between. See commands/enrich.ts.
+        case "enrich":
+            return (0, enrich_1.runEnrich)(argv.slice(1));
+        // `mla graph` (alias `cg` = coordination graph) is the relationship axis's own
+        // home: `review`/`pending` route to the SAME handlers as `mla kb review`/`kb
+        // pending` (one implementation, two entry points). It exists so the coordination
+        // graph stops hiding under the storage noun `kb`. Document/posture verbs typed
+        // here are redirected back to `mla kb` rather than conflated. See commands/graph.ts.
+        case "graph":
+        case "cg":
+            return (0, graph_1.runGraph)(argv.slice(1));
+        case "summary":
+            return (0, summary_1.runSummary)(argv.slice(1));
+        case "label":
+            return (0, label_1.runLabel)(argv.slice(1));
+        case "stats":
+            return (0, stats_1.runStats)(argv.slice(1));
+        // `mla turn [N]` is the per-turn analog of `mla stats`; `mla stats --turn`
+        // routes to the SAME runTurn handler (one implementation, two entry points).
+        case "turn":
+            return (0, turn_1.runTurn)(argv.slice(1));
+        // `mla adoption` is an alias for `mla stats evidence` (INV-ADOPTION-SOURCE-1):
+        // both route through the same runStats -> runAdoption code path, so the two
+        // entry points are byte-identical, not two implementations.
+        case "adoption":
+            return (0, stats_1.runStats)(["evidence", ...argv.slice(1)]);
+        case "debug":
+            return (0, debug_1.runDebug)(argv.slice(1));
+        // `mla evidence` is the one human-only CE0 evidence-consultation labeling workflow
+        // (notes/20260617-evidence-consultation-forcing-function-proposal.md §2.3): ce0-export writes
+        // the JSONL a labeler audits, ce0-import-labels reads it back and CAS-finalizes. Local only.
+        case "evidence":
+            return (0, evidence_1.runEvidence)(argv.slice(1));
+        // `mla mcp` boots the Meetless MCP server over stdio, authenticated as the
+        // logged-in human (cli-config user-token) and scoped to the marker
+        // workspace. Replaces the old standalone `meetless-mcp` service-key bin.
+        //
+        // Self-heal split (lib/mcp-restart.ts): a bare `mla mcp` runs the thin
+        // supervising parent, which respawns a `mla mcp --child` worker whenever a
+        // newer build lands on disk, so the long-lived daemon stops serving stale
+        // code (the "This operation was aborted" footgun) without an editor restart.
+        // The child (and the MEETLESS_MCP_SUPERVISOR=0 kill switch) run the worker
+        // directly.
+        case "mcp":
+            // @meetless/mcp is ESM-only and ships as a CJS bundle the binary loads via
+            // require() (scripts/bundle-esm.js); runMcp/loadAndServe handle
+            // bundle-vs-source resolution. Works in the binary and from a source/npm
+            // install alike, so no binary gate here.
+            return (0, mcp_restart_1.shouldSuperviseMcp)(argv.slice(1), process.env)
+                ? (0, mcp_supervisor_1.runMcpSupervisor)(argv.slice(1))
+                : (0, mcp_1.runMcp)(argv.slice(1));
+        // `mla upgrade` [--check] [--force]: explicit, foreground self-upgrade. Fetches
+        // and Ed25519-verifies the signed release manifest, enforces the downgrade
+        // guard, and atomically swaps the binary in place (curl installs only; brew/
+        // npm/unknown are redirected to their package manager). The silent background
+        // path (stage + apply-on-launch) is separate; this is the user-driven command.
+        case "upgrade":
+            return (0, upgrade_apply_1.runUpgrade)({ argv: argv.slice(1) });
+        case "_internal": {
+            if (sub === "finalize-session")
+                return (0, internal_finalize_1.runInternalFinalize)(rest);
+            if (sub === "active-review")
+                return (0, internal_active_review_1.runInternalActiveReview)(rest);
+            if (sub === "auto-index")
+                return (0, internal_auto_index_1.runInternalAutoIndex)(rest);
+            if (sub === "evidence-inject")
+                return (0, internal_evidence_inject_1.runInternalEvidenceInject)(rest);
+            if (sub === "evidence-correlate")
+                return (0, internal_evidence_correlate_1.runInternalEvidenceCorrelate)(rest);
+            if (sub === "evidence-turn-open")
+                return (0, internal_evidence_hooks_1.runInternalEvidenceTurnOpen)(rest);
+            if (sub === "evidence-capture")
+                return (0, internal_evidence_hooks_1.runInternalEvidenceCapture)(rest);
+            if (sub === "evidence-stop")
+                return (0, internal_evidence_hooks_1.runInternalEvidenceStop)(rest);
+            if (sub === "steer-sync")
+                return (0, internal_steer_sync_1.runInternalSteerSync)(rest);
+            if (sub === "capture-decisions")
+                return (0, internal_capture_decisions_1.runCaptureDecisions)(rest);
+            if (sub === "pretool-observe")
+                return (0, internal_pretool_observe_1.runInternalPretoolObserve)(rest);
+            if (sub === "turn-recap")
+                return (0, internal_turn_recap_1.runInternalTurnRecap)(rest);
+            if (sub === "refresh")
+                return (0, internal_refresh_1.runInternalRefresh)(rest);
+            if (sub === "session-nudge")
+                return (0, internal_session_nudge_1.runInternalSessionNudge)(rest);
+            if (sub === "update-check")
+                return (0, update_notifier_1.runInternalUpdateCheck)();
+            if (sub === "scan-context")
+                return (0, scan_context_1.runScanContext)(rest);
+            console.error(`Unknown _internal subcommand: ${sub ?? "(none)"}`);
+            return 2;
+        }
+        default:
+            console.error(`Unknown command: ${cmd}\n\n${USAGE}`);
+            return 2;
+    }
+}
+// Observability bootstrap: Sentry init MUST run BEFORE any other work so
+// bootstrap failures (config load, http first-hop) still surface as alerts.
+// trace_id is minted once per invocation and threaded through every outbound
+// HTTP request via lib/http.ts (X-Trace-ID header). It is IMMUTABLE for the
+// run; mlaFetch never reads response X-Trace-ID back. See spec §4.
+//
+// Spine note (notes/20260530-mla-observability-diagnostic-spine.md):
+//   - Canonical trace_id is 32 hex chars (OTel-native), NOT UUIDv4. This
+//     matches intel's RequestContext.langfuse_trace_id format and avoids any
+//     translation across Sentry/Langfuse/X-Trace-ID planes.
+//   - P2 lifecycle: one root span per command (`mla.<cmd>.<sub>`), one child
+//     span per outbound HTTP call (wired in lib/http.ts), root carries
+//     redacted argv + exit code, deep link printed only when trace landed.
+// Read CliConfig if present; return null otherwise. Used by the lifecycle
+// wrapper to know whether the run has any control hop at all (`mla init`,
+// `mla --help`, `mla doctor` on a fresh box have no config). When null, the
+// run uses a no-op tracer and skips the workspace/me prefetch.
+function tryReadConfig() {
+    try {
+        return (0, config_1.readConfig)();
+    }
+    catch {
+        return null;
+    }
+}
+// Best-effort GET /internal/v1/workspaces/me. Hydrates the run-local workspace
+// config so workspaceSentryAllowed + the Langfuse deep-link gate have real
+// data.
+//
+// If a workspace config is already preset (test fixtures, future programmatic
+// callers), we DO NOT touch it: the existing value is treated as authoritative
+// and we skip the network hop entirely. On a fresh run with no preset, success
+// stores the config; failure (control down, bad token, 404) is a silent no-op
+// so the run continues with sentryEnabled=false + no deep link.
+async function prefetchWorkspaceConfig(cfg, workspaceId) {
+    if ((0, observability_1.getWorkspaceConfig)())
+        return;
+    try {
+        const data = await (0, http_1.get)(cfg, `/internal/v1/workspaces/me?workspaceId=${encodeURIComponent(workspaceId)}`, 4000);
+        (0, observability_1.setWorkspaceConfig)(data);
+    }
+    catch {
+        // Intentional no-op.
+    }
+}
+// Testable orchestration: mints trace_id, hydrates workspace config, opens the
+// root span, runs dispatch, captures non-zero / throw signals, ends the root,
+// flushes the trace, prints the Langfuse deep link only when the trace likely
+// landed. The real require.main entrypoint wraps this and calls process.exit.
+async function runCliBootstrap(argv) {
+    // Apply-on-launch (D3), FIRST thing of all: if the background check has staged
+    // a verified newer binary and auto-apply is on (curl installs only), promote it
+    // with a cheap local swap and re-exec this exact command on the new binary. The
+    // re-exec'd child carries MLA_UPGRADE_REEXECED=1 so it skips this block (loop
+    // guard). Runs before the trace/analytics machinery so a promoted run is not
+    // double-counted. Best-effort and fail-open: any failure leaves the current
+    // binary running. The `_internal`, `upgrade`, and `mcp` commands are carved out
+    // inside maybePromoteStagedAndReExec so the check child, explicit upgrades, and
+    // the long-lived MCP daemon (which self-heals a stale dist in-band) never
+    // self-promote underneath themselves.
+    const promote = await (0, upgrade_apply_1.maybePromoteStagedAndReExec)({ command: argv[0], env: process.env });
+    if (promote.reExeced)
+        return promote.code ?? 0;
+    // Hook auto-resync, the SECOND thing of all: the installed hooks under
+    // ~/.meetless/hooks are a copy of this binary's templates, and only `mla
+    // rewire` refreshes them, so any binary upgrade (curl/brew/npm/manual) leaves
+    // the live hooks lagging the new code until the operator re-rewires. This
+    // self-heals that the moment a new binary runs: a cheap stamp read short-
+    // circuits the steady state, and on a build-id change it re-copies only the
+    // drifted, already-installed hooks (never adds new hooks or touches
+    // settings.json -- those still need an explicit rewire). Best-effort and
+    // fail-open: it never throws and never changes the exit code. Runs for every
+    // command (including the hook-invoked `_internal` calls, which is exactly how
+    // a fresh binary first heals mid-session) since it is idempotent and gated on
+    // the stamp. See notes/20260626-hook-auto-resync.md.
+    (0, wire_1.maybeResyncHooks)();
+    // Wall-clock at the very top: duration_ms for the mla_command journey event is
+    // measured from here to finalize, and the sequence idle-gap uses this as the
+    // command's start time (spec section 6.2). Captured before any I/O so it
+    // reflects the user-perceived command duration.
+    const startedAtMs = Date.now();
+    const traceId = (0, observability_1.mintTraceId)();
+    (0, observability_1.setRunTraceId)(traceId);
+    // run_id (INV-RUN-1): the analytics invocation key, minted independently from
+    // trace_id (never derived from it). 1:1 with trace_id at the CLI in v1, but a
+    // distinct identity so hooks/MCP/child-traces can later mint their own run_id
+    // under a shared trace. Every analytics event this run emits reads it back via
+    // getRunId().
+    (0, observability_1.setRunId)((0, observability_1.mintRunId)());
+    // Repo fingerprint (T1.10): a one-way hash of the repo identity for analytics
+    // attribution, computed ONCE here (it shells out to git) and stashed in a
+    // run-local singleton that every event reads back via getRepoFingerprint().
+    // Null outside a git repo; never a raw path (INV-POSTHOG-PII-1).
+    (0, observability_1.setRepoFingerprint)((0, git_1.computeRepoFingerprint)());
+    // Agent session capture (Channel A substrate): the raw Claude session UUID,
+    // canonicalized ONCE here so every intel call this run stamps the same
+    // X-Agent-Session-ID and intel composes the workspace-namespaced Langfuse
+    // Session a single time. Null when not inside a Claude session or the env value
+    // is malformed; the header is then simply omitted. The raw UUID is never
+    // composed CLI-side (INV-COMPOSE-ONCE).
+    (0, observability_1.setRunSessionId)((0, observability_1.canonicalizeSessionId)(process.env.CLAUDE_CODE_SESSION_ID ?? null));
+    const [cmd, sub] = argv;
+    const cmdName = cmd ?? "(none)";
+    const subName = sub ?? null;
+    const cfg = tryReadConfig();
+    // Folder = workspace (T1.1): the trace workspace comes from the nearest
+    // `.meetless.json` marker, never cli-config. This bootstrap runs for EVERY
+    // command (including non-workspace ones like `mla init` from an unbound dir),
+    // so resolution is best-effort: no marker -> no workspace attribution, and the
+    // trace prefetch + flush are simply skipped rather than throwing.
+    const workspaceId = cfg ? (0, workspace_1.tryResolveWorkspaceId)() : null;
+    if (cfg && workspaceId) {
+        await prefetchWorkspaceConfig(cfg, workspaceId);
+    }
+    const buildInfo = (0, observability_1.loadBuildInfo)();
+    // Update notifier (I5): kick off a detached, throttled background version check
+    // BEFORE dispatch so it overlaps the command and the parent never waits. The
+    // nag itself is printed at the end of the run from whatever the LAST completed
+    // check cached. Both halves are best-effort and can never change the exit code.
+    (0, update_notifier_1.maybeSpawnBackgroundCheck)({ command: cmdName, env: process.env, now: startedAtMs });
+    // Content sub-kill: a null flushFn yields a no-op tracer (createRunTracer), so
+    // when trace upload is off the trace plane never POSTs a span batch to control.
+    // Gated on traceUploadEnabled() (master kill OR the MEETLESS_TRACE_UPLOAD content
+    // sub-kill), the SAME gate as initSentry below, because agent-trace spans are
+    // content-bearing (spec section 9). Spans are still built in-process (cheap, never
+    // leave the machine).
+    const flushFn = cfg && workspaceId && (0, consent_1.traceUploadEnabled)()
+        ? (0, observability_1.makeHttpFlush)({
+            controlUrl: cfg.controlUrl,
+            controlToken: cfg.controlToken,
+            workspaceId,
+            actorUserId: cfg.actorUserId,
+        })
+        : null;
+    const tracer = (0, observability_1.createRunTracer)({
+        traceId,
+        rootName: `mla.${cmdName}.${subName ?? "none"}`,
+        buildInfo,
+        flushFn,
+    });
+    // Stamp the redacted argv on the root span before dispatch. Doing it here
+    // (not inside dispatch) keeps the attribute on the root regardless of which
+    // command runs, and the redactor strips any token-shaped flag values that a
+    // user pasted on the command line.
+    tracer.root.setAttribute("argv", (0, observability_1.redactArgvForSpan)(argv));
+    (0, observability_1.setRunTracer)(tracer);
+    let code = 1;
+    let threw = false;
+    let thrown = null;
+    try {
+        code = await dispatch(argv);
+        if (code !== 0) {
+            (0, observability_1.captureCliNonZeroExit)({
+                traceId,
+                command: cmdName,
+                sub: subName,
+                exitCode: code,
+            });
+        }
+    }
+    catch (err) {
+        threw = true;
+        thrown = err;
+        const e = err;
+        if (e.status) {
+            console.error(`HTTP ${e.status}: ${e.message}`);
+        }
+        else {
+            console.error(e.message || String(err));
+        }
+        (0, observability_1.captureCliError)(err, { traceId, command: cmdName, sub: subName });
+        code = 1;
+    }
+    tracer.endRoot(threw
+        ? { status: "error", output: { exitCode: code }, error: thrown }
+        : { status: code === 0 ? "ok" : "error", output: { exitCode: code } });
+    tracer.root.setAttribute("exit_code", code);
+    await (0, observability_1.boundedTraceFlush)(tracer);
+    (0, observability_1.setRunTracer)(null);
+    // mla_command journey event (spec section 6.2, section 11.4). Recorded after the
+    // result is known: a normalized command/subcommand/flags-shape (never raw argv),
+    // the closed-enum outcome, the run's sequence fields, and timing. Local-first and
+    // fully best-effort: captureCommandEvent swallows every failure so analytics can
+    // never change the exit code below. sessionId is the ambient Claude Code session
+    // the same way `mla review`/`mla summary` bind it.
+    await (0, capture_1.captureCommandEvent)({
+        argv,
+        exitCode: code,
+        threw,
+        thrown,
+        workspaceId,
+        sessionId: (process.env.CLAUDE_CODE_SESSION_ID || "").trim() || null,
+        actorUserId: cfg?.actorUserId ?? null,
+        mlaVersion: buildInfo.version,
+        gitSha: buildInfo.sha,
+        startedAtMs,
+        nowMs: Date.now(),
+        cfg: cfg ?? null,
+    });
+    // Deep link: print iff tracing.enabled === true AND langfuseProjectId set
+    // AND (flush succeeded OR intel echoed the inbound X-Trace-ID). The gate is
+    // checked inside maybePrintDeepLink; a no-op tracer + missing workspace
+    // config always falls through silently.
+    (0, observability_1.maybePrintDeepLink)({
+        traceId,
+        config: (0, observability_1.getWorkspaceConfig)(),
+        flushSucceeded: (0, observability_1.didTraceFlushSucceed)(),
+        intelEchoed: (0, observability_1.didIntelEchoTraceId)(),
+    });
+    // Update notifier (I5): print the install-method-aware upgrade nag last, so it
+    // is the final thing the user sees. Reads only the cache; gated on TTY, off CI,
+    // and MLA_NO_UPDATE_NOTIFIER. Never affects `code`.
+    (0, update_notifier_1.maybeShowUpdateNag)({ currentVersion: buildInfo.version, env: process.env });
+    return code;
+}
+if (require.main === module) {
+    const buildInfo = (0, observability_1.loadBuildInfo)();
+    // Sentry is the content-bearing error plane, so it is gated on the trace-upload
+    // posture (opt-out, master-kill-aware), not just the bare telemetry kill switch.
+    // initSentry itself also refuses when telemetryDisabled(); this is the explicit
+    // content sub-kill in front of it (INV-CONSENT-1).
+    if ((0, consent_1.traceUploadEnabled)()) {
+        (0, observability_1.initSentry)(buildInfo);
+    }
+    const argv = process.argv.slice(2);
+    runCliBootstrap(argv)
+        .then(async (code) => {
+        await (0, observability_1.boundedSentryFlush)();
+        process.exit(code);
+    })
+        .catch(async (err) => {
+        console.error(err?.message || String(err));
+        await (0, observability_1.boundedSentryFlush)();
+        process.exit(1);
+    });
+}