@mrrlin-dev/mcp 0.2.5 → 0.3.0

package/dist/bin.cjs

@@ -18671,11 +18671,11 @@ var require_dist = __commonJS({
 });
 
 // src/bin.ts
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_child_process7 = require("node:child_process");
 var import_node_fs14 = require("node:fs");
-var import_node_os10 = require("node:os");
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_os11 = require("node:os");
+var import_node_path20 = __toESM(require("node:path"), 1);
 
 // src/install-codex.ts
 var import_promises = __toESM(require("node:fs/promises"), 1);
@@ -18759,7 +18759,7 @@ async function installCodex(options) {
   const configPath = import_node_path.default.join(codexHome, "config.toml");
   const distribution = await detectInstallDistribution(options);
   await import_promises.default.mkdir(codexHome, { recursive: true, mode: 448 });
-  const writePrompts = async () => installPrompts(codexHome, options.prompts ?? []);
+  const writePrompts = async () => installPrompts(codexHome, options.prompts ?? [], options.forcePrompts === true);
   if (!await pathExists(configPath)) {
     await import_promises.default.writeFile(configPath, renderBlock(options.binPath, distribution).replace(/^\n/, ""), { mode: 384 });
     return { action: "created", configPath, prompts: await writePrompts() };
@@ -18799,7 +18799,7 @@ async function installCodex(options) {
   await import_promises.default.writeFile(realPath, appended, { mode: 384 });
   return { action: "appended", configPath: realPath, prompts: await writePrompts() };
 }
-async function installPrompts(codexHome, prompts) {
+async function installPrompts(codexHome, prompts, forcePrompts) {
   if (prompts.length === 0) return [];
   const promptsDir2 = import_node_path.default.join(codexHome, "prompts");
   await import_promises.default.mkdir(promptsDir2, { recursive: true, mode: 448 });
@@ -18812,12 +18812,21 @@ async function installPrompts(codexHome, prompts) {
     } catch {
       existing = null;
     }
+    if (existing === null) {
+      await import_promises.default.writeFile(promptPath, prompt.content, { mode: 384 });
+      out.push({ name: prompt.name, action: "created", promptPath });
+      continue;
+    }
     if (existing === prompt.content) {
       out.push({ name: prompt.name, action: "noop", promptPath });
       continue;
     }
+    if (!forcePrompts) {
+      out.push({ name: prompt.name, action: "skipped-modified", promptPath });
+      continue;
+    }
     await import_promises.default.writeFile(promptPath, prompt.content, { mode: 384 });
-    out.push({ name: prompt.name, action: existing === null ? "created" : "updated", promptPath });
+    out.push({ name: prompt.name, action: "updated", promptPath });
   }
   return out;
 }
@@ -18838,11 +18847,11 @@ ${block}`;
 }
 
 // src/director-bridge.ts
-var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_fs10 = __toESM(require("node:fs"), 1);
 var import_node_http = __toESM(require("node:http"), 1);
 var import_node_os7 = __toESM(require("node:os"), 1);
-var import_node_path12 = __toESM(require("node:path"), 1);
-var import_node_child_process4 = require("node:child_process");
+var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_child_process3 = require("node:child_process");
 var import_node_crypto4 = __toESM(require("node:crypto"), 1);
 
 // ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/wrapper.mjs
@@ -19257,13 +19266,15 @@ async function acquireThread(codex, opts) {
 }
 
 // ../../packages/codex-client/dist/render-context-bundle.js
+var DEFAULT_SPEC_BUDGET_CHARS = 6e3;
+var DEFAULT_ARTIFACT_PAYLOAD_BUDGET_CHARS = 400;
 function renderContextBundle(input) {
   const sections = [];
   sections.push(renderTaskSummary(input.task));
-  sections.push(renderSpec(input.specMarkdown));
+  sections.push(renderSpec(input.specMarkdown, input.compact));
   sections.push(renderRunHistory(input.runs, input.openRunId));
   sections.push(renderOpenRun(input.openRunId));
-  sections.push(renderArtifacts(input.artifacts, input.omittedArtifactCount ?? 0));
+  sections.push(renderArtifacts(input.artifacts, input.omittedArtifactCount ?? 0, input.compact));
   sections.push(renderAutonomyEvents(input.autonomyEvents));
   return sections.join("\n\n");
 }
@@ -19281,11 +19292,55 @@ function renderTaskSummary(task) {
   }
   return lines2.join("\n");
 }
-function renderSpec(specMarkdown) {
+function renderSpec(specMarkdown, compact) {
   if (!specMarkdown)
     return "## Spec\n(none)";
-  return `## Spec
+  if (!compact)
+    return `## Spec
 ${specMarkdown}`;
+  const budget = compact.specBudgetChars ?? DEFAULT_SPEC_BUDGET_CHARS;
+  if (specMarkdown.length <= budget)
+    return `## Spec
+${specMarkdown}`;
+  return `## Spec
+${compactSpecMarkdown(specMarkdown, budget, compact.projectSlug ?? null, compact.specWikiPageId ?? null)}`;
+}
+function compactSpecMarkdown(markdown, totalBudget, projectSlug, specWikiPageId) {
+  const lines2 = markdown.split(/\r?\n/);
+  const sections = [{ heading: "", body: [] }];
+  for (const line of lines2) {
+    if (/^#{1,6}\s/.test(line)) {
+      sections.push({ heading: line, body: [] });
+    } else {
+      sections[sections.length - 1].body.push(line);
+    }
+  }
+  const sectionCount = Math.max(1, sections.length);
+  const perSectionBudget = Math.max(120, Math.floor(totalBudget / sectionCount));
+  const out = [];
+  for (const section of sections) {
+    const bodyText = section.body.join("\n").replace(/^\s+|\s+$/g, "");
+    if (section.heading)
+      out.push(section.heading);
+    if (!bodyText)
+      continue;
+    if (bodyText.length <= perSectionBudget) {
+      out.push(bodyText);
+    } else {
+      const kept = bodyText.slice(0, perSectionBudget);
+      const omitted = bodyText.length - perSectionBudget;
+      out.push(`${kept}
+\u2026(${omitted} chars omitted; retrieve full spec for the rest)`);
+    }
+  }
+  if (projectSlug && specWikiPageId) {
+    out.push("");
+    out.push(`> Compact spec. Source: mrrlin://wiki/${projectSlug}/${specWikiPageId} \u2014 call retrieve_context with this handle before any irreversible decision.`);
+  } else {
+    out.push("");
+    out.push("> Compact spec. Retrieve the Specs/{id} wiki page via get_wiki_page before any irreversible decision.");
+  }
+  return out.join("\n");
 }
 function renderRunHistory(runs, openRunId) {
   if (runs.length === 0)
@@ -19301,13 +19356,14 @@ function renderOpenRun(openRunId) {
   return `## Open run
 ${openRunId ?? "(none)"}`;
 }
-function renderArtifacts(artifacts, omittedCount) {
+function renderArtifacts(artifacts, omittedCount, compact) {
   if (artifacts.length === 0 && omittedCount === 0)
     return "## Artifacts\n(none)";
   const lines2 = ["## Artifacts"];
   if (omittedCount > 0) {
     lines2.push(`(+${omittedCount} older artifact${omittedCount === 1 ? "" : "s"} omitted)`);
   }
+  let truncatedAny = false;
   for (const artifact of artifacts) {
     if (artifact.kind === "file") {
       const p = artifact.payload;
@@ -19316,7 +19372,16 @@ function renderArtifacts(artifacts, omittedCount) {
         continue;
       }
     }
-    lines2.push(`- ${artifact.createdAt} [${artifact.kind}] run=${artifact.runId} ${JSON.stringify(artifact.payload)}`);
+    const payloadText = JSON.stringify(artifact.payload);
+    const budget = compact?.artifactPayloadBudgetChars ?? DEFAULT_ARTIFACT_PAYLOAD_BUDGET_CHARS;
+    const willTruncate = !!compact && payloadText.length > budget;
+    const rendered = willTruncate ? `${payloadText.slice(0, budget)}\u2026(${payloadText.length - budget} chars omitted)` : payloadText;
+    if (willTruncate)
+      truncatedAny = true;
+    lines2.push(`- ${artifact.createdAt} [${artifact.kind}] run=${artifact.runId} ${rendered}`);
+  }
+  if (compact && (omittedCount > 0 || truncatedAny)) {
+    lines2.push("> Compact artifacts. Use retrieve_context with a `mrrlin://run/{projectSlug}/{runId}/artifacts` handle (substitute the slug and run id from the lines above) to load a run's full artifact history.");
   }
   return lines2.join("\n");
 }
@@ -33892,7 +33957,6 @@ var openApiOperationIds = {
   listExecutionArtifacts: "listExecutionArtifacts",
   listExecutionRuns: "listExecutionRuns",
   listGithubInstallations: "listGithubInstallations",
-  listGithubWebhookDeliveries: "listGithubWebhookDeliveries",
   listGithubWorkflows: "listGithubWorkflows",
   listPlans: "listPlans",
   listProjects: "listProjects",
@@ -33909,7 +33973,6 @@ var openApiOperationIds = {
   decideInboxItem: "decideInboxItem",
   markInboxItemRead: "markInboxItemRead",
   markAllInboxItemsRead: "markAllInboxItemsRead",
-  receiveGithubWebhook: "receiveGithubWebhook",
   searchKnowledge: "searchKnowledge",
   updateExecutionRun: "updateExecutionRun",
   upsertProjectSchedulerPolicy: "upsertProjectSchedulerPolicy",
@@ -33926,6 +33989,10 @@ var openApiOperationIds = {
   listAgentCredentials: "listAgentCredentials",
   revokeAgentCredential: "revokeAgentCredential",
   exchangeAgentToken: "exchangeAgentToken",
+  // ADR 0016 — operator-scoped credential routes.
+  issueOperatorAgentCredential: "issueOperatorAgentCredential",
+  listOperatorAgentCredentials: "listOperatorAgentCredentials",
+  revokeOperatorAgentCredential: "revokeOperatorAgentCredential",
   createArtifactFile: "createArtifactFile",
   completeArtifactFile: "completeArtifactFile",
   getArtifactFile: "getArtifactFile",
@@ -33949,7 +34016,12 @@ var operatorSessionSchema = external_exports.object({
   login: external_exports.string().min(1),
   projectSlug: external_exports.string().min(1),
   provider: external_exports.literal("github"),
-  repo: external_exports.string().min(1).nullable()
+  repo: external_exports.string().min(1).nullable(),
+  // ADR 0016: `scope` distinguishes project-pinned agent tokens (legacy, default) from
+  // operator-scoped agent tokens. Only relevant for kind:"agent". `web` sessions ignore it.
+  // Default 'project' for backward-compat: tokens minted before this field existed parse
+  // cleanly into the project branch of the middleware (which mirrors today's behavior).
+  scope: external_exports.enum(["project", "operator"]).default("project")
 });
 var AGENT_SESSION_TTL_MS = 1e3 * 60 * 60;
 
@@ -34251,15 +34323,6 @@ var mrrlinGithubWorkflowDispatchSchema = external_exports.object({
   ref: external_exports.string().min(1),
   workflowId: external_exports.string().min(1)
 });
-var mrrlinGithubWebhookDeliverySchema = external_exports.object({
-  action: external_exports.string().min(1).nullable(),
-  deliveryId: external_exports.string().min(1),
-  eventType: external_exports.string().min(1),
-  installationId: external_exports.number().int().positive().nullable(),
-  projectSlug: mrrlinProjectSlugSchema.nullable(),
-  receivedAt: external_exports.string().datetime(),
-  repositoryFullName: external_exports.string().regex(/^[^/]+\/[^/]+$/).nullable()
-});
 var mrrlinProjectSummarySchema = external_exports.object({
   displayName: external_exports.string().min(1),
   emoji: mrrlinProjectEmojiSchema,
@@ -34485,14 +34548,6 @@ var githubBindProjectRepoRequestSchema = external_exports.object({
 var githubBindProjectRepoResponseSchema = external_exports.object({
   data: mrrlinProjectSummarySchema
 });
-var githubWebhookReceiptResponseSchema = external_exports.object({
-  data: external_exports.object({
-    deliveryId: external_exports.string().min(1),
-    eventType: external_exports.string().min(1),
-    linkedProjectSlugs: external_exports.array(mrrlinProjectSlugSchema),
-    stored: external_exports.boolean()
-  })
-});
 var githubCreateBranchRequestSchema = external_exports.object({
   baseBranch: external_exports.string().min(1).default("main"),
   branchName: external_exports.string().min(1)
@@ -34542,9 +34597,6 @@ var githubLatestDeploymentQuerySchema = external_exports.object({
 var githubLatestDeploymentResponseSchema = external_exports.object({
   data: external_exports.object({ deploymentId: external_exports.number().int(), environmentUrl: external_exports.string() }).nullable()
 });
-var githubWebhookDeliveryListResponseSchema = external_exports.object({
-  data: external_exports.array(mrrlinGithubWebhookDeliverySchema)
-});
 var githubMintPushTokenRequestSchema = external_exports.object({
   runId: mrrlinExecutionRunIdSchema,
   leaseId: external_exports.string().min(1)
@@ -34757,13 +34809,24 @@ var agentCredentialSummarySchema = external_exports.object({
   createdAt: external_exports.string().datetime(),
   lastUsedAt: external_exports.string().datetime().nullable(),
   revokedAt: external_exports.string().datetime().nullable(),
-  expiresAt: external_exports.string().datetime().nullable()
+  expiresAt: external_exports.string().datetime().nullable(),
+  // ADR 0016: surface scope so UI can label rows; seedProjectSlug is audit-only ("issued from
+  // project X"). Both default to 'project'/null for back-compat with legacy rows.
+  scope: external_exports.enum(["project", "operator"]).default("project"),
+  seedProjectSlug: external_exports.string().nullable().default(null)
 });
 var agentCredentialListResponseSchema = external_exports.object({
   data: external_exports.array(agentCredentialSummarySchema)
 });
 var exchangeAgentTokenRequestSchema = external_exports.object({
-  secret: external_exports.string().min(1)
+  // ADR 0016 §3 no-oracle: the exchange schema MUST accept any string shape for `secret` and
+  // `projectSlug`. Empty/whitespace/missing inputs are handled by the handler's constant-work
+  // 5-step loop and flow into the same uniform 401 path as wrong-secret. A schema-level 400
+  // would leak (attacker can distinguish "malformed input" from "wrong secret" before the
+  // handler runs). Validation of structural content (e.g. selector parseability for `secret`)
+  // happens inside the handler against the dummy hash.
+  secret: external_exports.string(),
+  projectSlug: external_exports.string().optional()
 });
 var exchangeAgentTokenResponseSchema = external_exports.object({
   token: external_exports.string().min(1),
@@ -34978,10 +35041,10 @@ var AgentTokenProviderError = class extends Error {
     this.code = code;
   }
 };
-async function defaultExchange(secret, baseUrl) {
+async function defaultExchange(secret, baseUrl, projectSlug) {
   const url2 = `${baseUrl.replace(/\/$/, "")}/auth/agent/token`;
   const response = await fetch(url2, {
-    body: JSON.stringify({ secret }),
+    body: JSON.stringify({ secret, ...projectSlug ? { projectSlug } : {} }),
     headers: { "content-type": "application/json" },
     method: "POST"
   });
@@ -35006,22 +35069,28 @@ function createAgentTokenProvider(opts) {
   const { baseUrl, secret } = opts;
   const exchange = opts.exchange ?? defaultExchange;
   const now = opts.now ?? (() => Date.now());
-  let cached2 = null;
-  function isValid() {
-    if (!cached2)
+  const LEGACY_KEY = "__mrrlin_agent_no_slug__";
+  const cacheByKey = /* @__PURE__ */ new Map();
+  function cacheKey(projectSlug) {
+    return projectSlug ?? LEGACY_KEY;
+  }
+  function isValid(entry) {
+    if (!entry)
       return false;
-    const expiresAtMs = new Date(cached2.expiresAt).getTime();
+    const expiresAtMs = new Date(entry.expiresAt).getTime();
     return now() < expiresAtMs - REFRESH_BUFFER_MS;
   }
-  async function getSession() {
-    if (!isValid()) {
-      cached2 = await exchange(secret, baseUrl);
+  async function getSession(projectSlug) {
+    const key = cacheKey(projectSlug);
+    let entry = cacheByKey.get(key);
+    if (!isValid(entry)) {
+      entry = await exchange(secret, baseUrl, projectSlug);
+      cacheByKey.set(key, entry);
     }
-    const c = cached2;
-    return { token: c.token, projectSlug: c.projectSlug, login: c.login };
+    return { token: entry.token, projectSlug: entry.projectSlug, login: entry.login };
   }
-  async function getToken() {
-    return (await getSession()).token;
+  async function getToken(projectSlug) {
+    return (await getSession(projectSlug)).token;
   }
   return { getToken, getSession };
 }
@@ -35319,10 +35388,6 @@ function createMrrlinClient(config2) {
       const body = await request(`${projectPath(projectSlug)}/github/workflows`);
       return githubWorkflowListResponseSchema.parse(body).data;
     },
-    async listGithubWebhookDeliveries(projectSlug) {
-      const body = await request(`${projectPath(projectSlug)}/github/webhook-deliveries`);
-      return githubWebhookDeliveryListResponseSchema.parse(body).data;
-    },
     async listProjects() {
       const body = await request("/projects");
       return projectSummaryListResponseSchema.parse(body).data;
@@ -35754,6 +35819,24 @@ function createMrrlinClient(config2) {
         method: "POST"
       });
       return exchangeAgentTokenResponseSchema.parse(body);
+    },
+    // ── ADR 0016 — operator-scoped credential client methods ─────────────────
+    async issueOperatorAgentCredential(input) {
+      const body = await request("/operator/agent-credentials", {
+        body: JSON.stringify(input),
+        headers: { "content-type": "application/json" },
+        method: "POST"
+      });
+      return agentCredentialResponseSchema.parse(body.data);
+    },
+    async listOperatorAgentCredentials() {
+      const body = await request("/operator/agent-credentials");
+      return agentCredentialListResponseSchema.parse(body).data;
+    },
+    async revokeOperatorAgentCredential(credentialId) {
+      await request(`/operator/agent-credentials/${encodeURIComponent(credentialId)}`, {
+        method: "DELETE"
+      });
     }
   };
 }
@@ -36427,7 +36510,17 @@ async function driveRun(deps, projectSlug, runId) {
   }
   const leaseId = claimed.leaseId;
   const task = await deps.client.getTask(projectSlug, claimed.taskId);
-  const bundle = renderContextBundle(await gatherContext(deps.client, projectSlug, task, runId));
+  const compactEnabled = (process.env.MRRLIN_MCP_COMPACT_DISABLE ?? "").trim() !== "1";
+  const context = await gatherContext(deps.client, projectSlug, task, runId);
+  const bundle = renderContextBundle(
+    compactEnabled ? {
+      ...context,
+      compact: {
+        projectSlug,
+        specWikiPageId: task.specWikiPageId ?? null
+      }
+    } : context
+  );
   const checkout = deps.checkoutRegistry?.get(projectSlug) ?? null;
   let sandbox = "read-only";
   let turnCwd = deps.codexCwd ?? null;
@@ -40918,75 +41011,10 @@ var CheckoutRegistry = class {
   }
 };
 
-// src/checkout-scan.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path9 = require("node:path");
-var import_node_child_process3 = require("node:child_process");
-
-// src/git-remote-match.ts
-function normalizeRemote(url2) {
-  const trimmed = url2.trim().replace(/\.git$/i, "");
-  const scp = /^[^@]+@[^:]+:(.+)$/.exec(trimmed);
-  const pathPart = scp ? scp[1] : (() => {
-    try {
-      return new URL(trimmed).pathname.replace(/^\/+/, "");
-    } catch {
-      return null;
-    }
-  })();
-  if (!pathPart) return null;
-  const segs = pathPart.split("/").filter(Boolean);
-  if (segs.length < 2) return null;
-  return `${segs[segs.length - 2]}/${segs[segs.length - 1]}`.toLowerCase();
-}
-function remoteMatchesRepo(remoteUrl, repoFullName) {
-  const a = normalizeRemote(remoteUrl);
-  return a !== null && a === repoFullName.trim().toLowerCase();
-}
-
-// src/checkout-scan.ts
-var SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", ".cache", "Library", ".Trash"]);
-function originUrl(dir) {
-  try {
-    return (0, import_node_child_process3.execFileSync)("git", ["-C", dir, "remote", "get-url", "origin"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function scanForCheckouts(roots, repoFullName, opts = {}) {
-  const maxDepth = opts.maxDepth ?? 3;
-  const out = [];
-  const walk = (dir, depth) => {
-    if (depth > maxDepth) return;
-    const url2 = originUrl(dir);
-    if (url2) {
-      if (remoteMatchesRepo(url2, repoFullName)) out.push(dir);
-      return;
-    }
-    let entries = [];
-    try {
-      entries = (0, import_node_fs8.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !SKIP.has(e.name)).map((e) => e.name);
-    } catch {
-      return;
-    }
-    for (const name of entries) walk((0, import_node_path9.join)(dir, name), depth + 1);
-  };
-  for (const root of roots) walk(root, 0);
-  return out;
-}
-function defaultScanRoots(home) {
-  const fromEnv = (process.env.MRRLIN_DIRECTOR_BRIDGE_SCAN_ROOTS ?? "").trim();
-  if (fromEnv) return fromEnv.split(":").filter(Boolean);
-  return ["dev", "projects", "src", "work"].map((d) => (0, import_node_path9.join)(home, d));
-}
-
 // src/executor-server.ts
-var import_node_fs9 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_os6 = require("node:os");
-var import_node_path10 = require("node:path");
+var import_node_path9 = require("node:path");
 var DENY_READ_GLOBS = [
   "**/.ssh/**",
   "**/.aws/**",
@@ -41019,15 +41047,15 @@ function buildExecutorConfig(opts) {
 }
 function operatorSecretPaths(realHome = (0, import_node_os6.homedir)()) {
   return [
-    (0, import_node_path10.join)(realHome, ".ssh"),
-    (0, import_node_path10.join)(realHome, ".aws"),
-    (0, import_node_path10.join)(realHome, ".config", "gh"),
-    (0, import_node_path10.join)(realHome, ".npmrc"),
-    (0, import_node_path10.join)(realHome, ".netrc"),
-    (0, import_node_path10.join)(realHome, ".gnupg"),
-    (0, import_node_path10.join)(realHome, ".kube"),
-    (0, import_node_path10.join)(realHome, ".docker", "config.json"),
-    (0, import_node_path10.join)(realHome, ".config", "gcloud")
+    (0, import_node_path9.join)(realHome, ".ssh"),
+    (0, import_node_path9.join)(realHome, ".aws"),
+    (0, import_node_path9.join)(realHome, ".config", "gh"),
+    (0, import_node_path9.join)(realHome, ".npmrc"),
+    (0, import_node_path9.join)(realHome, ".netrc"),
+    (0, import_node_path9.join)(realHome, ".gnupg"),
+    (0, import_node_path9.join)(realHome, ".kube"),
+    (0, import_node_path9.join)(realHome, ".docker", "config.json"),
+    (0, import_node_path9.join)(realHome, ".config", "gcloud")
   ];
 }
 var SECRET_DIRECTORY_BASENAMES = /* @__PURE__ */ new Set([".ssh", ".aws", "gh", ".gnupg", ".kube", "gcloud"]);
@@ -41036,8 +41064,8 @@ function isSecretDirectoryPath(p) {
   return SECRET_DIRECTORY_BASENAMES.has(base);
 }
 function writeExecutorCodexHome(scratchDir, opts) {
-  const codexHome = (0, import_node_path10.join)(scratchDir, ".codex");
-  (0, import_node_fs9.mkdirSync)(codexHome, { recursive: true });
+  const codexHome = (0, import_node_path9.join)(scratchDir, ".codex");
+  (0, import_node_fs8.mkdirSync)(codexHome, { recursive: true });
   const hasEgress = opts.egressDomains.length > 0;
   const networkSection = hasEgress ? [
     "[permissions.executor.network]",
@@ -41072,21 +41100,21 @@ function writeExecutorCodexHome(scratchDir, opts) {
     networkSection,
     ""
   ].join("\n");
-  (0, import_node_fs9.writeFileSync)((0, import_node_path10.join)(codexHome, "config.toml"), toml3, "utf8");
+  (0, import_node_fs8.writeFileSync)((0, import_node_path9.join)(codexHome, "config.toml"), toml3, "utf8");
   return codexHome;
 }
 async function startExecutorServer(opts) {
   const egressDomains = opts.egressDomains ?? DEFAULT_EGRESS_DOMAINS;
   const realHome = (0, import_node_os6.homedir)();
   const denySecretPaths = operatorSecretPaths(realHome);
-  const scratchDir = (0, import_node_fs9.mkdtempSync)((0, import_node_path10.join)((0, import_node_os6.tmpdir)(), "mrrlin-executor-"));
+  const scratchDir = (0, import_node_fs8.mkdtempSync)((0, import_node_path9.join)((0, import_node_os6.tmpdir)(), "mrrlin-executor-"));
   const scratchHome = scratchDir;
   let scratchCleaned = false;
   const cleanScratch = () => {
     if (scratchCleaned) return;
     scratchCleaned = true;
     try {
-      (0, import_node_fs9.rmSync)(scratchDir, { recursive: true, force: true });
+      (0, import_node_fs8.rmSync)(scratchDir, { recursive: true, force: true });
     } catch {
     }
   };
@@ -41277,17 +41305,10 @@ function extractVerificationSection(markdown) {
 }
 
 // src/bridge-log.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path11 = require("node:path");
-var NOOP_LOGGER = {
-  logIn() {
-  },
-  logOut() {
-  },
-  close() {
-  }
-};
-var REDACT_DEPTH_CAP = 8;
+var import_node_fs9 = require("node:fs");
+var import_node_path10 = require("node:path");
+
+// src/redact.ts
 var REDACTED = "[REDACTED]";
 var SECRET_PATTERNS = [
   /ghp_[A-Za-z0-9]{20,}/g,
@@ -41303,17 +41324,36 @@ var SECRET_PATTERNS = [
   /\b[A-Za-z0-9+/]{40,}={0,2}\b/g
   // long base64-ish run (opaque tokens)
 ];
-function scrubString(value) {
-  let out = value;
+function redact(input) {
+  let out = input;
   for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);
   return out;
 }
+
+// src/bridge-log.ts
+var NOOP_LOGGER = {
+  logIn() {
+  },
+  logOut() {
+  },
+  close() {
+  }
+};
+var REDACT_DEPTH_CAP = 8;
+var IMAGE_DATA_URI_RE = /^(data:image\/[a-zA-Z0-9.+-]+;base64,)([A-Za-z0-9+/=]+)$/;
+function redactImageDataUri(value) {
+  const m = value.match(IMAGE_DATA_URI_RE);
+  if (!m) return value;
+  const prefix = m[1];
+  const body = m[2];
+  return `${prefix}\u2026(${body.length} bytes)`;
+}
 function redactValue(value, depth) {
-  if (typeof value === "string") return scrubString(value);
+  if (typeof value === "string") return redact(redactImageDataUri(value));
   if (value === null || typeof value !== "object") return value;
   if (depth >= REDACT_DEPTH_CAP) {
     try {
-      return scrubString(JSON.stringify(value));
+      return redact(JSON.stringify(value));
     } catch {
       return REDACTED;
     }
@@ -41351,14 +41391,14 @@ function resolvePromptsEnabled(env) {
 }
 function createBridgeLogger(stateDir, env = process.env) {
   if (!resolveBridgeLogEnabled(env)) return NOOP_LOGGER;
-  const logsDir = (0, import_node_path11.join)(stateDir, "logs");
+  const logsDir = (0, import_node_path10.join)(stateDir, "logs");
   try {
-    (0, import_node_fs10.mkdirSync)(logsDir, { recursive: true });
+    (0, import_node_fs9.mkdirSync)(logsDir, { recursive: true });
   } catch {
     return NOOP_LOGGER;
   }
   const includePrompts = resolvePromptsEnabled(env);
-  const fileFor = () => (0, import_node_path11.join)(logsDir, `bridge-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+  const fileFor = () => (0, import_node_path10.join)(logsDir, `bridge-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
   const write = (dir, rec) => {
     try {
       const line = JSON.stringify({
@@ -41370,7 +41410,7 @@ function createBridgeLogger(stateDir, env = process.env) {
         ...rec.ms !== void 0 ? { ms: rec.ms } : {},
         payload: redactMessage(rec.payload, { includePrompts })
       }) + "\n";
-      (0, import_node_fs10.appendFileSync)(fileFor(), line);
+      (0, import_node_fs9.appendFileSync)(fileFor(), line);
     } catch {
     }
   };
@@ -41404,9 +41444,9 @@ function normalizeModel(value) {
   return trimmed ? trimmed : null;
 }
 function neutralCheckoutCwd(stateDir) {
-  const dir = import_node_path12.default.join(stateDir, "no-checkout");
+  const dir = import_node_path11.default.join(stateDir, "no-checkout");
   try {
-    import_node_fs11.default.mkdirSync(dir, { recursive: true });
+    import_node_fs10.default.mkdirSync(dir, { recursive: true });
   } catch {
   }
   return dir;
@@ -41597,7 +41637,7 @@ function resolveDefaultBranch(checkoutPath) {
   if (!checkoutPath) return "main";
   const runGit = (args) => {
     try {
-      return (0, import_node_child_process4.execFileSync)("git", ["-C", checkoutPath, ...args], {
+      return (0, import_node_child_process3.execFileSync)("git", ["-C", checkoutPath, ...args], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 15e3,
@@ -41629,7 +41669,7 @@ async function runOrphanWorktreeSweep(client, opts) {
   const cutoff = Date.now() - worktreeRetentionMs();
   const isReapable = (worktreePath) => {
     try {
-      return import_node_fs11.default.statSync(worktreePath).mtimeMs < cutoff;
+      return import_node_fs10.default.statSync(worktreePath).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -41666,8 +41706,8 @@ async function runOrphanWorktreeSweep(client, opts) {
   }
 }
 function readStateDir() {
-  if (process.env.CODEX_HOME) return import_node_path12.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge");
-  return import_node_path12.default.join(import_node_os7.default.homedir(), ".mrrlin", "director-bridge");
+  if (process.env.CODEX_HOME) return import_node_path11.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge");
+  return import_node_path11.default.join(import_node_os7.default.homedir(), ".mrrlin", "director-bridge");
 }
 function readAllowedOrigins() {
   const raw = (process.env.MRRLIN_DIRECTOR_BRIDGE_ALLOWED_ORIGINS ?? "").trim();
@@ -41931,53 +41971,26 @@ function createBridgeMessageHandler(deps) {
         sendForSpan({ type: "reconfigured", directorSessionId: directorSessionId2 });
         return;
       }
-      if (msg.type === "discover-checkouts") {
-        const projectSlug = typeof msg.projectSlug === "string" ? msg.projectSlug.trim() : "";
-        const repo = typeof msg.repo === "string" ? msg.repo.trim() : "";
-        if (!projectSlug || !repo) {
-          sendForSpan({ type: "error", error: "discover-checkouts requires projectSlug and repo." });
-          return;
-        }
-        const roots = deps.scanRoots ?? defaultScanRoots(import_node_os7.default.homedir());
-        const candidates = scanForCheckouts(roots, repo);
-        sendForSpan({ type: "checkout-candidates", projectSlug, candidates });
+      if (msg.type !== "turn" || typeof msg.directorSessionId !== "string" || typeof msg.message !== "string") {
+        sendForSpan({ type: "error", error: "Invalid message schema." });
         return;
       }
-      if (msg.type === "confirm-checkout") {
-        const projectSlug = typeof msg.projectSlug === "string" ? msg.projectSlug.trim() : "";
-        const checkoutPath = typeof msg.path === "string" ? msg.path.trim() : "";
-        const repo = typeof msg.repo === "string" ? msg.repo.trim() : "";
-        if (!projectSlug || !checkoutPath) {
-          sendForSpan({ type: "checkout-error", projectSlug, error: "confirm-checkout requires projectSlug and path." });
-          return;
-        }
-        let remoteUrl = null;
-        try {
-          remoteUrl = (0, import_node_child_process4.execFileSync)("git", ["-C", checkoutPath, "remote", "get-url", "origin"], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-            timeout: 15e3,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-          }).trim();
-        } catch {
-          sendForSpan({ type: "checkout-error", projectSlug, error: `Path is not a git repository or has no origin remote: ${checkoutPath}` });
+      const rawImage = msg.imageDataUri;
+      let imageDataUri = null;
+      if (rawImage !== void 0 && rawImage !== null) {
+        if (typeof rawImage !== "string") {
+          sendForSpan({ type: "error", error: "imageDataUri must be a string." });
           return;
         }
-        if (repo && !remoteMatchesRepo(remoteUrl, repo)) {
-          sendForSpan({ type: "checkout-error", projectSlug, error: `Origin remote ${remoteUrl} does not match repo ${repo}.` });
+        if (!rawImage.startsWith("data:image/")) {
+          sendForSpan({ type: "error", error: "imageDataUri must be a data URI for an image." });
           return;
         }
-        if (!deps.checkoutRegistry) {
-          sendForSpan({ type: "checkout-error", projectSlug, error: "No checkout registry configured." });
+        if (rawImage.length > 3 * 1024 * 1024) {
+          sendForSpan({ type: "error", error: "Image too large." });
           return;
         }
-        deps.checkoutRegistry.confirm(projectSlug, checkoutPath, (/* @__PURE__ */ new Date()).toISOString());
-        sendForSpan({ type: "checkout-confirmed", projectSlug, path: checkoutPath });
-        return;
-      }
-      if (msg.type !== "turn" || typeof msg.directorSessionId !== "string" || typeof msg.message !== "string") {
-        sendForSpan({ type: "error", error: "Invalid message schema." });
-        return;
+        imageDataUri = rawImage;
       }
       const directorSessionId = msg.directorSessionId.trim();
       if (!directorSessionId) {
@@ -41985,7 +41998,7 @@ function createBridgeMessageHandler(deps) {
         return;
       }
       const inputText = msg.message.trim();
-      if (!inputText) {
+      if (!inputText && !imageDataUri) {
         sendForSpan({ type: "error", directorSessionId, error: "message is required." });
         return;
       }
@@ -42131,11 +42144,19 @@ function createBridgeMessageHandler(deps) {
           socket.once("close", onSocketClose);
           pokeActivity = () => watchdog.poke();
           const runSequence = (async () => {
+            const turnInput = [];
+            if (inputText.length > 0) {
+              const composed = contextPrefix ? `${contextPrefix}
+
+${inputText}` : inputText;
+              turnInput.push({ type: "text", text: composed, text_elements: [] });
+            }
+            if (imageDataUri) {
+              turnInput.push({ type: "image", url: imageDataUri });
+            }
             await codexClient.turn.start({
               threadId: thread.threadId,
-              input: [{ type: "text", text: contextPrefix ? `${contextPrefix}
-
-${inputText}` : inputText }],
+              input: turnInput,
               ...thread.reasoningEffort ? { effort: thread.reasoningEffort } : {}
             });
             await turnFinished;
@@ -42297,8 +42318,8 @@ async function startDirectorBridge() {
     codexCwd: config2.codexCwd,
     codexExecutable: config2.codexExecutable,
     checkoutRegistry,
-    worktreeRoot: import_node_path12.default.join(config2.stateDir, "worktrees"),
-    locksDir: import_node_path12.default.join(config2.stateDir, "locks"),
+    worktreeRoot: import_node_path11.default.join(config2.stateDir, "worktrees"),
+    locksDir: import_node_path11.default.join(config2.stateDir, "locks"),
     // Wire the profile-enforced executor server for code-execution runs. Each run gets its own
     // sandboxed Codex instance (scrubbed env, scratch CODEX_HOME, deny-read, egress allowlist).
     // The returned handle's dispose() shuts down the spawned app-server CHILD (manager.shutdown(),
@@ -42331,13 +42352,13 @@ async function startDirectorBridge() {
       },
       runVerificationTurn: createRunVerificationTurn({
         startSandbox: async (egressDomains) => {
-          const cwd = import_node_fs11.default.mkdtempSync(import_node_path12.default.join(import_node_os7.default.tmpdir(), "mrrlin-verify-"));
+          const cwd = import_node_fs10.default.mkdtempSync(import_node_path11.default.join(import_node_os7.default.tmpdir(), "mrrlin-verify-"));
           let handle;
           try {
             handle = await startExecutorServer({ worktree: cwd, egressDomains });
           } catch (error51) {
             try {
-              import_node_fs11.default.rmSync(cwd, { recursive: true, force: true });
+              import_node_fs10.default.rmSync(cwd, { recursive: true, force: true });
             } catch {
             }
             throw error51;
@@ -42348,7 +42369,7 @@ async function startDirectorBridge() {
             dispose: () => {
               handle.dispose();
               try {
-                import_node_fs11.default.rmSync(cwd, { recursive: true, force: true });
+                import_node_fs10.default.rmSync(cwd, { recursive: true, force: true });
               } catch {
               }
             }
@@ -42581,8 +42602,8 @@ async function startDirectorBridge() {
       enqueueRun(
         () => runOrphanWorktreeSweep(client, {
           checkoutRegistry,
-          worktreeRoot: import_node_path12.default.join(config2.stateDir, "worktrees"),
-          locksDir: import_node_path12.default.join(config2.stateDir, "locks")
+          worktreeRoot: import_node_path11.default.join(config2.stateDir, "worktrees"),
+          locksDir: import_node_path11.default.join(config2.stateDir, "locks")
         })
       );
       scheduleClaimLoop();
@@ -42739,15 +42760,15 @@ function readDispatchBody(req) {
 function readOrCreateBridgeToken(stateDir) {
   const explicit = (process.env.MRRLIN_DIRECTOR_BRIDGE_TOKEN ?? "").trim();
   if (explicit) return explicit;
-  const tokenPath = import_node_path12.default.join(stateDir, "token.txt");
+  const tokenPath = import_node_path11.default.join(stateDir, "token.txt");
   try {
-    const existing = import_node_fs11.default.readFileSync(tokenPath, "utf8").trim();
+    const existing = import_node_fs10.default.readFileSync(tokenPath, "utf8").trim();
     if (existing) return existing;
   } catch {
   }
-  import_node_fs11.default.mkdirSync(stateDir, { recursive: true, mode: 448 });
+  import_node_fs10.default.mkdirSync(stateDir, { recursive: true, mode: 448 });
   const token = import_node_crypto4.default.randomBytes(32).toString("base64url");
-  import_node_fs11.default.writeFileSync(tokenPath, `${token}
+  import_node_fs10.default.writeFileSync(tokenPath, `${token}
 `, { mode: 384 });
   return token;
 }
@@ -46130,14 +46151,17 @@ var StdioServerTransport = class {
 
 // src/tools.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_fs12 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_os8 = __toESM(require("node:os"), 1);
+var import_node_child_process6 = require("node:child_process");
 
 // ../../packages/wiki/dist/index.js
 var import_promises2 = __toESM(require("node:fs/promises"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_path12 = __toESM(require("node:path"), 1);
 var INCLUDED_DOC_FOLDERS = /* @__PURE__ */ new Set(["_meta", "explanation", "how-to", "reference", "sdd", "tutorials"]);
 function toPosixPath(input) {
-  return input.split(import_node_path13.default.sep).join("/");
+  return input.split(import_node_path12.default.sep).join("/");
 }
 function slugifyWikiSegment(input) {
   return input.trim().toLowerCase().replace(/`/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -46151,12 +46175,12 @@ async function pathExists2(input) {
   }
 }
 async function findWorkspaceRoot(start = process.cwd()) {
-  let current = import_node_path13.default.resolve(start);
+  let current = import_node_path12.default.resolve(start);
   while (true) {
-    if (await pathExists2(import_node_path13.default.join(current, "pnpm-workspace.yaml")) && await pathExists2(import_node_path13.default.join(current, "docs"))) {
+    if (await pathExists2(import_node_path12.default.join(current, "pnpm-workspace.yaml")) && await pathExists2(import_node_path12.default.join(current, "docs"))) {
       return current;
     }
-    const parent = import_node_path13.default.dirname(current);
+    const parent = import_node_path12.default.dirname(current);
     if (parent === current) {
       throw new Error(`Unable to find Mrrlin workspace root from ${start}`);
     }
@@ -46165,28 +46189,28 @@ async function findWorkspaceRoot(start = process.cwd()) {
 }
 async function resolveDocsRoot(input) {
   if (input) {
-    return import_node_path13.default.resolve(input);
+    return import_node_path12.default.resolve(input);
   }
   if (process.env.MRRLIN_DOCS_ROOT) {
-    return import_node_path13.default.resolve(process.env.MRRLIN_DOCS_ROOT);
+    return import_node_path12.default.resolve(process.env.MRRLIN_DOCS_ROOT);
   }
-  return import_node_path13.default.join(await findWorkspaceRoot(), "docs");
+  return import_node_path12.default.join(await findWorkspaceRoot(), "docs");
 }
 async function resolveIndexPath(input) {
   if (input) {
-    return import_node_path13.default.resolve(input);
+    return import_node_path12.default.resolve(input);
   }
   if (process.env.MRRLIN_WIKI_INDEX_PATH) {
-    return import_node_path13.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
+    return import_node_path12.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
   }
   const workspaceRoot = await findWorkspaceRoot();
-  return import_node_path13.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  return import_node_path12.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
 }
 async function walkMarkdownFiles(root, dir = root) {
   const entries = await import_promises2.default.readdir(dir, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = import_node_path13.default.join(dir, entry.name);
+    const absolute = import_node_path12.default.join(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...await walkMarkdownFiles(root, absolute));
       continue;
@@ -46205,7 +46229,7 @@ function parseTitle(markdown, sourcePath) {
   return title;
 }
 function documentFromFile(docsRoot, absolutePath, markdown) {
-  const relativePath = toPosixPath(import_node_path13.default.relative(docsRoot, absolutePath));
+  const relativePath = toPosixPath(import_node_path12.default.relative(docsRoot, absolutePath));
   const [section, fileName] = relativePath.split("/");
   if (!section || !fileName || !INCLUDED_DOC_FOLDERS.has(section)) {
     return null;
@@ -46620,7 +46644,7 @@ async function runCodeGate(_target, deps) {
 }
 
 // src/consensus/codex-exec.ts
-var import_node_child_process5 = require("node:child_process");
+var import_node_child_process4 = require("node:child_process");
 function extractFinalMessage(stdout) {
   let last = null;
   for (const rawLine of stdout.split(/\r?\n/)) {
@@ -46665,7 +46689,7 @@ function firstString(...values) {
   return null;
 }
 function runCodexExec(input, deps) {
-  const spawn2 = deps?.spawn ?? import_node_child_process5.spawn;
+  const spawn2 = deps?.spawn ?? import_node_child_process4.spawn;
   const executable = input.codexExecutable ?? "codex";
   const sandbox = input.sandbox ?? "read-only";
   const fullPrompt = input.developerInstructions.trim() ? `${input.developerInstructions.trim()}
@@ -46737,12 +46761,12 @@ function errMessage(err) {
 }
 
 // src/consensus/wiring.ts
-var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url = require("node:url");
 
 // src/consensus/code-gate-git.ts
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 var DIFF_MAX_BYTES = 2e5;
 var FASTGATE_OUTPUT_MAX_BYTES = 16e3;
 var GIT_TIMEOUT_MS = 6e4;
@@ -46758,7 +46782,7 @@ var defaultRunCmd = (cmd, args, opts) => new Promise((resolve) => {
   };
   let child;
   try {
-    child = (0, import_node_child_process6.spawn)(cmd, args, {
+    child = (0, import_node_child_process5.spawn)(cmd, args, {
       cwd: opts.cwd,
       env: process.env,
       shell: false,
@@ -46973,15 +46997,15 @@ ${res.stdout}${res.stderr}`);
 var import_meta = {};
 function getPersonasDir() {
   if (typeof __dirname !== "undefined") {
-    return import_node_path14.default.join(__dirname, "consensus", "personas");
+    return import_node_path13.default.join(__dirname, "consensus", "personas");
   }
-  return import_node_path14.default.join(import_node_path14.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url)), "personas");
+  return import_node_path13.default.join(import_node_path13.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url)), "personas");
 }
 var personaCache = /* @__PURE__ */ new Map();
 function loadPersona(name) {
   const cached2 = personaCache.get(name);
   if (cached2 !== void 0) return cached2;
-  const content = import_node_fs12.default.readFileSync(import_node_path14.default.join(getPersonasDir(), `${name}.md`), "utf8");
+  const content = import_node_fs11.default.readFileSync(import_node_path13.default.join(getPersonasDir(), `${name}.md`), "utf8");
   personaCache.set(name, content);
   return content;
 }
@@ -47290,8 +47314,28 @@ async function enqueueAsyncTool(client, descriptor2, input) {
   }
 }
 
-// src/tools.ts
-registerAsyncTool(consensusDescriptor);
+// src/git-remote-match.ts
+function normalizeRemote(url2) {
+  const trimmed = url2.trim().replace(/\.git$/i, "");
+  const scp = /^[^@]+@[^:]+:(.+)$/.exec(trimmed);
+  const pathPart = scp ? scp[1] : (() => {
+    try {
+      return new URL(trimmed).pathname.replace(/^\/+/, "");
+    } catch {
+      return null;
+    }
+  })();
+  if (!pathPart) return null;
+  const segs = pathPart.split("/").filter(Boolean);
+  if (segs.length < 2) return null;
+  return `${segs[segs.length - 2]}/${segs[segs.length - 1]}`.toLowerCase();
+}
+function remoteMatchesRepo(remoteUrl, repoFullName) {
+  const a = normalizeRemote(remoteUrl);
+  return a !== null && a === repoFullName.trim().toLowerCase();
+}
+
+// src/tool-names.ts
 var mcpToolNames = {
   appendExecutionArtifact: "append_execution_artifact",
   archivePlan: "archive_plan",
@@ -47327,7 +47371,6 @@ var mcpToolNames = {
   listExecutionArtifacts: "list_execution_artifacts",
   listExecutionRuns: "list_execution_runs",
   listInboxItems: "list_inbox_items",
-  listGithubWebhookDeliveries: "list_github_webhook_deliveries",
   listGithubInstallations: "list_github_installations",
   listGithubWorkflows: "list_github_workflows",
   listPlans: "list_plans",
@@ -47350,8 +47393,500 @@ var mcpToolNames = {
   runCodeReviewerGate: "run_code_reviewer_gate",
   uploadArtifact: "upload_artifact",
   listArtifactFiles: "list_artifact_files",
-  resolveHandoff: "resolve_handoff"
+  resolveHandoff: "resolve_handoff",
+  registerLocalCheckout: "register_local_checkout",
+  /** Compact-context retrieval: rehydrate a mrrlin:// handle into the canonical full record. */
+  retrieveContext: "retrieve_context"
+};
+
+// src/context-compact/policy.ts
+var DEFAULT_THRESHOLD_CHARS = 12e3;
+var DEFAULT_MAX_ITEMS = 25;
+function readPositiveInt(value, fallback) {
+  const raw = (value ?? "").trim();
+  if (!raw) return fallback;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function readCompactPolicy(env = process.env) {
+  const disabled = (env.MRRLIN_MCP_COMPACT_DISABLE ?? "").trim() === "1";
+  return {
+    enabled: !disabled,
+    thresholdChars: readPositiveInt(env.MRRLIN_MCP_COMPACT_THRESHOLD_CHARS, DEFAULT_THRESHOLD_CHARS),
+    maxItems: readPositiveInt(env.MRRLIN_MCP_COMPACT_MAX_ITEMS, DEFAULT_MAX_ITEMS),
+    debug: (env.MRRLIN_MCP_COMPACT_DEBUG ?? "").trim() === "1"
+  };
+}
+
+// src/context-compact/handles.ts
+var MRRLIN_HANDLE_SCHEME = "mrrlin://";
+var SLUG_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/;
+var TASK_ID_RE = /^GT-[A-Za-z0-9-]+$/;
+var WIKI_ID_RE = /^WK-[A-Za-z0-9-]+$/;
+var RUN_ID_RE = /^ER-[A-Za-z0-9-]+$/;
+function isProjectSlug(value) {
+  return SLUG_RE.test(value);
+}
+function formatTaskHandle(projectSlug, taskId) {
+  return `${MRRLIN_HANDLE_SCHEME}task/${projectSlug}/${taskId}`;
+}
+function formatTaskEventsHandle(projectSlug, taskId) {
+  return `${MRRLIN_HANDLE_SCHEME}task/${projectSlug}/${taskId}/events`;
+}
+function formatWikiHandle(projectSlug, pageId) {
+  return `${MRRLIN_HANDLE_SCHEME}wiki/${projectSlug}/${pageId}`;
+}
+function formatProjectSnapshotHandle(projectSlug) {
+  return `${MRRLIN_HANDLE_SCHEME}project/${projectSlug}/snapshot`;
+}
+function formatRunArtifactsHandle(projectSlug, runId) {
+  return `${MRRLIN_HANDLE_SCHEME}run/${projectSlug}/${runId}/artifacts`;
+}
+function parseMrrlinHandle(value) {
+  if (typeof value !== "string") return null;
+  if (!value.startsWith(MRRLIN_HANDLE_SCHEME)) return null;
+  const rest = value.slice(MRRLIN_HANDLE_SCHEME.length);
+  if (!rest) return null;
+  if (rest.includes("?") || rest.includes("#")) return null;
+  const parts = rest.split("/");
+  if (parts.length < 2) return null;
+  const [kind, slug, ...tail2] = parts;
+  if (!kind || !slug) return null;
+  if (!isProjectSlug(slug)) return null;
+  switch (kind) {
+    case "task": {
+      if (tail2.length < 1 || tail2.length > 2) return null;
+      const taskId = tail2[0] ?? "";
+      if (!TASK_ID_RE.test(taskId)) return null;
+      if (tail2.length === 1) return { kind: "task", projectSlug: slug, taskId };
+      if (tail2[1] !== "events") return null;
+      return { kind: "task-events", projectSlug: slug, taskId };
+    }
+    case "wiki": {
+      if (tail2.length !== 1) return null;
+      const pageId = tail2[0] ?? "";
+      if (!WIKI_ID_RE.test(pageId)) return null;
+      return { kind: "wiki", projectSlug: slug, pageId };
+    }
+    case "project": {
+      if (tail2.length !== 1) return null;
+      const sub = tail2[0];
+      if (sub === "snapshot") return { kind: "project-snapshot", projectSlug: slug };
+      if (sub === "tasks") return { kind: "project-tasks", projectSlug: slug };
+      return null;
+    }
+    case "run": {
+      if (tail2.length < 1 || tail2.length > 2) return null;
+      const runId = tail2[0] ?? "";
+      if (!RUN_ID_RE.test(runId)) return null;
+      if (tail2.length === 1) return { kind: "run", projectSlug: slug, runId };
+      if (tail2[1] !== "artifacts") return null;
+      return { kind: "run-artifacts", projectSlug: slug, runId };
+    }
+    default:
+      return null;
+  }
+}
+
+// src/context-compact/compactors.ts
+var NOTES_EXCERPT_CHARS = 200;
+var TITLE_TRUNCATE_CHARS = 160;
+var EXCERPT_TRUNCATE_CHARS = 240;
+function truncate(value, maxChars) {
+  if (value.length <= maxChars) return value;
+  return `${value.slice(0, Math.max(0, maxChars - 1))}\u2026`;
+}
+function firstHeadingLine(markdown) {
+  for (const line of markdown.split(/\r?\n/, 32)) {
+    if (line.startsWith("#")) return line.replace(/\s+$/u, "");
+  }
+  return null;
+}
+function compactTaskList(projectSlug, tasks, maxItems) {
+  const total = tasks.length;
+  const included = Math.min(total, maxItems);
+  const slice = tasks.slice(0, included);
+  const items = slice.map((t) => ({
+    id: t.id,
+    title: truncate(t.title, TITLE_TRUNCATE_CHARS),
+    status: t.status,
+    type: t.type,
+    category: t.category,
+    subcategory: t.subcategory,
+    impact: t.impact,
+    autonomy: t.autonomyLevel,
+    tags: t.tags,
+    assignee: t.assignee,
+    planId: t.planId,
+    specWikiPageId: t.specWikiPageId,
+    notesExcerpt: t.notes ? truncate(t.notes, NOTES_EXCERPT_CHARS) : null,
+    latestJudgementExcerpt: t.latestJudgement ? truncate(t.latestJudgement, NOTES_EXCERPT_CHARS) : null,
+    handle: formatTaskHandle(projectSlug, t.id)
+  }));
+  const handles = slice.map((t) => ({
+    handle: formatTaskHandle(projectSlug, t.id),
+    retrieveTool: mcpToolNames.getTask,
+    retrieveArgs: { projectSlug, taskId: t.id }
+  }));
+  return {
+    summary: `${total} task${total === 1 ? "" : "s"} in project ${projectSlug}; ${included} included in this compact view.`,
+    items,
+    handles,
+    counts: { total, included, omitted: total - included }
+  };
+}
+function compactWikiPageList(projectSlug, pages, maxItems) {
+  const total = pages.length;
+  const included = Math.min(total, maxItems);
+  const slice = pages.slice(0, included);
+  const items = slice.map((p) => ({
+    id: p.id,
+    title: truncate(p.title, TITLE_TRUNCATE_CHARS),
+    folder: p.folder,
+    path: p.path,
+    taskId: p.taskId,
+    specReady: p.specReady,
+    firstHeading: firstHeadingLine(p.markdownBody),
+    handle: formatWikiHandle(projectSlug, p.id)
+  }));
+  const handles = slice.map((p) => ({
+    handle: formatWikiHandle(projectSlug, p.id),
+    retrieveTool: mcpToolNames.getWikiPage,
+    retrieveArgs: { projectSlug, pageId: p.id }
+  }));
+  return {
+    summary: `${total} wiki page${total === 1 ? "" : "s"} in project ${projectSlug}; ${included} included in this compact view.`,
+    items,
+    handles,
+    counts: { total, included, omitted: total - included }
+  };
+}
+function compactWikiSearch(projectSlug, results, maxItems) {
+  const total = results.length;
+  const included = Math.min(total, maxItems);
+  const slice = results.slice(0, included);
+  const items = slice.map((r) => ({
+    pageId: r.id,
+    title: truncate(r.title, TITLE_TRUNCATE_CHARS),
+    folder: r.folder,
+    path: r.path,
+    rank: r.rank,
+    snippet: truncate(r.snippet, EXCERPT_TRUNCATE_CHARS),
+    handle: formatWikiHandle(projectSlug, r.id)
+  }));
+  const handles = slice.map((r) => ({
+    handle: formatWikiHandle(projectSlug, r.id),
+    retrieveTool: mcpToolNames.getWikiPage,
+    retrieveArgs: { projectSlug, pageId: r.id }
+  }));
+  return {
+    summary: `${total} wiki search hit${total === 1 ? "" : "s"} in project ${projectSlug}; ${included} included.`,
+    items,
+    handles,
+    counts: { total, included, omitted: total - included }
+  };
+}
+function compactProjectSnapshot(projectSlug, snapshot, maxItems) {
+  const taskBody = compactTaskList(projectSlug, snapshot.tasks, maxItems);
+  const wikiBody = compactWikiPageList(projectSlug, snapshot.wikiPages, maxItems);
+  const statusCounts = {};
+  for (const t of snapshot.tasks) {
+    statusCounts[t.status] = (statusCounts[t.status] ?? 0) + 1;
+  }
+  const categoryCounts = {};
+  for (const t of snapshot.tasks) {
+    const key = `${t.category}/${t.subcategory}`;
+    categoryCounts[key] = (categoryCounts[key] ?? 0) + 1;
+  }
+  const compactPlans = snapshot.plans.map((p) => ({
+    id: p.id,
+    name: truncate(p.name, TITLE_TRUNCATE_CHARS),
+    status: p.status,
+    taskCount: p.taskCount,
+    closedTaskCount: p.closedTaskCount,
+    progress: p.progress,
+    dueDate: p.dueDate
+  }));
+  const items = [
+    {
+      project: snapshot.project,
+      github: {
+        installationState: snapshot.github.appInstallationState,
+        installationId: snapshot.github.installationId,
+        operator: snapshot.github.operator
+      },
+      taskCount: snapshot.tasks.length,
+      wikiCount: snapshot.wikiPages.length,
+      planCount: snapshot.plans.length,
+      statusCounts,
+      categoryCounts,
+      plans: compactPlans,
+      tasks: taskBody.items,
+      wikiPages: wikiBody.items
+    }
+  ];
+  const handles = [
+    {
+      handle: formatProjectSnapshotHandle(projectSlug),
+      retrieveTool: mcpToolNames.getProjectSnapshot,
+      retrieveArgs: { projectSlug }
+    },
+    ...taskBody.handles,
+    ...wikiBody.handles
+  ];
+  const total = snapshot.tasks.length + snapshot.wikiPages.length;
+  const included = taskBody.counts.included + wikiBody.counts.included;
+  return {
+    summary: `Snapshot for ${projectSlug}: ${snapshot.tasks.length} tasks, ${snapshot.wikiPages.length} wiki pages, ${snapshot.plans.length} plans.`,
+    items,
+    handles,
+    counts: { total, included, omitted: total - included }
+  };
+}
+var ARTIFACT_PAYLOAD_BUDGET = 400;
+var COMMAND_OUTPUT_TAIL_LINES = 10;
+function compactArtifactPayload(artifact) {
+  const payload = artifact.payload ?? {};
+  switch (artifact.kind) {
+    case "file": {
+      return {
+        filename: payload.filename ?? null,
+        contentType: payload.contentType ?? null,
+        sizeBytes: payload.sizeBytes ?? null,
+        class: payload.class ?? null,
+        stableUrl: payload.stableUrl ?? null,
+        description: payload.description ?? null
+      };
+    }
+    case "command_output": {
+      const event = payload.event ?? void 0;
+      const command = payload.command ?? event?.tool?.input?.command ?? null;
+      const cwd = payload.cwd ?? event?.tool?.input?.cwd ?? null;
+      const exitCode = payload.exitCode ?? null;
+      const rawOutput = payload.stdout ?? payload.output ?? event?.content ?? "";
+      const lines2 = rawOutput.split(/\r?\n/);
+      const tail2 = lines2.slice(-COMMAND_OUTPUT_TAIL_LINES).join("\n");
+      const firstError = lines2.find((l) => /error|fail/i.test(l)) ?? null;
+      return {
+        command,
+        cwd,
+        exitCode,
+        firstError,
+        tail: truncate(tail2, ARTIFACT_PAYLOAD_BUDGET),
+        totalLines: lines2.length
+      };
+    }
+    case "test_result": {
+      return {
+        status: payload.status ?? null,
+        command: payload.command ?? null,
+        summary: typeof payload.summary === "string" ? truncate(payload.summary, ARTIFACT_PAYLOAD_BUDGET) : null,
+        failed: Array.isArray(payload.failedTests) ? payload.failedTests.slice(0, 25) : null
+      };
+    }
+    case "diff_summary": {
+      return {
+        files: Array.isArray(payload.files) ? payload.files.slice(0, 50) : null,
+        added: payload.added ?? null,
+        removed: payload.removed ?? null,
+        renamed: payload.renamed ?? null
+      };
+    }
+    case "handoff_judgement":
+    case "self_review":
+    case "error":
+    case "checkpoint":
+    default: {
+      const flattened = JSON.stringify(payload);
+      return { excerpt: truncate(flattened, ARTIFACT_PAYLOAD_BUDGET) };
+    }
+  }
+}
+function compactExecutionArtifacts(projectSlug, artifacts, maxItems) {
+  const total = artifacts.length;
+  const included = Math.min(total, maxItems);
+  const slice = total > included ? artifacts.slice(total - included) : artifacts;
+  const items = slice.map((a) => ({
+    id: a.id,
+    runId: a.runId,
+    kind: a.kind,
+    createdAt: a.createdAt,
+    payload: compactArtifactPayload(a)
+  }));
+  const runIds = Array.from(new Set(slice.map((a) => a.runId)));
+  const handles = runIds.map((runId) => ({
+    handle: formatRunArtifactsHandle(projectSlug, runId),
+    retrieveTool: mcpToolNames.listExecutionArtifacts,
+    retrieveArgs: { projectSlug, runId }
+  }));
+  return {
+    summary: `${total} execution artifact${total === 1 ? "" : "s"}; ${included} included (most recent first dropped older).`,
+    items,
+    handles,
+    counts: { total, included, omitted: total - included }
+  };
+}
+function compactTaskEvents(projectSlug, taskId, events, maxItems) {
+  const total = events.length;
+  const included = Math.min(total, maxItems);
+  const slice = total > included ? events.slice(total - included) : events;
+  const items = slice.map((e) => ({
+    id: e.id,
+    eventType: e.eventType,
+    actor: e.actor,
+    createdAt: e.createdAt,
+    autonomyLevel: e.autonomyLevel,
+    autonomyReason: e.autonomyReason,
+    bodyExcerpt: e.body ? truncate(e.body, NOTES_EXCERPT_CHARS) : null
+  }));
+  const handles = [
+    {
+      handle: formatTaskEventsHandle(projectSlug, taskId),
+      retrieveTool: mcpToolNames.listTaskEvents,
+      retrieveArgs: { projectSlug, taskId }
+    }
+  ];
+  return {
+    summary: `${total} task event${total === 1 ? "" : "s"} for ${taskId}; ${included} most recent included.`,
+    items,
+    handles,
+    counts: { total, included, omitted: total - included }
+  };
+}
+function compactGeneric(value, maxItems, projectSlug) {
+  if (Array.isArray(value)) {
+    const total = value.length;
+    const included = Math.min(total, maxItems);
+    const slice = value.slice(0, included).map((entry) => {
+      const text2 = typeof entry === "string" ? entry : JSON.stringify(entry);
+      return truncate(text2, ARTIFACT_PAYLOAD_BUDGET);
+    });
+    return {
+      summary: `Compact array view: ${total} entries, ${included} included.`,
+      items: slice,
+      handles: [],
+      counts: { total, included, omitted: total - included }
+    };
+  }
+  if (value && typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj);
+    return {
+      summary: `Compact object view (project=${projectSlug}): keys=[${keys.join(", ")}].`,
+      items: [
+        Object.fromEntries(
+          keys.map((k) => {
+            const entry = obj[k];
+            if (Array.isArray(entry)) return [k, `[Array(${entry.length})]`];
+            if (entry && typeof entry === "object") return [k, "[Object]"];
+            return [k, entry];
+          })
+        )
+      ],
+      handles: [],
+      counts: { total: 1, included: 1, omitted: 0 }
+    };
+  }
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return {
+    summary: "Compact scalar view.",
+    items: [truncate(text, ARTIFACT_PAYLOAD_BUDGET)],
+    handles: [],
+    counts: { total: 1, included: 1, omitted: 0 }
+  };
+}
+
+// src/context-compact/index.ts
+var COMPACT_WARNING = "Compact result. Source of truth lives in the Mrrlin API; call `retrieve_context` with one of the embedded mrrlin:// handles to load the full record before any irreversible decision.";
+function serializedChars(value) {
+  return JSON.stringify({ data: value }, null, 2).length;
+}
+function buildEnvelope(dispatch, body, originalChars) {
+  const partial2 = {
+    compact: true,
+    kind: dispatch.kind,
+    toolName: dispatch.toolName,
+    projectSlug: dispatch.projectSlug,
+    summary: body.summary,
+    counts: body.counts,
+    items: body.items,
+    handles: body.handles,
+    warning: COMPACT_WARNING
+  };
+  const compactNoStats = JSON.stringify({ data: partial2 }, null, 2).length;
+  const statsOverhead = 220;
+  const compactChars = compactNoStats + statsOverhead;
+  const savedChars = originalChars - compactChars;
+  const savedRatio = originalChars > 0 ? Math.max(0, savedChars / originalChars) : 0;
+  const envelope = {
+    ...partial2,
+    stats: {
+      originalChars,
+      compactChars,
+      savedChars,
+      savedRatio: Number(savedRatio.toFixed(4))
+    }
+  };
+  return { envelope, shrunk: compactChars < originalChars };
+}
+function runCompactor(dispatch, policy) {
+  switch (dispatch.kind) {
+    case "task-list":
+      return compactTaskList(dispatch.projectSlug, dispatch.rawValue, policy.maxItems);
+    case "wiki-list":
+      return compactWikiPageList(dispatch.projectSlug, dispatch.rawValue, policy.maxItems);
+    case "wiki-search":
+      return compactWikiSearch(
+        dispatch.projectSlug,
+        dispatch.rawValue,
+        policy.maxItems
+      );
+    case "project-snapshot":
+      return compactProjectSnapshot(
+        dispatch.projectSlug,
+        dispatch.rawValue,
+        policy.maxItems
+      );
+    case "execution-artifacts":
+      return compactExecutionArtifacts(
+        dispatch.projectSlug,
+        dispatch.rawValue,
+        policy.maxItems
+      );
+    case "task-events": {
+      if (!dispatch.taskId) throw new Error("task-events compact requires taskId");
+      return compactTaskEvents(dispatch.projectSlug, dispatch.taskId, dispatch.rawValue, policy.maxItems);
+    }
+    case "generic-json":
+      return compactGeneric(dispatch.rawValue, policy.maxItems, dispatch.projectSlug);
+  }
+}
+function maybeCompact(dispatch, policy = readCompactPolicy()) {
+  if (!policy.enabled) return null;
+  const originalChars = serializedChars(dispatch.rawValue);
+  if (originalChars <= policy.thresholdChars) return null;
+  const body = runCompactor(dispatch, policy);
+  const result = buildEnvelope(dispatch, body, originalChars);
+  if (policy.debug) {
+    process.stderr.write(
+      `[mrrlin-mcp compact] tool=${dispatch.toolName} kind=${dispatch.kind} originalChars=${originalChars} compactChars=${result.envelope.stats.compactChars} savedRatio=${result.envelope.stats.savedRatio}
+`
+    );
+  }
+  if (!result.shrunk) return null;
+  return result.envelope;
+}
+var COMPACT_OPT_IN = {
+  [mcpToolNames.listTasks]: "task-list",
+  [mcpToolNames.listWikiPages]: "wiki-list",
+  [mcpToolNames.searchWikiPages]: "wiki-search",
+  [mcpToolNames.getProjectSnapshot]: "project-snapshot",
+  [mcpToolNames.listExecutionArtifacts]: "execution-artifacts",
+  [mcpToolNames.listTaskEvents]: "task-events"
 };
+
+// src/tools.ts
+registerAsyncTool(consensusDescriptor);
 var projectScopedSchema = external_exports.object({ projectSlug: mrrlinProjectSlugSchema });
 var taskScopedSchema = projectScopedSchema.extend({ taskId: mrrlinTaskIdSchema });
 var planScopedSchema = projectScopedSchema.extend({ planId: mrrlinPlanIdSchema });
@@ -47403,7 +47938,6 @@ var runCodeReviewerGateInputSchema = external_exports.object({
 var searchKnowledgeInputSchema = wikiKnowledgeSearchInputSchema;
 var createGithubBranchInputSchema = projectScopedSchema.merge(githubCreateBranchRequestSchema);
 var createGithubPullRequestInputSchema = projectScopedSchema.merge(githubCreatePullRequestRequestSchema);
-var listGithubWebhookDeliveriesInputSchema = projectScopedSchema;
 var listGithubWorkflowsInputSchema = projectScopedSchema;
 var dispatchGithubWorkflowInputSchema = projectScopedSchema.extend({ workflowId: external_exports.string().min(1) }).merge(githubWorkflowDispatchRequestSchema);
 var dispatchTaskDeployInputSchema = taskScopedSchema.extend({
@@ -47448,6 +47982,18 @@ var listInboxItemsInputSchema = projectScopedSchema.merge(mrrlinInboxItemListFil
 var createInboxItemInputSchema = projectScopedSchema.merge(mrrlinInboxItemCreateSchema);
 var decideInboxItemInputSchema = projectScopedSchema.extend({ itemId: mrrlinInboxItemIdSchema }).merge(mrrlinInboxItemDecideSchema);
 var resolveHandoffInputSchema = projectScopedSchema.extend({ runId: mrrlinExecutionRunIdSchema }).merge(mrrlinResolveHandoffSchema);
+var registerLocalCheckoutInputSchema = projectScopedSchema.extend({
+  path: external_exports.string().min(1).describe("Absolute path to the local git checkout (must be a git repo whose origin matches `repo`)."),
+  repo: external_exports.string().min(1).describe("The project's bound GitHub repo full name in `owner/repo` form.")
+});
+var retrieveContextInputSchema = external_exports.object({
+  handle: external_exports.string().min(1).describe(
+    "A mrrlin:// handle emitted in a compact envelope. Examples: mrrlin://task/{slug}/GT-123, mrrlin://wiki/{slug}/WK-1, mrrlin://project/{slug}/snapshot, mrrlin://run/{slug}/ER-9, mrrlin://run/{slug}/ER-9/artifacts."
+  ),
+  mode: external_exports.enum(["full", "summary", "metadata"]).optional().describe(
+    "Reserved. v1 always returns the full record regardless; future versions will use this to scope rehydration."
+  )
+});
 var mcpToolInputSchemas = {
   [mcpToolNames.appendExecutionArtifact]: appendExecutionArtifactInputSchema,
   [mcpToolNames.archivePlan]: archivePlanInputSchema,
@@ -47480,7 +48026,6 @@ var mcpToolInputSchemas = {
   [mcpToolNames.getGithubInstallationRepositories]: getGithubInstallationRepositoriesInputSchema,
   [mcpToolNames.listExecutionArtifacts]: listExecutionArtifactsInputSchema,
   [mcpToolNames.listExecutionRuns]: listExecutionRunsInputSchema,
-  [mcpToolNames.listGithubWebhookDeliveries]: listGithubWebhookDeliveriesInputSchema,
   [mcpToolNames.listGithubInstallations]: listGithubInstallationsInputSchema,
   [mcpToolNames.listGithubWorkflows]: listGithubWorkflowsInputSchema,
   [mcpToolNames.listPlans]: listPlansInputSchema,
@@ -47506,7 +48051,9 @@ var mcpToolInputSchemas = {
   [mcpToolNames.decideInboxItem]: decideInboxItemInputSchema,
   [mcpToolNames.uploadArtifact]: uploadArtifactInputSchema,
   [mcpToolNames.listArtifactFiles]: listArtifactFilesInputSchema,
-  [mcpToolNames.resolveHandoff]: resolveHandoffInputSchema
+  [mcpToolNames.resolveHandoff]: resolveHandoffInputSchema,
+  [mcpToolNames.registerLocalCheckout]: registerLocalCheckoutInputSchema,
+  [mcpToolNames.retrieveContext]: retrieveContextInputSchema
 };
 var mcpToolOperationIds = {
   [mcpToolNames.appendExecutionArtifact]: openApiOperationIds.appendExecutionArtifact,
@@ -47540,7 +48087,6 @@ var mcpToolOperationIds = {
   [mcpToolNames.getGithubInstallationRepositories]: openApiOperationIds.getGithubInstallationRepositories,
   [mcpToolNames.listExecutionArtifacts]: openApiOperationIds.listExecutionArtifacts,
   [mcpToolNames.listExecutionRuns]: openApiOperationIds.listExecutionRuns,
-  [mcpToolNames.listGithubWebhookDeliveries]: openApiOperationIds.listGithubWebhookDeliveries,
   [mcpToolNames.listGithubInstallations]: openApiOperationIds.listGithubInstallations,
   [mcpToolNames.listGithubWorkflows]: openApiOperationIds.listGithubWorkflows,
   [mcpToolNames.listPlans]: openApiOperationIds.listPlans,
@@ -47590,7 +48136,6 @@ var mcpToolDescriptions = {
   [mcpToolNames.dispatchGithubWorkflow]: "Dispatch a GitHub Actions workflow by workflow file/id against a ref visible to the linked installation.",
   [mcpToolNames.dispatchTaskDeploy]: "Dispatch a task's dev or prod deploy; caller supplies workflowId chosen for this run (ADR 0012). Subject to auto_deploy policy and prod dev-verification gate.",
   [mcpToolNames.getGithubInstallationRepositories]: "List repositories visible to a GitHub App installation id.",
-  [mcpToolNames.listGithubWebhookDeliveries]: "List recent persisted GitHub webhook deliveries for the project so install/webhook smoke can be verified without raw DB access.",
   [mcpToolNames.listGithubInstallations]: "List persisted GitHub App installations.",
   [mcpToolNames.listGithubWorkflows]: "List the bound repository's GitHub Actions workflows live through the linked installation. No Mrrlin-side cache.",
   [mcpToolNames.listProjects]: "List every project visible to the operator.",
@@ -47624,7 +48169,9 @@ var mcpToolDescriptions = {
   [mcpToolNames.decideInboxItem]: "Approve, reject, or acknowledge an operator-inbox item. Rejection requires a reason.",
   [mcpToolNames.uploadArtifact]: "Upload a local file (md/txt/html/csv/json/pdf/png/jpg/webp/gif, <=5MB) as a project artifact. Returns a stable markdown link to embed in chat/spec/handoff text. Use class=temp for one-off hand-offs, class=durable for anything referenced by specs or evidence. Pass runId to record the file in that run's artifact history; pass taskId to surface it on the task's Artifacts list.",
   [mcpToolNames.listArtifactFiles]: "List uploaded artifact files for the project (optionally filtered by taskId/runId), newest first.",
-  [mcpToolNames.resolveHandoff]: "Resolve a tool_assisted handoff for an execution run (outcome success|failure). Success returns the task to the board; failure opens a new handoff cycle. Idempotent."
+  [mcpToolNames.resolveHandoff]: "Resolve a tool_assisted handoff for an execution run (outcome success|failure). Success returns the task to the board; failure opens a new handoff cycle. Idempotent.",
+  [mcpToolNames.registerLocalCheckout]: "Register the operator-local git checkout path for `projectSlug` so execution-run workers run code on this machine instead of the cloud. Validates the path is a git repo whose `origin` remote matches `repo`, then writes the (slug -> absolute path) entry to the operator-local checkout registry. Call this after locating the checkout on disk (e.g. via filesystem search) and confirming the choice with the user in chat \u2014 they should NOT have to paste the path into Settings. Returns `{ projectSlug, path, confirmedAt }`. Idempotent: re-registering overwrites the prior entry.",
+  [mcpToolNames.retrieveContext]: "Rehydrate a mrrlin:// handle emitted by the compact-context layer into the full canonical Mrrlin record (task/wiki page/project snapshot/execution run/artifacts). Use whenever you need the full source \u2014 irreversible decisions (closing tasks, dispatching deploys, writing specs) MUST call this first; never act on a compact envelope alone. Returns `{ kind, data }`. Invalid or unsupported handle \u2192 structured `HANDLE_INVALID` error."
 };
 var ARTIFACT_EXTENSION_TYPES = {
   ".md": "text/markdown",
@@ -47728,6 +48275,41 @@ function makeTool(client, name, fallbackCode, fallbackMessage, handler) {
     }
   };
 }
+function structuredOkCompactEnvelope(envelope) {
+  return {
+    content: [{ text: JSON.stringify({ data: envelope }, null, 2), type: "text" }],
+    isError: false,
+    structuredContent: { data: envelope }
+  };
+}
+function structuredOkMaybeCompact(name, projectSlug, value, context = {}) {
+  const kind = COMPACT_OPT_IN[name];
+  if (!kind) return structuredOk(value);
+  const envelope = maybeCompact(
+    { toolName: name, projectSlug, kind, rawValue: value, taskId: context.taskId },
+    readCompactPolicy()
+  );
+  if (!envelope) return structuredOk(value);
+  return structuredOkCompactEnvelope(envelope);
+}
+function makeReadTool(client, name, fallbackCode, fallbackMessage, handler, projectSlugFrom, taskIdFrom) {
+  return {
+    description: mcpToolDescriptions[name],
+    inputSchema: mcpToolInputSchemas[name],
+    name,
+    openApiOperationId: mcpToolOperationIds[name],
+    async invoke(input) {
+      try {
+        const value = await handler(client, input);
+        return structuredOkMaybeCompact(name, projectSlugFrom(input), value, {
+          taskId: taskIdFrom ? taskIdFrom(input) : void 0
+        });
+      } catch (error51) {
+        return structuredErr(classifyClientError(fallbackCode, fallbackMessage, error51));
+      }
+    }
+  };
+}
 function createMrrlinTools(options) {
   const client = createMrrlinClient(withAuth(options));
   return {
@@ -47864,12 +48446,13 @@ function createMrrlinTools(options) {
       "Unable to read project.",
       async (c, { projectSlug }) => await c.getProject(projectSlug)
     ),
-    [mcpToolNames.getProjectSnapshot]: makeTool(
+    [mcpToolNames.getProjectSnapshot]: makeReadTool(
       client,
       mcpToolNames.getProjectSnapshot,
       "PROJECT_SNAPSHOT_READ_FAILED",
       "Unable to read project snapshot.",
-      async (c, { projectSlug }) => await c.getProjectSnapshot(projectSlug)
+      async (c, { projectSlug }) => await c.getProjectSnapshot(projectSlug),
+      ({ projectSlug }) => projectSlug
     ),
     [mcpToolNames.getTask]: makeTool(
       client,
@@ -47899,13 +48482,6 @@ function createMrrlinTools(options) {
       "Unable to dispatch the task deploy workflow.",
       async (c, { projectSlug, taskId, workflowId, ...rest }) => await c.dispatchTaskDeploy(projectSlug, taskId, { ...rest, workflowId })
     ),
-    [mcpToolNames.listGithubWebhookDeliveries]: makeTool(
-      client,
-      mcpToolNames.listGithubWebhookDeliveries,
-      "GITHUB_WEBHOOK_DELIVERY_LIST_FAILED",
-      "Unable to list GitHub webhook deliveries.",
-      async (c, { projectSlug }) => await c.listGithubWebhookDeliveries(projectSlug)
-    ),
     [mcpToolNames.listGithubWorkflows]: makeTool(
       client,
       mcpToolNames.listGithubWorkflows,
@@ -47934,19 +48510,22 @@ function createMrrlinTools(options) {
       "Unable to list task dependencies.",
       async (c, { projectSlug }) => await c.listTaskDependencies(projectSlug)
     ),
-    [mcpToolNames.listTaskEvents]: makeTool(
+    [mcpToolNames.listTaskEvents]: makeReadTool(
       client,
       mcpToolNames.listTaskEvents,
       "TASK_EVENT_LIST_FAILED",
       "Unable to list task events.",
-      async (c, { projectSlug, taskId }) => await c.listTaskEvents(projectSlug, taskId)
+      async (c, { projectSlug, taskId }) => await c.listTaskEvents(projectSlug, taskId),
+      ({ projectSlug }) => projectSlug,
+      ({ taskId }) => taskId
     ),
-    [mcpToolNames.listTasks]: makeTool(
+    [mcpToolNames.listTasks]: makeReadTool(
       client,
       mcpToolNames.listTasks,
       "TASK_LIST_FAILED",
       "Unable to list tasks.",
-      async (c, { projectSlug, ...filters }) => await c.listTasks(projectSlug, filters)
+      async (c, { projectSlug, ...filters }) => await c.listTasks(projectSlug, filters),
+      ({ projectSlug }) => projectSlug
     ),
     [mcpToolNames.listTaxonomy]: makeTool(
       client,
@@ -47955,19 +48534,21 @@ function createMrrlinTools(options) {
       "Unable to list taxonomy.",
       async (c, { projectSlug }) => await c.listTaxonomy(projectSlug)
     ),
-    [mcpToolNames.listWikiPages]: makeTool(
+    [mcpToolNames.listWikiPages]: makeReadTool(
       client,
       mcpToolNames.listWikiPages,
       "WIKI_PAGE_LIST_FAILED",
       "Unable to list wiki pages.",
-      async (c, { projectSlug, ...filters }) => await c.listWikiPages(projectSlug, filters)
+      async (c, { projectSlug, ...filters }) => await c.listWikiPages(projectSlug, filters),
+      ({ projectSlug }) => projectSlug
     ),
-    [mcpToolNames.searchWikiPages]: makeTool(
+    [mcpToolNames.searchWikiPages]: makeReadTool(
       client,
       mcpToolNames.searchWikiPages,
       "WIKI_PAGE_SEARCH_FAILED",
       "Unable to search wiki pages.",
-      async (c, { projectSlug, ...query }) => await c.searchWikiPages(projectSlug, query)
+      async (c, { projectSlug, ...query }) => await c.searchWikiPages(projectSlug, query),
+      ({ projectSlug }) => projectSlug
     ),
     [mcpToolNames.searchKnowledge]: makeTool(
       client,
@@ -48114,12 +48695,13 @@ function createMrrlinTools(options) {
       "Unable to update execution run.",
       async (c, { projectSlug, runId, ...patch }) => await c.updateExecutionRun(projectSlug, runId, patch)
     ),
-    [mcpToolNames.listExecutionArtifacts]: makeTool(
+    [mcpToolNames.listExecutionArtifacts]: makeReadTool(
       client,
       mcpToolNames.listExecutionArtifacts,
       "EXECUTION_ARTIFACTS_LIST_FAILED",
       "Unable to list execution artifacts.",
-      async (c, { projectSlug, runId }) => await c.listExecutionArtifacts(projectSlug, runId)
+      async (c, { projectSlug, runId }) => await c.listExecutionArtifacts(projectSlug, runId),
+      ({ projectSlug }) => projectSlug
     ),
     [mcpToolNames.appendExecutionArtifact]: makeTool(
       client,
@@ -48186,7 +48768,7 @@ function createMrrlinTools(options) {
       "ARTIFACT_FILE_UPLOAD_FAILED",
       "Unable to upload artifact file.",
       async (c, { projectSlug, path: filePath, class: artifactClass, taskId, runId, description }) => {
-        const extension2 = import_node_path15.default.extname(filePath).toLowerCase();
+        const extension2 = import_node_path14.default.extname(filePath).toLowerCase();
         const contentType = ARTIFACT_EXTENSION_TYPES[extension2];
         if (!contentType) {
           throw new McpToolCodedError(
@@ -48214,7 +48796,7 @@ function createMrrlinTools(options) {
             "Artifact exceeds 5MB; split or summarize instead."
           );
         }
-        const filename = import_node_path15.default.basename(filePath);
+        const filename = import_node_path14.default.basename(filePath);
         const created = await c.createArtifactFile(projectSlug, {
           class: artifactClass,
           contentType,
@@ -48289,9 +48871,98 @@ function createMrrlinTools(options) {
       "HANDOFF_RESOLVE_FAILED",
       "Unable to resolve handoff.",
       async (c, { projectSlug, runId, ...input }) => await c.resolveHandoff(projectSlug, runId, input)
+    ),
+    [mcpToolNames.registerLocalCheckout]: makeTool(
+      client,
+      mcpToolNames.registerLocalCheckout,
+      "LOCAL_CHECKOUT_REGISTER_FAILED",
+      "Unable to register local checkout.",
+      async (_c, { projectSlug, path: checkoutPath, repo }) => {
+        const trimmedPath = checkoutPath.trim();
+        if (!import_node_path14.default.isAbsolute(trimmedPath)) {
+          throw new McpToolCodedError(
+            "LOCAL_CHECKOUT_PATH_NOT_ABSOLUTE",
+            `Path must be absolute, got: ${trimmedPath}`
+          );
+        }
+        let resolvedPath;
+        try {
+          resolvedPath = (0, import_node_fs12.realpathSync)(trimmedPath);
+        } catch {
+          throw new McpToolCodedError(
+            "LOCAL_CHECKOUT_PATH_NOT_FOUND",
+            `Path does not exist or is not accessible: ${trimmedPath}`
+          );
+        }
+        let remoteUrl;
+        try {
+          remoteUrl = (0, import_node_child_process6.execFileSync)("git", ["-C", resolvedPath, "remote", "get-url", "origin"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 15e3,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+          }).trim();
+        } catch {
+          throw new McpToolCodedError(
+            "LOCAL_CHECKOUT_NOT_A_GIT_REPO",
+            `Path is not a git repository or has no origin remote: ${resolvedPath}`
+          );
+        }
+        if (!remoteMatchesRepo(remoteUrl, repo)) {
+          throw new McpToolCodedError(
+            "LOCAL_CHECKOUT_REMOTE_MISMATCH",
+            `Origin remote ${remoteUrl} does not match repo ${repo}.`
+          );
+        }
+        const stateDir = process.env.CODEX_HOME ? import_node_path14.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge") : import_node_path14.default.join(import_node_os8.default.homedir(), ".mrrlin", "director-bridge");
+        const registry3 = new CheckoutRegistry(stateDir);
+        const confirmedAt = (/* @__PURE__ */ new Date()).toISOString();
+        registry3.confirm(projectSlug, resolvedPath, confirmedAt);
+        return { projectSlug, path: resolvedPath, confirmedAt };
+      }
+    ),
+    [mcpToolNames.retrieveContext]: makeTool(
+      client,
+      mcpToolNames.retrieveContext,
+      "HANDLE_INVALID",
+      "Unable to retrieve handle.",
+      async (c, { handle }) => {
+        const parsed = parseMrrlinHandle(handle);
+        if (!parsed) {
+          throw new McpToolCodedError(
+            "HANDLE_INVALID",
+            `Unrecognized mrrlin:// handle: ${handle}. Valid kinds: task | wiki | project/{slug}/snapshot | project/{slug}/tasks | run/{slug}/{runId} | run/{slug}/{runId}/artifacts.`
+          );
+        }
+        return await dispatchHandle(c, parsed);
+      }
     )
   };
 }
+async function dispatchHandle(client, handle) {
+  switch (handle.kind) {
+    case "task":
+      return { kind: handle.kind, data: await client.getTask(handle.projectSlug, handle.taskId) };
+    case "task-events":
+      return {
+        kind: handle.kind,
+        data: await client.listTaskEvents(handle.projectSlug, handle.taskId)
+      };
+    case "wiki":
+      return { kind: handle.kind, data: await client.getWikiPage(handle.projectSlug, handle.pageId) };
+    case "project-snapshot":
+      return { kind: handle.kind, data: await client.getProjectSnapshot(handle.projectSlug) };
+    case "project-tasks":
+      return { kind: handle.kind, data: await client.listTasks(handle.projectSlug, {}) };
+    case "run":
+      return { kind: handle.kind, data: await client.getExecutionRun(handle.projectSlug, handle.runId) };
+    case "run-artifacts":
+      return {
+        kind: handle.kind,
+        data: await client.listExecutionArtifacts(handle.projectSlug, handle.runId)
+      };
+  }
+}
 
 // src/server.ts
 function redactUrlForLog(value) {
@@ -48450,13 +49121,13 @@ function runSetCredential(args) {
 }
 
 // src/install-service.ts
-var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_os9 = __toESM(require("node:os"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 
 // src/service-paths.ts
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 function isWorktreePath(p) {
-  const norm = import_node_path16.default.normalize(p).split(import_node_path16.default.sep).join("/");
+  const norm = import_node_path15.default.normalize(p).split(import_node_path15.default.sep).join("/");
   return norm.includes("/.claude/worktrees/");
 }
 function resolveServiceCwd(opts) {
@@ -48509,7 +49180,7 @@ function installService(deps) {
     deps.log(resolved.reason);
     return { ok: false };
   }
-  const home = deps.env.HOME ?? import_node_os8.default.homedir();
+  const home = deps.env.HOME ?? import_node_os9.default.homedir();
   const bins = ["node", "codex", "mrrlin-mcp"].map((b) => deps.which(b));
   if (bins.some((b) => !b)) {
     deps.log("Could not resolve absolute paths for node/codex/mrrlin-mcp on PATH. Install them or fix PATH.");
@@ -48520,7 +49191,7 @@ function installService(deps) {
     return { ok: false };
   }
   const resolvedBins = bins.filter((b) => b !== null);
-  const pathEnv = Array.from(new Set(resolvedBins.map((b) => import_node_path17.default.dirname(b)))).join(":");
+  const pathEnv = Array.from(new Set(resolvedBins.map((b) => import_node_path16.default.dirname(b)))).join(":");
   const text = renderEcosystemConfig({
     cwd: resolved.cwd,
     home,
@@ -48529,7 +49200,7 @@ function installService(deps) {
     staging: deps.env.MRRLIN_STAGING === "1",
     apiBaseUrl: deps.env.MRRLIN_API_BASE_URL?.trim() || void 0
   });
-  const ecoPath = import_node_path17.default.join(home, ".mrrlin", "ecosystem.config.cjs");
+  const ecoPath = import_node_path16.default.join(home, ".mrrlin", "ecosystem.config.cjs");
   deps.writeFile(ecoPath, text);
   const start = deps.runPm2(["startOrReload", ecoPath]);
   if (start.code !== 0) {
@@ -48560,13 +49231,13 @@ function uninstallService(deps) {
 
 // src/uninstall-codex.ts
 var import_promises4 = __toESM(require("node:fs/promises"), 1);
-var import_node_os9 = __toESM(require("node:os"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_os10 = __toESM(require("node:os"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var toml2 = __toESM(require_toml(), 1);
 function resolveCodexHome2(options) {
   if (options.codexHome) return options.codexHome;
   if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
-  return import_node_path18.default.join(options.homeDir ?? import_node_os9.default.homedir(), ".codex");
+  return import_node_path17.default.join(options.homeDir ?? import_node_os10.default.homedir(), ".codex");
 }
 async function pathExists3(target) {
   try {
@@ -48579,7 +49250,7 @@ async function pathExists3(target) {
 var MRRLIN_BLOCK_RE2 = /(^|\n)\[mcp_servers\.mrrlin(?:\]|\.[^\]\n]*\])[\s\S]*?(?=\n\[|$)/g;
 async function uninstallCodex(options = {}) {
   const codexHome = resolveCodexHome2(options);
-  const configPath = import_node_path18.default.join(codexHome, "config.toml");
+  const configPath = import_node_path17.default.join(codexHome, "config.toml");
   const removePrompts = async () => uninstallPrompts(codexHome, options.promptNames ?? []);
   if (!await pathExists3(configPath)) {
     return { action: "missing", configPath, prompts: await removePrompts() };
@@ -48607,10 +49278,10 @@ async function uninstallCodex(options = {}) {
 }
 async function uninstallPrompts(codexHome, names) {
   if (names.length === 0) return [];
-  const promptsDir2 = import_node_path18.default.join(codexHome, "prompts");
+  const promptsDir2 = import_node_path17.default.join(codexHome, "prompts");
   const out = [];
   for (const name of names) {
-    const promptPath = import_node_path18.default.join(promptsDir2, `${name}.md`);
+    const promptPath = import_node_path17.default.join(promptsDir2, `${name}.md`);
     try {
       await import_promises4.default.unlink(promptPath);
       out.push({ name, action: "removed", promptPath });
@@ -48628,15 +49299,15 @@ async function uninstallPrompts(codexHome, names) {
 
 // src/report-issue-prompt.ts
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
 var import_meta2 = {};
 function promptsDir() {
-  if (typeof __dirname !== "undefined") return import_node_path19.default.join(__dirname, "prompts");
-  return import_node_path19.default.join(import_node_path19.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url)), "prompts");
+  if (typeof __dirname !== "undefined") return import_node_path18.default.join(__dirname, "prompts");
+  return import_node_path18.default.join(import_node_path18.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url)), "prompts");
 }
 function readReportIssuePrompt() {
-  return import_node_fs13.default.readFileSync(import_node_path19.default.join(promptsDir(), "report-issue.md"), "utf8");
+  return import_node_fs13.default.readFileSync(import_node_path18.default.join(promptsDir(), "report-issue.md"), "utf8");
 }
 
 // src/bin.ts
@@ -48662,14 +49333,18 @@ Usage:
 
   mrrlin-mcp install-codex      Idempotently register Mrrlin in
   [--force]                     ~/.codex/config.toml (or CODEX_HOME). Adds an
-                                [mcp_servers.mrrlin] block AND drops the bundled
+  [--force-prompts]             [mcp_servers.mrrlin] block AND drops the bundled
                                 slash-command prompts (currently: /report-issue)
                                 into <CODEX_HOME>/prompts/. Development
                                 checkouts register the local dist/bin.cjs;
                                 published npm installs register
                                 \`mrrlin-mcp serve\`.
-                                --force replaces
-                                an existing conflicting block.
+                                --force replaces an existing conflicting block.
+                                --force-prompts overwrites prompt files that
+                                already exist with different content. WITHOUT it,
+                                local edits to <CODEX_HOME>/prompts/<name>.md are
+                                preserved across patch releases (reported as
+                                'skipped-modified').
 
   mrrlin-mcp director-bridge    Run a local ws://127.0.0.1 (plain HTTP +
                                 WebSocket) bridge that lets the web Director
@@ -48747,6 +49422,14 @@ Usage:
                                 binary) and the Settings credential revoke. Leaves
                                 global pm2 alone (it may be used elsewhere).
 
+  mrrlin-mcp redact             Scrub known secret shapes (GitHub PATs,
+                                Bearer/JWT tokens, long hex / base64-ish runs)
+                                from stdin and write the result to stdout. Same
+                                regex set as the bridge logger. Empty input ->
+                                empty output, exit 0. Used by the /report-issue
+                                prompt to ensure no raw text reaches Telegram:
+                                  printf %s "$HINT" | mrrlin-mcp redact
+
   mrrlin-mcp report-issue       Print the bundled support-report prompt to
                                 stdout. Normal users don't need this \u2014 install-codex
                                 already drops it as a /report-issue slash command.
@@ -48785,10 +49468,12 @@ async function main() {
     }
     case "install-codex": {
       const force = rest.includes("--force");
+      const forcePrompts = rest.includes("--force-prompts");
       const binPath = resolveSelfBinPath();
       const result = await installCodex({
         binPath,
         force,
+        forcePrompts,
         prompts: [{ name: "report-issue", content: readReportIssuePrompt() }]
       });
       process.stderr.write(`[mrrlin-mcp install-codex] ${result.action} ${result.configPath}
@@ -48796,7 +49481,22 @@ async function main() {
       for (const p of result.prompts) {
         process.stderr.write(`[mrrlin-mcp install-codex] prompt ${p.name}: ${p.action} ${p.promptPath}
 `);
+        if (p.action === "skipped-modified") {
+          process.stderr.write(
+            `[mrrlin-mcp install-codex] prompt ${p.name}: kept your local edits; run with --force-prompts to overwrite (or delete ${p.promptPath} to take the new bundled version)
+`
+          );
+        }
+      }
+      return;
+    }
+    case "redact": {
+      const chunks = [];
+      for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
       }
+      const input = Buffer.concat(chunks).toString("utf8");
+      process.stdout.write(redact(input));
       return;
     }
     case "report-issue": {
@@ -48819,7 +49519,7 @@ async function main() {
         env: process.env,
         cwd: process.cwd(),
         writeFile: (p, c) => {
-          (0, import_node_fs14.mkdirSync)(import_node_path21.default.dirname(p), { recursive: true, mode: 448 });
+          (0, import_node_fs14.mkdirSync)(import_node_path20.default.dirname(p), { recursive: true, mode: 448 });
           (0, import_node_fs14.writeFileSync)(p, c, { mode: 384 });
         },
         runPm2: pm2Runner,
@@ -48844,14 +49544,14 @@ async function main() {
         purgeSecret: purge,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path21.default.join(process.env.HOME ?? (0, import_node_os10.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path20.default.join(process.env.HOME ?? (0, import_node_os11.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
         log: (m) => process.stderr.write(`[mrrlin-mcp uninstall-service] ${m}
 `)
       });
       return;
     }
     case "uninstall": {
-      const home = process.env.HOME ?? (0, import_node_os10.homedir)();
+      const home = process.env.HOME ?? (0, import_node_os11.homedir)();
       const log = (m) => process.stderr.write(`[mrrlin-mcp uninstall] ${m}
 `);
       uninstallService({
@@ -48865,7 +49565,7 @@ async function main() {
         purgeSecret: true,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path21.default.join(home, ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path20.default.join(home, ".mrrlin", "ecosystem.config.cjs"),
         log
       });
       let codexOk = true;
@@ -48885,7 +49585,7 @@ async function main() {
         log(`codex config NOT modified: ${error51 instanceof Error ? error51.message : String(error51)}`);
       }
       try {
-        (0, import_node_fs14.rmSync)(import_node_path21.default.join(home, ".mrrlin"), { recursive: true, force: true });
+        (0, import_node_fs14.rmSync)(import_node_path20.default.join(home, ".mrrlin"), { recursive: true, force: true });
       } catch {
       }
       log("removed ~/.mrrlin");
@@ -48926,7 +49626,7 @@ ${HELP_TEXT}`);
   }
 }
 function resolveSelfBinPath() {
-  return import_node_path20.default.resolve(process.argv[1] ?? process.execPath);
+  return import_node_path19.default.resolve(process.argv[1] ?? process.execPath);
 }
 main().catch((error51) => {
   process.stderr.write(`mrrlin-mcp fatal error: ${error51 instanceof Error ? error51.message : String(error51)}