@mushi-mushi/cli 0.31.0 → 0.33.0

package/dist/index.js

@@ -22,6 +22,7 @@ import {
   ensureClientId,
   fetchIngestSetup,
   fmtDate,
+  getAbortSignal,
   installSignalHandlers,
   isMcpClient,
   listProfiles,
@@ -54,11 +55,11 @@ import {
   syncKeychainAfterKeyChange,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-JFMM7FGM.js";
+} from "./chunk-VAFSOAIO.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-KSEZHXYC.js";
+} from "./chunk-WO52D547.js";
 import {
   CLOUD_API_ENDPOINT,
   CLOUD_MCP_OAUTH_URL,
@@ -166,7 +167,7 @@ async function pollDeviceToken(endpoint, deviceCode) {
 var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 var deviceAuthRetryDelayMs = 1e3;
 async function waitForCliToken(endpoint, session, opts = {}) {
-  const sleep = opts.sleep ?? defaultSleep;
+  const sleep2 = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
   let intervalMs = (session.interval || 5) * 1e3;
   const deadline = now() + (session.expires_in || 600) * 1e3;
@@ -175,7 +176,7 @@ async function waitForCliToken(endpoint, session, opts = {}) {
   let firstPoll = true;
   while (now() < deadline) {
     if (!firstPoll) {
-      await sleep(intervalMs);
+      await sleep2(intervalMs);
     }
     firstPoll = false;
     const outcome = await pollDeviceToken(endpoint, session.device_code);
@@ -394,19 +395,19 @@ function printPostLoginBanner(opts) {
   if (message) console.log(message);
 }
 var MAX_CONSECUTIVE_ERRORS = 5;
-async function pollUntilApproved(endpoint, deviceData, deps) {
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? Date.now;
+async function pollUntilApproved(endpoint, deviceData, deps2) {
+  const sleep2 = deps2.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps2.now ?? Date.now;
   let pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
   const deadline = now() + (deviceData.expires_in ?? 600) * 1e3;
   let consecutiveErrors = 0;
   let firstPoll = true;
   while (now() < deadline) {
     if (!firstPoll) {
-      await sleep(pollIntervalMs);
+      await sleep2(pollIntervalMs);
     }
     firstPoll = false;
-    const outcome = await deps.poll(endpoint, deviceData.device_code);
+    const outcome = await deps2.poll(endpoint, deviceData.device_code);
     switch (outcome.status) {
       case "approved":
         return { status: "approved", cliToken: outcome.cliToken };
@@ -435,15 +436,15 @@ async function resolveProjectChoice(projectsList, ask) {
   if (projectsList.length > 0) {
     console.log("");
     console.log("  Your projects:");
-    projectsList.forEach((p3, i) => {
-      console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
+    projectsList.forEach((p4, i) => {
+      console.log(`    ${i + 1}. ${p4.name} (${p4.id})`);
     });
     console.log(`    ${projectsList.length + 1}. Create a new project`);
     console.log("");
     const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-    const num2 = parseInt(choice, 10);
-    if (num2 >= 1 && num2 <= projectsList.length) {
-      const picked = projectsList[num2 - 1];
+    const num3 = parseInt(choice, 10);
+    if (num3 >= 1 && num3 <= projectsList.length) {
+      const picked = projectsList[num3 - 1];
       return { kind: "picked", id: picked.id, name: picked.name };
     }
   }
@@ -463,7 +464,7 @@ function defaultProjectName(packageName, cwd) {
 }
 function chooseProjectNonInteractive(projects, preferredName) {
   const wanted = slugify(preferredName);
-  const match = projects.find((p3) => slugify(p3.name) === wanted || p3.slug !== void 0 && slugify(p3.slug) === wanted);
+  const match = projects.find((p4) => slugify(p4.name) === wanted || p4.slug !== void 0 && slugify(p4.slug) === wanted);
   return match ? { kind: "existing", id: match.id, name: match.name } : { kind: "new", name: preferredName };
 }
 async function runLogin(opts = {}) {
@@ -554,7 +555,7 @@ error: Could not start login session: ${err instanceof Error ? err.message : Str
     if (process.stdin.isTTY) {
       const { createInterface } = await import("readline");
       const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const ask = (q) => new Promise((resolve7) => rl.question(q, (a) => resolve7(a.trim())));
+      const ask = (q2) => new Promise((resolve9) => rl.question(q2, (a) => resolve9(a.trim())));
       choice = await resolveProjectChoice(projectsList, ask);
       rl.close();
     } else {
@@ -782,13 +783,13 @@ function isFileSafe(path) {
   }
 }
 function getFrameworkFromPkg(pkg) {
-  const deps = {
+  const deps2 = {
     ...pkg.dependencies ?? {},
     ...pkg.devDependencies ?? {},
     ...pkg.peerDependencies ?? {}
   };
   for (const dep of Object.keys(FRAMEWORK_DEPS)) {
-    if (dep in deps) return FRAMEWORK_DEPS[dep];
+    if (dep in deps2) return FRAMEWORK_DEPS[dep];
   }
   return void 0;
 }
@@ -909,11 +910,11 @@ async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join11, resolve: resolve7 } = await import("path");
-    const root = resolve7(cwd);
-    const pkgPath = join11(root, "package.json");
+    const { join: join13, resolve: resolve9 } = await import("path");
+    const root = resolve9(cwd);
+    const pkgPath = join13(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
-    const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    const deps2 = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
       "@mushi-mushi/react",
       "@mushi-mushi/web",
@@ -925,11 +926,11 @@ async function checkSdkInstall(cwd) {
       "@mushi-mushi/capacitor",
       "@mushi-mushi/node"
     ];
-    const installed = sdks.filter((s) => deps[s]);
+    const installed = sdks.filter((s) => deps2[s]);
     return {
       name: "SDK installed in this repo",
       ok: installed.length > 0,
-      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `npx mushi-mushi` to install"
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps2[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `npx mushi-mushi` to install"
     };
   } catch {
     return null;
@@ -1121,17 +1122,17 @@ async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
     const { readFile: readFile3, access } = await import("fs/promises");
-    const { join: join11, resolve: resolve7 } = await import("path");
-    const root = resolve7(cwd);
-    const pkgPath = join11(root, "package.json");
+    const { join: join13, resolve: resolve9 } = await import("path");
+    const root = resolve9(cwd);
+    const pkgPath = join13(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
-    const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
-    const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
+    const deps2 = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    const isCapHybrid = Boolean(deps2["@capacitor/core"] && deps2["react"]);
     const envCandidates = [".env.local", ".env"];
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile3(join11(root, f), "utf8");
+        envContent = await readFile3(join13(root, f), "utf8");
         break;
       } catch {
       }
@@ -1146,9 +1147,9 @@ async function checkHostAppWiring(cwd) {
       detail: hasProjectId && hasApiKey ? "VITE_/MUSHI_ project id + API key found" : "Run `mushi connect --write-env` or add VITE_MUSHI_PROJECT_ID + VITE_MUSHI_API_KEY"
     });
     let mcpFound = null;
-    for (const rel of [".mcp.json", join11(".cursor", "mcp.json")]) {
+    for (const rel of [".mcp.json", join13(".cursor", "mcp.json")]) {
       try {
-        await access(join11(root, rel));
+        await access(join13(root, rel));
         mcpFound = rel;
         break;
       } catch {
@@ -1160,7 +1161,7 @@ async function checkHostAppWiring(cwd) {
       detail: mcpFound ? `${mcpFound} present` : "No .mcp.json (Claude Code) or .cursor/mcp.json (Cursor) \u2014 run `npx mushi-mushi setup --ide claude` or `--ide cursor` for two-way reporter replies"
     });
     if (isCapHybrid) {
-      const hasWebSdk = Boolean(deps["@mushi-mushi/web"] || deps["@mushi-mushi/react"]);
+      const hasWebSdk = Boolean(deps2["@mushi-mushi/web"] || deps2["@mushi-mushi/react"]);
       checks.push({
         name: "[host] Capacitor hybrid \u2014 WebView SDK",
         ok: hasWebSdk,
@@ -1169,7 +1170,7 @@ async function checkHostAppWiring(cwd) {
       checks.push({
         name: "[host] Capacitor native plugin (optional)",
         ok: true,
-        detail: deps["@mushi-mushi/capacitor"] ? `@mushi-mushi/capacitor@${deps["@mushi-mushi/capacitor"]} installed` : "Optional: @mushi-mushi/capacitor for native shell parity \u2014 WebView SDK covers most flows"
+        detail: deps2["@mushi-mushi/capacitor"] ? `@mushi-mushi/capacitor@${deps2["@mushi-mushi/capacitor"]} installed` : "Optional: @mushi-mushi/capacitor for native shell parity \u2014 WebView SDK covers most flows"
       });
     }
   } catch {
@@ -1190,7 +1191,7 @@ var HASH_ROUTER_PATTERNS = [
 var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
-  const { join: join11 } = await import("path");
+  const { join: join13 } = await import("path");
   let count = 0;
   async function walk2(d, depth) {
     if (depth > maxDepth || count > maxFiles) return null;
@@ -1202,7 +1203,7 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
     }
     for (const e of entries) {
       if (e.name.startsWith(".") || e.name === "node_modules" || e.name === "dist") continue;
-      const full = join11(d, e.name);
+      const full = join13(d, e.name);
       if (e.isDirectory()) {
         const found = await walk2(full, depth + 1);
         if (found) return found;
@@ -1210,19 +1211,19 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
         count++;
         try {
           const src = await readFile3(full, "utf8");
-          if (patterns.some((p3) => p3.test(src))) return full;
+          if (patterns.some((p4) => p4.test(src))) return full;
         } catch {
         }
       }
     }
     return null;
   }
-  const { resolve: resolve7 } = await import("path");
+  const { resolve: resolve9 } = await import("path");
   for (const sub of ["src", "app", "pages", "lib", "components"]) {
-    const found = await walk2(join11(resolve7(dir), sub), 0);
+    const found = await walk2(join13(resolve9(dir), sub), 0);
     if (found) return found;
   }
-  return walk2(resolve7(dir), 0);
+  return walk2(resolve9(dir), 0);
 }
 async function checkHashRouterCapture(cwd) {
   const hashFile = await scanDirForPattern(cwd, HASH_ROUTER_PATTERNS);
@@ -1255,13 +1256,13 @@ function normalizeProjectPath(path) {
 }
 async function collectMcpSources(root, home) {
   const { readFile: readFile3 } = await import("fs/promises");
-  const { join: join11 } = await import("path");
+  const { join: join13 } = await import("path");
   const sources = [];
   const invalid = [];
   const plainFiles = [
-    { path: join11(root, ".mcp.json"), claudeCode: true },
-    { path: join11(root, ".cursor", "mcp.json"), claudeCode: false },
-    { path: join11(home, ".cursor", "mcp.json"), claudeCode: false }
+    { path: join13(root, ".mcp.json"), claudeCode: true },
+    { path: join13(root, ".cursor", "mcp.json"), claudeCode: false },
+    { path: join13(home, ".cursor", "mcp.json"), claudeCode: false }
   ];
   for (const file of plainFiles) {
     let raw;
@@ -1278,7 +1279,7 @@ async function collectMcpSources(root, home) {
       invalid.push(file.path);
     }
   }
-  const claudeJsonPath = join11(home, ".claude.json");
+  const claudeJsonPath = join13(home, ".claude.json");
   try {
     const parsed = JSON.parse(await readFile3(claudeJsonPath, "utf8"));
     if (isJsonObject(parsed)) {
@@ -1349,9 +1350,9 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
 }
 async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch, home) {
   const checks = [];
-  const { resolve: resolve7 } = await import("path");
+  const { resolve: resolve9 } = await import("path");
   const { homedir } = await import("os");
-  const root = resolve7(cwd);
+  const root = resolve9(cwd);
   const { sources, invalid } = await collectMcpSources(root, home ?? homedir());
   if (invalid.length > 0) {
     checks.push({
@@ -1475,12 +1476,12 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join11, resolve: resolve7 } = await import("path");
-    const root = resolve7(cwd);
+    const { join: join13, resolve: resolve9 } = await import("path");
+    const root = resolve9(cwd);
     let envContent = "";
     for (const f of [".env.local", ".env"]) {
       try {
-        envContent = await readFile3(join11(root, f), "utf8");
+        envContent = await readFile3(join13(root, f), "utf8");
         break;
       } catch {
       }
@@ -1546,7 +1547,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-XYJRQQMM.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-N7HPHS4Y.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1576,10 +1577,10 @@ async function checkVersionDrift(cwd, doFetch) {
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join11 } = await import("path");
-    const pkg = JSON.parse(await readFile3(join11(cwd, "package.json"), "utf8"));
-    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const candidates = Object.entries(deps).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
+    const { join: join13 } = await import("path");
+    const pkg = JSON.parse(await readFile3(join13(cwd, "package.json"), "utf8"));
+    const deps2 = { ...pkg.dependencies, ...pkg.devDependencies };
+    const candidates = Object.entries(deps2).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
     const drifted = (await Promise.all(
       candidates.map(async ([name, v]) => {
         try {
@@ -1833,11 +1834,11 @@ async function runInitAudit(cwd) {
   }
 }
 function maybeSuggestAudit(pkg) {
-  const deps = {
+  const deps2 = {
     ...pkg?.dependencies,
     ...pkg?.devDependencies
   };
-  if (Object.keys(deps).some((d) => d.startsWith("@mushi-mushi/"))) {
+  if (Object.keys(deps2).some((d) => d.startsWith("@mushi-mushi/"))) {
     p.log.info(
       "A Mushi SDK is already installed here. To health-check the existing setup instead, run `npx mushi-mushi --audit`."
     );
@@ -1988,12 +1989,12 @@ async function resolveSavedCredentials(saved, endpoint, probe) {
   }
   return { kind: "unusable", reason: describeUnsafeSdkKey(cliProbe, endpoint) };
 }
-async function mintWizardKeys(deps, args) {
+async function mintWizardKeys(deps2, args) {
   let projectId2;
   let createdName;
   let sdkKey = null;
   if (args.target.kind === "new") {
-    const created = await deps.createProject(args.endpoint, args.cliToken, args.target.name, {
+    const created = await deps2.createProject(args.endpoint, args.cliToken, args.target.name, {
       scopes: SDK_KEY_SCOPES
     });
     projectId2 = created.id;
@@ -2003,7 +2004,7 @@ async function mintWizardKeys(deps, args) {
     projectId2 = args.target.projectId;
   }
   if (!sdkKey) {
-    sdkKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId2, {
+    sdkKey = await deps2.mintProjectKey(args.endpoint, args.cliToken, projectId2, {
       scopes: SDK_KEY_SCOPES,
       label: SDK_KEY_LABEL
     });
@@ -2012,7 +2013,7 @@ async function mintWizardKeys(deps, args) {
   let cliKeyError;
   if (args.withCliKey) {
     try {
-      cliKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId2, {
+      cliKey = await deps2.mintProjectKey(args.endpoint, args.cliToken, projectId2, {
         scopes: CLI_KEY_SCOPES,
         label: CLI_KEY_LABEL
       });
@@ -2287,7 +2288,7 @@ async function installPackages(pm, packages, cwd) {
 function runCommand(pm, packages, cwd) {
   const verb = pm === "npm" ? "install" : "add";
   const command = process.platform === "win32" ? `${pm}.cmd` : pm;
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = spawn(command, [verb, ...packages], {
       stdio: "inherit",
       shell: false,
@@ -2296,7 +2297,7 @@ function runCommand(pm, packages, cwd) {
     });
     child.on("error", reject);
     child.on("exit", (code) => {
-      if (code === 0) resolve7();
+      if (code === 0) resolve9();
       else reject(new Error(`${pm} exited with code ${code ?? "null"}`));
     });
   });
@@ -2470,7 +2471,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-DKPQB4UI.js");
+    const { runConnect: runConnect2 } = await import("./connect-G4B4A36H.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -2673,7 +2674,7 @@ var MIGRATE_CATALOG = [
       "@sentry/angular",
       "@sentry/react-native",
       "@sentry/capacitor"
-    ].some((p3) => d.has(p3))
+    ].some((p4) => d.has(p4))
   },
   ...Object.entries(COMPETITOR_PACKAGES).map(([slug, pkgs]) => ({
     slug,
@@ -2682,7 +2683,7 @@ var MIGRATE_CATALOG = [
     category: "competitor",
     status: "published",
     detectionLabel: pkgs[0],
-    match: (d) => pkgs.some((p3) => d.has(p3))
+    match: (d) => pkgs.some((p4) => d.has(p4))
   }))
 ];
 function titleForCompetitor(slug) {
@@ -2701,8 +2702,8 @@ function titleForCompetitor(slug) {
       return slug;
   }
 }
-function detectMigrations(deps, catalog = MIGRATE_CATALOG) {
-  return catalog.filter((g) => g.status === "published" && g.match?.(deps)).map((g) => ({ guide: g, url: `${DOCS_BASE}/migrations/${g.slug}` }));
+function detectMigrations(deps2, catalog = MIGRATE_CATALOG) {
+  return catalog.filter((g) => g.status === "published" && g.match?.(deps2)).map((g) => ({ guide: g, url: `${DOCS_BASE}/migrations/${g.slug}` }));
 }
 function depsFromPackageJson(pkg) {
   if (!pkg) return /* @__PURE__ */ new Set();
@@ -2722,8 +2723,8 @@ function runMigrate(opts = {}) {
     );
     return { matches: [] };
   }
-  const deps = depsFromPackageJson(pkg);
-  const matches = detectMigrations(deps);
+  const deps2 = depsFromPackageJson(pkg);
+  const matches = detectMigrations(deps2);
   if (opts.json) {
     log3(
       JSON.stringify(
@@ -2943,7 +2944,80 @@ function registerDeployCommands(program2) {
   });
 }
 
+// src/command-helpers.ts
+function orgSegment(org) {
+  if (!org || org === "current") return "current";
+  return encodeURIComponent(requireUuid(org, "organization id"));
+}
+function dieOrgError(result) {
+  const { code } = result.error;
+  if (code === "ORG_REQUIRED") {
+    const orgs = Array.isArray(result.error["organizations"]) ? result.error["organizations"] : [];
+    if (orgs.length > 0) {
+      process.stderr.write("\n  Pick one and pass it with --org:\n");
+      for (const o of orgs) {
+        process.stderr.write(`    --org ${String(o.id)}   ${typeof o.name === "string" ? o.name : ""}
+`);
+      }
+      process.stderr.write("\n");
+    }
+  } else if (code.endsWith("_NEEDS_ACCOUNT_KEY")) {
+    process.stderr.write(
+      "\n  Team-wide views need an account-level key, not a key bound to one project.\n  Mint one in the console (Connect \u2192 MCP \u2192 account key), then:\n\n    MUSHI_API_KEY=<account key> mushi <command>\n\n"
+    );
+  }
+  die(result);
+}
+function requireYes(yes, action) {
+  if (yes) return;
+  throw new MushiCliError(
+    "E_INVALID_INPUT",
+    `${action} Re-run with --yes to go ahead.`,
+    "nothing was sent"
+  );
+}
+function resolveProjectId(flag, configured) {
+  const raw = flag ?? configured;
+  if (!raw) {
+    throw new MushiCliError(
+      "E_PROJECT_MISSING",
+      "Project ID not configured.",
+      "pass --project-id <uuid> or run `mushi login --project-id <uuid>`"
+    );
+  }
+  return requireUuid(raw, "project id");
+}
+function oneLine(text2, max = 80) {
+  const flat = String(text2 ?? "").replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+}
+
 // src/commands/reports.ts
+var FILE_REPORT_SEVERITIES = ["critical", "high", "medium", "low"];
+function buildFileReportBody(flags) {
+  const title = (flags.title ?? "").trim();
+  const description = (flags.description ?? "").trim();
+  if (title.length < 3 || title.length > 200) {
+    throw new MushiCliError("E_INVALID_INPUT", "--title must be 3 to 200 characters.");
+  }
+  if (description.length < 1 || description.length > 1e4) {
+    throw new MushiCliError("E_INVALID_INPUT", "--description must be 1 to 10000 characters.");
+  }
+  const body = { title, description };
+  if (flags.severity !== void 0) {
+    const severity = flags.severity.trim().toLowerCase();
+    if (!FILE_REPORT_SEVERITIES.includes(severity)) {
+      throw new MushiCliError("E_INVALID_INPUT", `--severity must be one of: ${FILE_REPORT_SEVERITIES.join(", ")}.`);
+    }
+    body["severity"] = severity;
+  }
+  if (flags.component !== void 0) {
+    const component = flags.component.trim();
+    if (component.length > 200) throw new MushiCliError("E_INVALID_INPUT", "--component is at most 200 characters.");
+    if (component) body["component"] = component;
+  }
+  return body;
+}
 function registerReportsCommands(program2) {
   const reports = program2.command("reports").description("Manage bug reports");
   reports.command("list").description("List recent reports for the current project").option("--limit <n>", "Max results (1\u2013100)", "20").option("--status <status>", "Filter by status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "Filter by severity: critical|high|medium|low").option("--search <query>", "Full-text search in summary and description").option("--json", "Output as JSON (alias for -o json)").addHelpText("after", `
@@ -3229,6 +3303,30 @@ Examples:
       }
     });
   });
+  reports.command("file").description("File a report by hand (a backlog item, a bug you found yourself); it is triaged like any other report").requiredOption("--title <text>", "One-line title (3-200 characters)").requiredOption("--description <text>", "What happens, steps, what you expected (up to 10000 characters)").option("--severity <severity>", "Your hint: critical|high|medium|low (triage may refine it)").option("--component <name>", "Area of the app, e.g. checkout").option("--project <id>", "Project ID (defaults to the configured project)").option("--project-id <id>", "Same as --project").option("--json", "Output as JSON (alias for -o json)").addHelpText("after", `
+Needs a key with the mcp:write scope (or an account key that reaches the app).
+At most 30 reports an hour per app.
+
+Examples:
+  mushi reports file --title "Checkout adds tax twice" --description "Cart of 2 items shows tax x2 on /checkout"
+  mushi reports file --title "Bump sharp to 0.34" --description "..." --severity low --component build --project <uuid>`).action(async (opts) => {
+    const body = buildFileReportBody(opts);
+    const config = requireConfig();
+    const projectId2 = resolveProjectId(opts.project ?? opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${projectId2}/reports`, config, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+    if (!result.ok) die(result);
+    printResult(result.data, {
+      json: opts.json,
+      render(d) {
+        console.log(`\u2713 Filed report ${d.reportId}`);
+        console.log(`  ${d.title}`);
+        console.log(`  Triage runs now; see it with: mushi reports show ${d.reportId}`);
+      }
+    });
+  });
 }
 
 // src/commands/feedback.ts
@@ -3400,11 +3498,11 @@ async function findMapFiles(dir) {
   return results;
 }
 function fileHash(path) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const hash = createHash("sha256");
     const stream = createReadStream(path);
     stream.on("data", (chunk) => hash.update(chunk));
-    stream.on("end", () => resolve7(hash.digest("hex")));
+    stream.on("end", () => resolve9(hash.digest("hex")));
     stream.on("error", reject);
   });
 }
@@ -3724,6 +3822,20 @@ async function writeProjectBootstrapFiles(opts) {
 }
 
 // src/commands/project.ts
+async function persistProjectCreate(opts) {
+  const config = loadConfig(opts.configPath);
+  config.apiKey = opts.apiKey;
+  config.endpoint = opts.endpoint;
+  config.projectId = opts.projectId;
+  config.consoleUrl = opts.consoleUrl;
+  saveConfig(config, opts.configPath);
+  return writeProjectBootstrapFiles({
+    cwd: opts.cwd,
+    endpoint: opts.endpoint,
+    projectId: opts.projectId,
+    apiKey: opts.apiKey
+  });
+}
 function registerProjectCommands(program2) {
   const project = program2.command("project").description("Project management");
   project.command("create").description("Create or select a Mushi project via browser sign-in, then write config files").option("--name <name>", "Project name for a new project (skips the prompt)").option("--no-browser", "Print the verification URL instead of opening the browser").option("--endpoint <url>", "Override API endpoint (self-hosted)").addHelpText("after", `
@@ -3777,7 +3889,7 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
     const projectsList = await listProjects(endpoint, cliToken);
     const { createInterface } = await import("readline");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (q) => new Promise((resolve7) => rl.question(q, (a) => resolve7(a.trim())));
+    const ask = (q2) => new Promise((resolve9) => rl.question(q2, (a) => resolve9(a.trim())));
     let chosen;
     let projectId2;
     let projectName;
@@ -3791,9 +3903,9 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
       console.log(`    ${projectsList.length + 1}. Create a new project`);
       console.log("");
       const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-      const num2 = parseInt(choice, 10);
-      if (num2 >= 1 && num2 <= projectsList.length) {
-        chosen = projectsList[num2 - 1];
+      const num3 = parseInt(choice, 10);
+      if (num3 >= 1 && num3 <= projectsList.length) {
+        chosen = projectsList[num3 - 1];
         projectId2 = chosen.id;
         projectName = chosen.name;
       }
@@ -3827,16 +3939,11 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
       process.stderr.write("\nerror: Could not obtain an SDK key for the project. Run `mushi login` and try again.\n");
       process.exit(1);
     }
-    const config = loadConfig();
-    config.apiKey = apiKey;
-    config.endpoint = endpoint;
-    config.projectId = projectId2;
-    config.consoleUrl = consoleBase;
-    saveConfig(config);
-    const { envUpdated, mcpUpdated } = await writeProjectBootstrapFiles({
+    const { envUpdated, mcpUpdated } = await persistProjectCreate({
       endpoint,
       projectId: projectId2,
-      apiKey
+      apiKey,
+      consoleUrl: consoleBase
     });
     console.log(`
   OK  ${envUpdated ? "Updated" : "Created"} .env.local`);
@@ -3999,7 +4106,7 @@ If you are not signed in yet, setup runs browser sign-in first, then writes the
         );
         if (res.ok) {
           const body = await res.json();
-          const project = body?.data?.projects?.find((p3) => p3.id === config.projectId);
+          const project = body?.data?.projects?.find((p4) => p4.id === config.projectId);
           slug = project?.name ? slugifyProjectName(project.name) : config.projectId?.slice(0, 8) ?? "mushi";
         } else {
           slug = config.projectId?.slice(0, 8) ?? "mushi";
@@ -4047,11 +4154,11 @@ If you are not signed in yet, setup runs browser sign-in first, then writes the
     if (note2) console.log(note2);
     if (target.format === "mcp-json") {
       if (allProjectsList && allProjectsList.length > 0) {
-        for (const p3 of allProjectsList) {
-          const pServerName = buildMcpServerName({ projectId: p3.id, projectName: p3.name ?? void 0 });
+        for (const p4 of allProjectsList) {
+          const pServerName = buildMcpServerName({ projectId: p4.id, projectName: p4.name ?? void 0 });
           const pBlock = buildMcpServerBlock({
             endpoint: config.endpoint,
-            projectId: p3.id,
+            projectId: p4.id,
             apiKey: config.apiKey,
             client: ide,
             inlineKey
@@ -4063,7 +4170,7 @@ If you are not signed in yet, setup runs browser sign-in first, then writes the
         if (opts.dryRun) {
           console.log(`[dry-run] Would add ${allProjectsList.length} mushi-* entries to ${configPath}`);
         } else {
-          console.log(`\u2713 Added ${allProjectsList.length} mushi-* server entries (${allProjectsList.map((p3) => p3.name ?? p3.id.slice(0, 8)).join(", ")})`);
+          console.log(`\u2713 Added ${allProjectsList.length} mushi-* server entries (${allProjectsList.map((p4) => p4.name ?? p4.id.slice(0, 8)).join(", ")})`);
           if (!inlineKey) printKeyExportHint(ide);
         }
       } else {
@@ -4211,7 +4318,7 @@ If you are not signed in yet, setup runs browser sign-in first, then writes the
                 const { createInterface } = await import("readline");
                 const rl = createInterface({ input: process.stdin, output: process.stdout });
                 const answer = await new Promise(
-                  (resolve7) => rl.question("   Upgrade this key now via browser sign-in? [Y/n] ", (a) => resolve7(a.trim().toLowerCase()))
+                  (resolve9) => rl.question("   Upgrade this key now via browser sign-in? [Y/n] ", (a) => resolve9(a.trim().toLowerCase()))
                 );
                 rl.close();
                 if (answer === "" || answer === "y" || answer === "yes") {
@@ -4343,6 +4450,45 @@ async function resolveTargetRepoId(repo, cfg) {
     `linked repos: ${names}`
   );
 }
+var GATE_MARK = {
+  pass: ["\u2713", "pass"],
+  fail: ["\u2717", "fail"],
+  pending: ["\u2026", "pending"],
+  unavailable: ["\u2013", "unavailable"],
+  not_set_up: ["\u25CB", "not set up"]
+};
+var AUTO_MERGE_WORDS = {
+  none: "not merged by Mushi",
+  eligible: "eligible, waiting for the next run",
+  merged: "merged by Mushi",
+  skipped: "skipped",
+  failed: "failed"
+};
+var SIGNAL_WORDS = {
+  ci_failed_on_merge: "CI failed on the merge commit",
+  report_reopened: "the report was reopened",
+  new_report_in_changed_file: "a new report names a file this fix changed"
+};
+function renderVerification(v) {
+  const lines = [`Head ${v.headSha ? v.headSha.slice(0, 7) : "unknown"}: ${v.passed ? "every gate passes" : "not verified yet"}`];
+  for (const g of v.gates ?? []) {
+    const [glyph, word] = GATE_MARK[g.status] ?? ["?", g.status];
+    lines.push(`  ${glyph} ${word.padEnd(11)} ${g.label}`);
+    if (g.detail && g.status !== "pass") lines.push(`                ${g.detail}`);
+  }
+  const am = v.autoMerge;
+  if (am) lines.push(`Automatic merge: ${AUTO_MERGE_WORDS[am.state] ?? am.state}${am.detail ? `. ${am.detail}` : ""}`);
+  for (const r of v.regressions ?? []) {
+    const signal = String(r["signal"] ?? "");
+    const revertUrl = r["revertPrUrl"] ?? r["revert_pr_url"];
+    const revertState = String(r["revertState"] ?? r["revert_state"] ?? "none");
+    const detail = typeof r["detail"] === "string" && r["detail"] ? `: ${r["detail"]}` : "";
+    lines.push(`Regression: ${SIGNAL_WORDS[signal] ?? signal}${detail}`);
+    if (revertUrl) lines.push(`  Revert PR: ${revertUrl}`);
+    else if (revertState === "not_safe") lines.push("  No revert PR: later commits changed the same files. Revert by hand.");
+  }
+  return lines;
+}
 function registerFixCommands(program2) {
   const fixCmd = program2.command("fix").description("Dispatch an agentic fix for a report");
   fixCmd.argument("<reportId>", "Report UUID to fix").option(
@@ -4521,6 +4667,9 @@ Examples:
     "--method <method>",
     "GitHub merge method: squash (default), merge, or rebase",
     "squash"
+  ).option(
+    "--override",
+    'Not available here: the CLI signs in with an API key, and only a person in the Mushi console can override an Opus "hold" (with a reason)'
   ).option("--json", "Machine-readable JSON output").action(async (fixId, opts) => {
     const config = loadConfig();
     if (!config.apiKey) {
@@ -4531,6 +4680,12 @@ Examples:
       console.error("No endpoint configured. Run `mushi init`");
       process.exit(1);
     }
+    if (opts.override) {
+      console.error(
+        'Overriding an Opus "hold" needs a person in the Mushi console: open the fix, read the findings, and choose Merge anyway with a reason. The CLI signs in with an API key, which cannot override (ADR 0030).'
+      );
+      process.exit(1);
+    }
     const method = opts.method;
     if (!["squash", "merge", "rebase"].includes(method)) {
       console.error("--method must be squash, merge, or rebase");
@@ -4545,6 +4700,9 @@ Examples:
         console.log(JSON.stringify({ ok: false, error: result.error }, null, 2));
       } else {
         console.error("Merge failed:", result.error.message);
+        if (result.error.code === "REVIEW_HOLD") {
+          console.error(`Read the review: mushi fixes review ${fixId} --show. To merge anyway, override the hold in the Mushi console (with a reason).`);
+        }
       }
       process.exit(1);
     }
@@ -4558,6 +4716,78 @@ Examples:
     } else {
       console.log(`Merged successfully. Report status: ${data.reportStatus ?? "fixed"}`);
     }
+    if (data.review) {
+      console.log(`${data.review.label}${data.review.overridden ? " (overridden)" : ""}`);
+    }
+  });
+  function printReview(review) {
+    console.log(review.label);
+    if (review.reason) console.log(review.reason);
+    if (review.summary) console.log(`
+${review.summary}`);
+    for (const f of review.findings) {
+      const where = f.file === "(general)" ? "" : ` ${f.file}${f.line ? `:${f.line}` : ""}`;
+      console.log(`  - ${f.severity}${where}: ${f.issue} Fix: ${f.suggested_fix}`);
+    }
+    for (const r of review.removesBehavior) console.log(`  - removes: ${r}`);
+    if (review.needsHumanDecision) console.log(`Needs your decision: ${review.needsHumanDecision}`);
+    if (review.commentUrl) console.log(`On GitHub: ${review.commentUrl}`);
+  }
+  fixes.command("review <fixId>").description("Re-run the Opus review of a fix PR (ADR 0030), or show the current one with --show").option("--show", "Show the current review instead of starting a new one").option("--json", "Machine-readable JSON output").action(async (fixId, opts) => {
+    const config = loadConfig();
+    if (!config.apiKey) {
+      console.error("Run `mushi login` first");
+      process.exit(1);
+    }
+    if (!config.endpoint) {
+      console.error("No endpoint configured. Run `mushi init`");
+      process.exit(1);
+    }
+    const result = opts.show ? await apiCall(`/v1/admin/fixes/${fixId}/timeline`, config) : await apiCall(`/v1/admin/fixes/${fixId}/review`, config, { method: "POST" });
+    if (!result.ok) {
+      if (opts.json) console.log(JSON.stringify({ ok: false, error: result.error }, null, 2));
+      else console.error(opts.show ? "Could not read the review:" : "Review not started:", result.error.message);
+      process.exit(1);
+    }
+    const review = result.data?.review;
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: true, review: review ?? null }, null, 2));
+      return;
+    }
+    if (!opts.show) console.log("Review queued. It takes a few minutes; check with --show.");
+    if (review) printReview(review);
+  });
+  fixes.command("verify <fixId>").description("Show the verified-merge gates for a fix PR's current head (ADR 0035), or re-check them with --rerun").option("--rerun", "Re-check the gates now, then show them").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Gates: Opus review, CI, a test that fails without the fix, no tests weakened,
+a small change, and a second review. Mushi merges on its own only when every
+gate passes and Verified merge is on for the project.
+Docs: https://kensaur.us/mushi-mushi/docs/admin/verified-merge`).action(async (fixId, opts) => {
+    requireUuid(fixId, "fixId");
+    const config = requireConfig();
+    const json2 = outputIsJson(opts.json);
+    if (opts.rerun) {
+      const started = await apiCall(`/v1/admin/fixes/${fixId}/verify`, config, { method: "POST" });
+      if (!started.ok) {
+        if (json2) console.log(JSON.stringify({ ok: false, error: started.error }, null, 2));
+        else console.error("Re-check not started:", started.error.message);
+        process.exit(1);
+      }
+    }
+    const result = await apiCall(`/v1/admin/fixes/${fixId}/verification`, config);
+    if (!result.ok) {
+      if (json2) console.log(JSON.stringify({ ok: false, error: result.error }, null, 2));
+      else console.error("Could not read the verification:", result.error.message);
+      process.exit(1);
+    }
+    if (json2) {
+      console.log(JSON.stringify({ ok: true, verification: result.data ?? null }, null, 2));
+      return;
+    }
+    if (!result.data) {
+      console.log("No verification for this fix yet. Mushi checks open agent PRs every 10 minutes after their review.");
+      return;
+    }
+    for (const line of renderVerification(result.data)) console.log(line);
   });
   fixes.command("refresh-ci <fixId>").description("Pull latest GitHub Actions check-run status for a fix attempt (on-demand ci-sync)").option("--json", "Machine-readable JSON output").action(async (fixId, opts) => {
     const config = loadConfig();
@@ -4588,6 +4818,33 @@ Examples:
     const updated = data.check_run_updated_at ? new Date(data.check_run_updated_at).toISOString() : "\u2014";
     console.log(`CI status: ${status} \xB7 conclusion: ${conclusion} \xB7 updated: ${updated}`);
   });
+  fixes.command("rerun-ci <fixId>").description("Re-run the failed or cancelled CI runs on a fix PR's latest commit (for example after the test machine stopped)").option("--json", "Machine-readable JSON output").action(async (fixId, opts) => {
+    const config = loadConfig();
+    if (!config.apiKey) {
+      console.error("Run `mushi login` first");
+      process.exit(1);
+    }
+    if (!config.endpoint) {
+      console.error("No endpoint configured. Run `mushi init`");
+      process.exit(1);
+    }
+    const result = await apiCall(
+      `/v1/admin/fixes/${fixId}/ci/rerun`,
+      config,
+      { method: "POST" }
+    );
+    if (!result.ok) {
+      if (opts.json) console.log(JSON.stringify({ ok: false, error: result.error }, null, 2));
+      else console.error("Re-run failed:", result.error.message);
+      process.exit(1);
+    }
+    const runs = result.data?.rerun ?? [];
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: true, ...result.data }, null, 2));
+      return;
+    }
+    console.log(`Re-ran ${runs.length} run${runs.length === 1 ? "" : "s"}: ${runs.map((r) => `#${r.runId}`).join(", ")}`);
+  });
 }
 
 // src/nudge.ts
@@ -4640,24 +4897,24 @@ var PRESETS = {
   }
 };
 function renderNudgeSnippet(opts) {
-  const p3 = { ...PRESETS[opts.phase], ...opts.overrides };
-  const dwellMs = p3.pageDwellMinutes > 0 ? `${p3.pageDwellMinutes} * 60 * 1000` : null;
-  const firstMs = p3.firstSessionSeconds > 0 ? `${p3.firstSessionSeconds} * 1000` : null;
+  const p4 = { ...PRESETS[opts.phase], ...opts.overrides };
+  const dwellMs = p4.pageDwellMinutes > 0 ? `${p4.pageDwellMinutes} * 60 * 1000` : null;
+  const firstMs = p4.firstSessionSeconds > 0 ? `${p4.firstSessionSeconds} * 1000` : null;
   const proactiveLines = [];
-  if (p3.rageClick) proactiveLines.push(`    rageClick: true,`);
-  if (p3.longTask) proactiveLines.push(`    longTask: true,`);
-  if (p3.apiCascade) proactiveLines.push(`    apiCascade: true,`);
-  if (p3.errorBoundary) proactiveLines.push(`    errorBoundary: true,`);
-  if (dwellMs) proactiveLines.push(`    pageDwell: { thresholdMs: ${dwellMs} }, // ${p3.pageDwellMinutes}min on the same route`);
-  if (firstMs) proactiveLines.push(`    firstSession: { delayMs: ${firstMs} }, // welcome new users after ${p3.firstSessionSeconds}s`);
+  if (p4.rageClick) proactiveLines.push(`    rageClick: true,`);
+  if (p4.longTask) proactiveLines.push(`    longTask: true,`);
+  if (p4.apiCascade) proactiveLines.push(`    apiCascade: true,`);
+  if (p4.errorBoundary) proactiveLines.push(`    errorBoundary: true,`);
+  if (dwellMs) proactiveLines.push(`    pageDwell: { thresholdMs: ${dwellMs} }, // ${p4.pageDwellMinutes}min on the same route`);
+  if (firstMs) proactiveLines.push(`    firstSession: { delayMs: ${firstMs} }, // welcome new users after ${p4.firstSessionSeconds}s`);
   proactiveLines.push(`    cooldown: {`);
-  proactiveLines.push(`      maxProactivePerSession: ${p3.maxProactivePerSession},`);
-  proactiveLines.push(`      dismissCooldownHours: ${p3.dismissCooldownHours},`);
-  proactiveLines.push(`      suppressAfterDismissals: ${p3.suppressAfterDismissals},`);
+  proactiveLines.push(`      maxProactivePerSession: ${p4.maxProactivePerSession},`);
+  proactiveLines.push(`      dismissCooldownHours: ${p4.dismissCooldownHours},`);
+  proactiveLines.push(`      suppressAfterDismissals: ${p4.suppressAfterDismissals},`);
   proactiveLines.push(`    },`);
   const widgetLines = [];
-  if (p3.featureRequestCard) widgetLines.push(`    featureRequestCard: true,`);
-  if (p3.betaMode) {
+  if (p4.featureRequestCard) widgetLines.push(`    featureRequestCard: true,`);
+  if (p4.betaMode) {
     widgetLines.push(`    betaMode: {`);
     widgetLines.push(`      enabled: true,`);
     widgetLines.push(`      label: 'BETA',`);
@@ -4679,23 +4936,23 @@ function renderNudgeSnippet(opts) {
   ].join("\n");
 }
 function renderNudgeExplainer(phase) {
-  const p3 = PRESETS[phase];
+  const p4 = PRESETS[phase];
   const lines = [];
   lines.push(``);
   lines.push(`Nudge preset for "${phase}" phase:`);
-  lines.push(`  - max ${p3.maxProactivePerSession} proactive prompts per session`);
-  lines.push(`  - ${p3.dismissCooldownHours}h cooldown after a dismissal`);
-  lines.push(`  - suppress permanently after ${p3.suppressAfterDismissals} consecutive dismissals`);
-  if (p3.pageDwellMinutes > 0) lines.push(`  - fire page-dwell trigger after ${p3.pageDwellMinutes} continuous minutes on a route`);
-  if (p3.firstSessionSeconds > 0) lines.push(`  - welcome new users with a button pulse ${p3.firstSessionSeconds}s after init`);
+  lines.push(`  - max ${p4.maxProactivePerSession} proactive prompts per session`);
+  lines.push(`  - ${p4.dismissCooldownHours}h cooldown after a dismissal`);
+  lines.push(`  - suppress permanently after ${p4.suppressAfterDismissals} consecutive dismissals`);
+  if (p4.pageDwellMinutes > 0) lines.push(`  - fire page-dwell trigger after ${p4.pageDwellMinutes} continuous minutes on a route`);
+  if (p4.firstSessionSeconds > 0) lines.push(`  - welcome new users with a button pulse ${p4.firstSessionSeconds}s after init`);
   lines.push(`  - signals enabled: ${[
-    p3.rageClick && "rage-click",
-    p3.longTask && "long-task",
-    p3.apiCascade && "api-cascade",
-    p3.errorBoundary && "error-boundary"
+    p4.rageClick && "rage-click",
+    p4.longTask && "long-task",
+    p4.apiCascade && "api-cascade",
+    p4.errorBoundary && "error-boundary"
   ].filter(Boolean).join(", ")}`);
-  lines.push(`  - feature-request card: ${p3.featureRequestCard ? "shown" : "hidden"}`);
-  lines.push(`  - beta-mode UI: ${p3.betaMode ? "on" : "off"}`);
+  lines.push(`  - feature-request card: ${p4.featureRequestCard ? "shown" : "hidden"}`);
+  lines.push(`  - beta-mode UI: ${p4.betaMode ? "on" : "off"}`);
   lines.push(``);
   return lines.join("\n");
 }
@@ -4750,14 +5007,14 @@ async function planUpgrade(cwd) {
   const root = resolve2(cwd);
   const pkg = readPackageJson(root);
   const pm = detectPackageManager(root);
-  const deps = {
+  const deps2 = {
     ...pkg?.dependencies ?? {},
     ...pkg?.devDependencies ?? {}
   };
-  const installed = MUSHI_PACKAGES.filter((name) => deps[name]);
+  const installed = MUSHI_PACKAGES.filter((name) => deps2[name]);
   const entries = await Promise.all(
     installed.map(async (name) => {
-      const current = deps[name] ?? "";
+      const current = deps2[name] ?? "";
       const currentCore = current.replace(/^[\^~>=<]*/, "");
       if (!/^\d/.test(currentCore)) {
         return { name, current, latest: null, willUpgrade: false };
@@ -5343,7 +5600,7 @@ function spendDownStatusLine(k) {
   const name = `${k.label ?? "(no label)"} ${k.keyHint ?? ""}`.trim();
   const expires = k.creditsExpireAt ? k.creditsExpireAt.slice(0, 10) : "not set";
   const model = k.model ?? "app default";
-  const apps = k.projects.length > 0 ? k.projects.map((p3) => p3.name).join(", ") : "none";
+  const apps = k.projects.length > 0 ? k.projects.map((p4) => p4.name).join(", ") : "none";
   return `${name} [${k.scope}] ${k.state} \xB7 ${k.dispatchedToday}/${k.dailyLimit} today \xB7 credits expire ${expires} \xB7 model ${model} \xB7 pays for ${apps} \u2014 ${k.id}`;
 }
 
@@ -5376,8 +5633,9 @@ function registerKeysCommands(program2) {
           const lastUsed = k.last_used_at ? ` used=${new Date(k.last_used_at).toISOString()}` : "";
           const baseUrl = k.base_url ? ` base=${k.base_url}` : "";
           const hint = k.key_hint ? ` hint=${k.key_hint}` : "";
+          const scope = ` scope=${k.scope ?? "project"}`;
           console.log(
-            `${k.provider_slug.padEnd(14)} [${k.status}]${validation} p=${k.priority} ${k.label ?? "(no label)"}${hint}${baseUrl}${cooldown}${lastTested}${lastUsed} created=${new Date(k.created_at).toISOString()} \u2014 ${k.id}`
+            `${k.provider_slug.padEnd(14)} [${k.status}]${validation} p=${k.priority}${scope} ${k.label ?? "(no label)"}${hint}${baseUrl}${cooldown}${lastTested}${lastUsed} created=${new Date(k.created_at).toISOString()} \u2014 ${k.id}`
           );
         }
         for (const k of legacyKeys) {
@@ -5459,7 +5717,9 @@ function registerKeysCommands(program2) {
       }
     );
   });
-  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, openrouter, firecrawl, browserbase, cursor, supabase").option(
+  keys.command("add").description(
+    "Add a new API key to this app (keys for every app in the organization, or every app you own, are added in the console)"
+  ).requiredOption("--provider <p>", "Provider: anthropic, openai, openrouter, firecrawl, browserbase, cursor, supabase").option(
     "--key <k>",
     "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)"
   ).option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").option("--base-url <url>", "Allow-listed OpenAI-compatible HTTPS base URL").action(
@@ -5872,54 +6132,6 @@ Recent runs for story ${storyId.slice(0, 8)}\u2026:
   });
 }
 
-// src/command-helpers.ts
-function orgSegment(org) {
-  if (!org || org === "current") return "current";
-  return encodeURIComponent(requireUuid(org, "organization id"));
-}
-function dieOrgError(result) {
-  const { code } = result.error;
-  if (code === "ORG_REQUIRED") {
-    const orgs = Array.isArray(result.error["organizations"]) ? result.error["organizations"] : [];
-    if (orgs.length > 0) {
-      process.stderr.write("\n  Pick one and pass it with --org:\n");
-      for (const o of orgs) {
-        process.stderr.write(`    --org ${String(o.id)}   ${typeof o.name === "string" ? o.name : ""}
-`);
-      }
-      process.stderr.write("\n");
-    }
-  } else if (code.endsWith("_NEEDS_ACCOUNT_KEY")) {
-    process.stderr.write(
-      "\n  Team-wide views need an account-level key, not a key bound to one project.\n  Mint one in the console (Connect \u2192 MCP \u2192 account key), then:\n\n    MUSHI_API_KEY=<account key> mushi <command>\n\n"
-    );
-  }
-  die(result);
-}
-function requireYes(yes, action) {
-  if (yes) return;
-  throw new MushiCliError(
-    "E_INVALID_INPUT",
-    `${action} Re-run with --yes to go ahead.`,
-    "nothing was sent"
-  );
-}
-function resolveProjectId(flag, configured) {
-  const raw = flag ?? configured;
-  if (!raw) {
-    throw new MushiCliError(
-      "E_PROJECT_MISSING",
-      "Project ID not configured.",
-      "pass --project-id <uuid> or run `mushi login --project-id <uuid>`"
-    );
-  }
-  return requireUuid(raw, "project id");
-}
-function oneLine(text2, max = 80) {
-  const flat = String(text2 ?? "").replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
-  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
-}
-
 // src/commands/audit.ts
 var KNOWN_GATES = [
   "dead_handler",
@@ -7011,10 +7223,10 @@ var REPO_SCAN_PATHS = [
   ".github/workflows/"
 ];
 function isRepoScanPath(path) {
-  const p3 = normalizePath(path);
-  if (REPO_SCAN_PATHS.includes(p3)) return true;
-  if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(p3)) return true;
-  return /^ios\/(?:[^/]+\/)?[^/]+\.xcodeproj\/project\.pbxproj$/.test(p3);
+  const p4 = normalizePath(path);
+  if (REPO_SCAN_PATHS.includes(p4)) return true;
+  if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(p4)) return true;
+  return /^ios\/(?:[^/]+\/)?[^/]+\.xcodeproj\/project\.pbxproj$/.test(p4);
 }
 function normalizePath(path) {
   return path.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -7274,7 +7486,7 @@ function bundleRootsFromFlags(root, dirs) {
   }
   return [...new Set(roots)].sort();
 }
-function scanBuiltBundles(root, readFile3 = (p3) => readFileSync3(p3, "utf8"), bundleDirs) {
+function scanBuiltBundles(root, readFile3 = (p4) => readFileSync3(p4, "utf8"), bundleDirs) {
   const roots = bundleDirs && bundleDirs.length > 0 ? bundleRootsFromFlags(root, bundleDirs) : findBundleRoots(root);
   const out = { roots, scannedFiles: 0, truncated: false, unreadable: 0, findings: [] };
   const walk2 = (dir) => {
@@ -7319,7 +7531,7 @@ function scanBuiltBundles(root, readFile3 = (p3) => readFileSync3(p3, "utf8"), b
   for (const r of roots) walk2(join5(root, r));
   return out;
 }
-function scanLocalRepo(root, readFile3 = (p3) => readFileSync3(p3, "utf8"), opts = {}) {
+function scanLocalRepo(root, readFile3 = (p4) => readFileSync3(p4, "utf8"), opts = {}) {
   const { files, truncated, unreadable: unreadableDirs } = listRepoFiles(root);
   let unreadable = unreadableDirs;
   const findings = [];
@@ -7509,8 +7721,8 @@ function toHex(c) {
 function num(token, scale) {
   const t = token.trim();
   if (t === "none") return 0;
-  const pct = /^(-?[\d.]+)%$/.exec(t);
-  if (pct) return Number(pct[1]) / 100 * scale;
+  const pct2 = /^(-?[\d.]+)%$/.exec(t);
+  if (pct2) return Number(pct2[1]) / 100 * scale;
   const deg = /^(-?[\d.]+)(deg|turn|rad|grad)?$/.exec(t);
   if (!deg) return null;
   const v = Number(deg[1]);
@@ -7529,7 +7741,7 @@ function num(token, scale) {
 function splitArgs(body) {
   const [main, alpha] = body.split("/");
   const parts = main.includes(",") ? main.split(",") : main.trim().split(/\s+/);
-  const cleaned = parts.map((p3) => p3.trim()).filter(Boolean);
+  const cleaned = parts.map((p4) => p4.trim()).filter(Boolean);
   if (alpha === void 0 && cleaned.length === 4) return { parts: cleaned.slice(0, 3), alpha: cleaned[3] };
   return { parts: cleaned, alpha: alpha?.trim() ?? null };
 }
@@ -7578,7 +7790,7 @@ function parseCssColor(input) {
   if (parts.length !== 3) return null;
   const a = alphaOf(alpha);
   if (kind === "rgb" || kind === "rgba") {
-    const ch = parts.map((p3) => num(p3, 255));
+    const ch = parts.map((p4) => num(p4, 255));
     if (ch.some((v) => v == null)) return null;
     const [r2, g2, b2] = ch;
     return { r: clamp01(r2 / 255), g: clamp01(g2 / 255), b: clamp01(b2 / 255), a };
@@ -7898,7 +8110,7 @@ function normalizeTokenSet(files) {
     };
     const norm = r ? normalizeByType(type, r.value, note2) : { value: null, display: alias ? `{${alias}} (unresolved)` : "unresolved", hex: null, px: null };
     const ext = tok.ext;
-    const str = (k) => ext && typeof ext[k] === "string" ? ext[k] : null;
+    const str2 = (k) => ext && typeof ext[k] === "string" ? ext[k] : null;
     tokens.push({
       path: tok.path,
       type,
@@ -7907,9 +8119,9 @@ function normalizeTokenSet(files) {
       hex: norm.hex,
       px: norm.px,
       aliasOf: alias,
-      cssVar: str("cssVar"),
-      ts: str("ts"),
-      rn: str("rn"),
+      cssVar: str2("cssVar"),
+      ts: str2("ts"),
+      rn: str2("rn"),
       description: tok.description,
       file: tok.file,
       role: tok.role,
@@ -7936,13 +8148,13 @@ function declaredFontFamilies(tokens) {
 // src/recipe/engine/recipe-glob.ts
 function normalizeRepoPath(input) {
   if (typeof input !== "string") return null;
-  const p3 = input.trim();
-  if (p3.length === 0 || p3.length > 512) return null;
-  if (p3.startsWith("/") || p3.startsWith("~")) return null;
-  if (p3.includes("\\") || p3.includes("%")) return null;
-  if (/^[A-Za-z]:/.test(p3)) return null;
-  if (/[\u0000-\u001f\u007f]/.test(p3)) return null;
-  const segments = p3.split("/");
+  const p4 = input.trim();
+  if (p4.length === 0 || p4.length > 512) return null;
+  if (p4.startsWith("/") || p4.startsWith("~")) return null;
+  if (p4.includes("\\") || p4.includes("%")) return null;
+  if (/^[A-Za-z]:/.test(p4)) return null;
+  if (/[\u0000-\u001f\u007f]/.test(p4)) return null;
+  const segments = p4.split("/");
   for (const seg of segments) {
     if (seg === "" || seg === "." || seg === "..") return null;
   }
@@ -8313,13 +8525,13 @@ function stripBraces(ref) {
 }
 function evaluateContrast(tokens, pairs) {
   const byPath = new Map(tokens.map((t) => [t.path, t]));
-  return pairs.map((p3) => {
-    const fgPath = stripBraces(p3.fg);
-    const bgPath = stripBraces(p3.bg);
-    const min = p3.min ?? (p3.large ? 3 : 4.5);
+  return pairs.map((p4) => {
+    const fgPath = stripBraces(p4.fg);
+    const bgPath = stripBraces(p4.bg);
+    const min = p4.min ?? (p4.large ? 3 : 4.5);
     const fg = byPath.get(fgPath);
     const bg = byPath.get(bgPath);
-    const base = { fg: fgPath, bg: bgPath, min, use: p3.use ?? null };
+    const base = { fg: fgPath, bg: bgPath, min, use: p4.use ?? null };
     const fc = fg?.hex ? parseCssColor(fg.hex) : null;
     const bc = bg?.hex ? parseCssColor(bg.hex) : null;
     if (!fc || !bc) {
@@ -8346,7 +8558,7 @@ function contrastFindings(results, tokens, rule) {
 }
 function computeDevianceScore(input) {
   const kloc = Math.max(1, input.scannedLines / 1e3);
-  let num2 = 0;
+  let num3 = 0;
   let den = 0;
   const breakdown = input.rules.map((r) => {
     const count = input.counts[r.id] ?? 0;
@@ -8368,12 +8580,12 @@ function computeDevianceScore(input) {
       }
     }
     if (r.enabled && applicable) {
-      num2 += weight * penalty;
+      num3 += weight * penalty;
       den += weight;
     }
     return { rule: r.id, enabled: r.enabled, applicable, severity: r.severity, weight, count, density, penalty: Math.round(penalty * 1e3) / 1e3 };
   });
-  return { score: den === 0 ? null : Math.round(100 * num2 / den), breakdown };
+  return { score: den === 0 ? null : Math.round(100 * num3 / den), breakdown };
 }
 var SEVERITY_ORDER = { error: 0, warn: 1, info: 2 };
 function sortFindings(findings) {
@@ -8449,19 +8661,19 @@ function planTokenSets(declared, treePaths, directions = []) {
   if (directions.length > 0) {
     for (const d of directions) {
       if (d.status !== "inactive" || d.name === activeName) continue;
-      const files = d.tokens.map((p3) => normalizeRepoPath(p3)).filter((p3) => p3 !== null);
+      const files = d.tokens.map((p4) => normalizeRepoPath(p4)).filter((p4) => p4 !== null);
       sets.push({ name: d.name, kind: "direction", active: false, files: files.map((path) => ({ path, role: "source", generator: null })), note: d.note ?? null });
     }
   } else if (sameDirection) {
     const base = dirs[0].base;
     const siblings = /* @__PURE__ */ new Map();
-    for (const p3 of treePaths) {
-      if (!p3.startsWith(base)) continue;
-      const d = directionOf(p3);
+    for (const p4 of treePaths) {
+      if (!p4.startsWith(base)) continue;
+      const d = directionOf(p4);
       if (!d || d.base !== base || d.name === activeName) continue;
       if (!/\.tokens\.json$|^tokens\.json$/.test(d.file)) continue;
       const list = siblings.get(d.name) ?? [];
-      list.push(p3);
+      list.push(p4);
       siblings.set(d.name, list);
     }
     for (const name of [...siblings.keys()].sort()) {
@@ -8516,10 +8728,22 @@ var ALWAYS_IGNORE = [
   "**/android/**",
   "**/ios/**"
 ];
+var DEFAULT_TOKEN_DEFINITION_GLOBS = [
+  "**/theme-tokens.css",
+  "**/base-and-density.css",
+  "**/vizTokens.ts",
+  "**/tokens.ts",
+  "**/tokens.css",
+  "**/*.tokens.json"
+];
+function tokenDefinitionGlobs(manifest) {
+  const declared = manifest?.design?.literalScan?.tokenDefinitions;
+  return Array.isArray(declared) ? [...declared] : [...DEFAULT_TOKEN_DEFINITION_GLOBS];
+}
 function selectScanFiles(entries, manifest, excludePaths, limits = SCAN_LIMITS) {
   const declared = manifest?.design?.literalScan?.globs;
   const globs = declared && declared.length > 0 ? [...declared] : DEFAULT_SCAN_GLOBS;
-  const ignore = [...ALWAYS_IGNORE, ...manifest?.design?.literalScan?.ignore ?? []];
+  const ignore = [...ALWAYS_IGNORE, ...tokenDefinitionGlobs(manifest), ...manifest?.design?.literalScan?.ignore ?? []];
   const matched = entries.filter((e) => matchAny(e.path, globs) && !matchAny(e.path, ignore) && !excludePaths.includes(e.path) && e.size <= limits.maxFileBytes).sort((a, b) => a.path < b.path ? -1 : 1);
   const files = [];
   let bytes = 0;
@@ -8699,16 +8923,16 @@ function readContrast(raw, issues) {
     return void 0;
   }
   const out = [];
-  raw.forEach((p3, i) => {
-    if (!isObject(p3) || !isString(p3.fg) || !isString(p3.bg) || !p3.fg || !p3.bg) {
+  raw.forEach((p4, i) => {
+    if (!isObject(p4) || !isString(p4.fg) || !isString(p4.bg) || !p4.fg || !p4.bg) {
       issues.push({ severity: "error", message: `design.contrast[${i}] needs fg and bg token paths.` });
       return;
     }
-    const pair = { fg: p3.fg, bg: p3.bg };
-    if (typeof p3.min === "number" && p3.min >= 1 && p3.min <= 21) pair.min = p3.min;
-    else if (p3.min !== void 0) issues.push({ severity: "error", message: `design.contrast[${i}].min must be a ratio from 1 to 21.` });
-    if (typeof p3.large === "boolean") pair.large = p3.large;
-    if (isString(p3.use)) pair.use = p3.use;
+    const pair = { fg: p4.fg, bg: p4.bg };
+    if (typeof p4.min === "number" && p4.min >= 1 && p4.min <= 21) pair.min = p4.min;
+    else if (p4.min !== void 0) issues.push({ severity: "error", message: `design.contrast[${i}].min must be a ratio from 1 to 21.` });
+    if (typeof p4.large === "boolean") pair.large = p4.large;
+    if (isString(p4.use)) pair.use = p4.use;
     out.push(pair);
   });
   return out;
@@ -8756,10 +8980,14 @@ function readScanManifest(manifest) {
   }
   if (d.literalScan !== void 0) {
     const ls = d.literalScan;
-    if (!isObject(ls) || ls.globs !== void 0 && !isStringList(ls.globs) || ls.ignore !== void 0 && !isStringList(ls.ignore)) {
-      issues.push({ severity: "error", message: "design.literalScan.globs and .ignore must be lists of file globs." });
+    if (!isObject(ls) || ls.globs !== void 0 && !isStringList(ls.globs) || ls.ignore !== void 0 && !isStringList(ls.ignore) || ls.tokenDefinitions !== void 0 && !isStringList(ls.tokenDefinitions)) {
+      issues.push({ severity: "error", message: "design.literalScan.globs, .ignore and .tokenDefinitions must be lists of file globs." });
     } else {
-      design.literalScan = { ...ls.globs ? { globs: ls.globs } : {}, ...ls.ignore ? { ignore: ls.ignore } : {} };
+      design.literalScan = {
+        ...ls.globs ? { globs: ls.globs } : {},
+        ...ls.ignore ? { ignore: ls.ignore } : {},
+        ...ls.tokenDefinitions ? { tokenDefinitions: ls.tokenDefinitions } : {}
+      };
     }
   }
   const contrast = readContrast(d.contrast, issues);
@@ -8807,10 +9035,10 @@ function listRepoFiles2(root) {
     paths = walk(root);
   }
   const entries = [];
-  for (const p3 of paths) {
+  for (const p4 of paths) {
     try {
-      const st = statSync3(join6(root, p3));
-      if (st.isFile()) entries.push({ path: p3, size: st.size });
+      const st = statSync3(join6(root, p4));
+      if (st.isFile()) entries.push({ path: p4, size: st.size });
     } catch {
     }
   }
@@ -8862,7 +9090,7 @@ function workspacePatterns(root, pkg) {
   const out = [];
   const ws = pkg?.workspaces;
   const list = Array.isArray(ws) ? ws : isObject2(ws) && Array.isArray(ws.packages) ? ws.packages : [];
-  for (const p3 of list) if (typeof p3 === "string") out.push(p3);
+  for (const p4 of list) if (typeof p4 === "string") out.push(p4);
   const yaml = readCapped(root, "pnpm-workspace.yaml");
   if (yaml) {
     let inPackages = false;
@@ -8876,7 +9104,7 @@ function workspacePatterns(root, pkg) {
       if (item) out.push(item[1]);
     }
   }
-  return out.map((p3) => p3.trim().replace(/^\.\//, "").replace(/\/+$/, "")).filter(Boolean);
+  return out.map((p4) => p4.trim().replace(/^\.\//, "").replace(/\/+$/, "")).filter(Boolean);
 }
 function scriptRunner(files) {
   if (files.has("pnpm-lock.yaml")) return "pnpm";
@@ -8919,25 +9147,25 @@ function starterManifest(root) {
   const files = tracked.length ? tracked : walk(root);
   const fileSet = new Set(files);
   const pkg = readJson(join6(root, "package.json"));
-  const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
+  const deps2 = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
   const rootScripts = Object.entries(pkg?.scripts ?? {}).filter((e) => typeof e[1] === "string");
-  const native = files.some((f) => /^capacitor\.config\.(ts|js|json)$/.test(f)) || "expo" in deps || "react-native" in deps || files.some((f) => f.startsWith("android/") || f.startsWith("ios/"));
-  const platforms = ["web", ...files.some((f) => f.startsWith("android/")) || "expo" in deps ? ["android"] : [], ...files.some((f) => f.startsWith("ios/")) || "expo" in deps ? ["ios"] : []];
+  const native = files.some((f) => /^capacitor\.config\.(ts|js|json)$/.test(f)) || "expo" in deps2 || "react-native" in deps2 || files.some((f) => f.startsWith("android/") || f.startsWith("ios/"));
+  const platforms = ["web", ...files.some((f) => f.startsWith("android/")) || "expo" in deps2 ? ["android"] : [], ...files.some((f) => f.startsWith("ios/")) || "expo" in deps2 ? ["ios"] : []];
   const archived = files.filter((f) => f.endsWith("/ARCHIVED.md")).map((f) => f.slice(0, -"/ARCHIVED.md".length));
   const isArchived = (f) => archived.some((d) => f.startsWith(`${d}/`));
   const live = (f) => !FIXTURE_DIR.test(f) && !isArchived(f);
   const tokenPaths = files.filter((f) => live(f) && (/\.tokens\.json$/.test(f) || /(^|\/)dtcg\/[^/]+\.json$/.test(f))).slice(0, 20);
   const workflows = files.filter((f) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(f));
   const hasSource = (dir, ext) => files.some((f) => f.startsWith(`${dir}/`) && live(f) && ext.test(f));
-  const rootIsApp = files.some((f) => /^(next|vite)\.config\.(js|mjs|cjs|ts|mts)$/.test(f)) || "expo" in deps || rootScripts.some(([name]) => name === "dev" || name === "build");
+  const rootIsApp = files.some((f) => /^(next|vite)\.config\.(js|mjs|cjs|ts|mts)$/.test(f)) || "expo" in deps2 || rootScripts.some(([name]) => name === "dev" || name === "build");
   const rootDirs = rootIsApp ? ROOT_APP_DIRS.filter((d) => hasSource(d, /\.(ts|tsx|css)$/)) : [];
   const patterns = workspacePatterns(root, pkg);
   let packageRoots;
   if (patterns.length) {
-    const include = patterns.filter((p3) => !p3.startsWith("!"));
-    const exclude = patterns.filter((p3) => p3.startsWith("!")).map((p3) => p3.slice(1));
+    const include = patterns.filter((p4) => !p4.startsWith("!"));
+    const exclude = patterns.filter((p4) => p4.startsWith("!")).map((p4) => p4.slice(1));
     const pkgDirs = [...new Set(files.filter((f) => f.endsWith("/package.json") && !f.includes("node_modules/")).map((f) => f.slice(0, -"/package.json".length)))];
-    packageRoots = pkgDirs.filter((d) => !isArchived(`${d}/`) && include.some((p3) => matchGlob(d, p3)) && !exclude.some((p3) => matchGlob(d, p3))).sort().flatMap((d) => hasSource(`${d}/src`, /\.(tsx|css)$/) ? [`${d}/src`] : hasSource(d, /\.(tsx|css)$/) ? [d] : []);
+    packageRoots = pkgDirs.filter((d) => !isArchived(`${d}/`) && include.some((p4) => matchGlob(d, p4)) && !exclude.some((p4) => matchGlob(d, p4))).sort().flatMap((d) => hasSource(`${d}/src`, /\.(tsx|css)$/) ? [`${d}/src`] : hasSource(d, /\.(tsx|css)$/) ? [d] : []);
   } else {
     packageRoots = [...new Set(files.filter((f) => live(f) && /^(apps|packages)\/[^/]+\/src\/.+\.(tsx|css)$/.test(f)).map((f) => f.split("/").slice(0, 3).join("/")))];
   }
@@ -8972,7 +9200,7 @@ function starterManifest(root) {
       }))
     };
   }
-  const envExample = ENV_EXAMPLES.find((p3) => existsSync3(join6(root, p3)));
+  const envExample = ENV_EXAMPLES.find((p4) => existsSync3(join6(root, p4)));
   if (envExample) manifest.env = { environments: ["production"], required: [], example: envExample };
   const sourceDirs = tokens.filter((t) => t.role === "source").map((t) => `${t.path.split("/").slice(0, -1).join("/") || "."}/**`);
   manifest.change = { allowPaths: [MANIFEST, ...new Set(sourceDirs)] };
@@ -9010,11 +9238,11 @@ function checkRecipe(root) {
   const manifest = parsed;
   files[MANIFEST] = text2;
   const change = isObject2(manifest.change) ? manifest.change : {};
-  for (const p3 of asStringList(change.allowPaths)) {
-    if (p3.startsWith(".github") || /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|[^/]*\.lock)$/.test(p3)) {
-      issues.push({ severity: "error", message: `change.allowPaths entry "${p3}" points at files Mushi never writes (workflows, lockfiles).`, path: MANIFEST });
+  for (const p4 of asStringList(change.allowPaths)) {
+    if (p4.startsWith(".github") || /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|[^/]*\.lock)$/.test(p4)) {
+      issues.push({ severity: "error", message: `change.allowPaths entry "${p4}" points at files Mushi never writes (workflows, lockfiles).`, path: MANIFEST });
     }
-    if (/(^|\/)\.env(?!\.example)/.test(p3)) issues.push({ severity: "error", message: `change.allowPaths entry "${p3}" would let a PR touch env files.`, path: MANIFEST });
+    if (/(^|\/)\.env(?!\.example)/.test(p4)) issues.push({ severity: "error", message: `change.allowPaths entry "${p4}" would let a PR touch env files.`, path: MANIFEST });
   }
   const shaped = readScanManifest(manifest);
   issues.push(...shaped.issues);
@@ -9029,14 +9257,14 @@ function checkRecipe(root) {
   const judged = judgingSet(tokens);
   const tokenCount = judged?.tokens.length ?? 0;
   let pushedBytes = text2.length;
-  const addPush = (p3) => {
-    if (files[p3] !== void 0 || Object.keys(files).length >= PUSH_MAX_FILES) return;
-    const f = read(p3, PUSH_MAX_FILE_BYTES);
+  const addPush = (p4) => {
+    if (files[p4] !== void 0 || Object.keys(files).length >= PUSH_MAX_FILES) return;
+    const f = read(p4, PUSH_MAX_FILE_BYTES);
     if (f.kind !== "file" || pushedBytes + f.text.length > PUSH_MAX_TOTAL_BYTES) return;
-    files[p3] = f.text;
+    files[p4] = f.text;
     pushedBytes += f.text.length;
   };
-  for (const p3 of tokenFilePaths(tokens)) addPush(p3);
+  for (const p4 of tokenFilePaths(tokens)) addPush(p4);
   const design = isObject2(manifest.design) ? manifest.design : {};
   for (const c of Array.isArray(design.css) ? design.css : []) {
     const rel = isObject2(c) && typeof c.path === "string" ? normalizeRepoPath(c.path) : null;
@@ -9047,9 +9275,9 @@ function checkRecipe(root) {
   if (judged) {
     const pick = selectScanFiles(tree, scanManifest, [...tokenFilePaths(tokens), MANIFEST]);
     const texts = /* @__PURE__ */ new Map();
-    for (const p3 of pick.files) {
-      const f = read(p3, Number.POSITIVE_INFINITY);
-      texts.set(p3, f.kind === "file" ? f.text : null);
+    for (const p4 of pick.files) {
+      const f = read(p4, Number.POSITIVE_INFINITY);
+      texts.set(p4, f.kind === "file" ? f.text : null);
     }
     const result = computeDeviance({ manifest: scanManifest, tokens }, texts);
     findings = result.findings;
@@ -9623,7 +9851,7 @@ function registerPortfolioCommands(program2) {
   groups.command("set <groupId> [projectIds...]").description("Set exactly which apps are in a group (team owners and admins); no ids empties it").option(ORG_HELP, ORG_DESC).action(async (groupId, projectIds, opts) => {
     const config = requireConfig();
     const gid = requireUuid(groupId, "group id");
-    const ids = (projectIds ?? []).map((p3) => requireUuid(p3, "project id"));
+    const ids = (projectIds ?? []).map((p4) => requireUuid(p4, "project id"));
     const result = await apiCall(
       `/v1/admin/orgs/${orgSegment(opts.org)}/project-groups/${gid}/projects`,
       config,
@@ -10425,16 +10653,16 @@ function registerRepoCommands(program2) {
     const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const preview = await apiCall(`/v1/admin/projects/${projectId2}/codebase/diagram/publish-preview`, config);
     if (!preview.ok) die(preview);
-    const p3 = preview.data;
-    if (!p3.can_publish) {
-      throw new MushiCliError("E_INVALID_INPUT", p3.publish_blocked_reason ?? "This diagram cannot be published.", "publish it from the console instead");
+    const p4 = preview.data;
+    if (!p4.can_publish) {
+      throw new MushiCliError("E_INVALID_INPUT", p4.publish_blocked_reason ?? "This diagram cannot be published.", "publish it from the console instead");
     }
-    console.log(`Will publish to ${p3.url}${p3.repo_private ? " (the repo is private on GitHub)" : ""}.`);
+    console.log(`Will publish to ${p4.url}${p4.repo_private ? " (the repo is private on GitHub)" : ""}.`);
     requireYes(opts.yes, "Publishing makes the diagram public.");
     const result = await apiCall(
       `/v1/admin/projects/${projectId2}/codebase/diagram/publish`,
       config,
-      { method: "POST", body: JSON.stringify({ diagram_id: p3.diagram_id, payload_hash: p3.payload_hash }) },
+      { method: "POST", body: JSON.stringify({ diagram_id: p4.diagram_id, payload_hash: p4.payload_hash }) },
       { timeoutMs: PUBLISH_TIMEOUT_MS2 }
     );
     if (!result.ok) die(result);
@@ -10653,6 +10881,15 @@ function parseOnOff(raw, flag) {
   if (v === "off" || v === "false" || v === "no") return false;
   throw new MushiCliError("E_INVALID_INPUT", `${flag} must be on or off`);
 }
+function renderFindingsDispatch(r) {
+  if (r.action === "no_scan") return ["No finished design scan yet. Run one first (mushi recipe check --push, or the console)."];
+  if (r.action === "budget_reached") return [`Nothing sent: ${r.reason ?? "the app's auto-fix limits are reached for today"}`];
+  const sent = r.sent ?? [];
+  const lines = sent.length === 0 ? ["Nothing to send: every file with findings already has an open report."] : sent.map((s) => `${s.refused ? "\u2717" : "\u2713"} ${s.file}: ${s.findings} finding(s) \u2192 report ${s.reportId}${s.refused ? ` (not dispatched: ${s.refused.message ?? s.refused.code ?? "refused"})` : ""}`);
+  if ((r.remainingFiles ?? 0) > 0) lines.push(`${r.remainingFiles} more file(s) left; run it again to send the next batch.`);
+  if ((r.skipped?.tokenDefinition ?? 0) > 0) lines.push(`${r.skipped.tokenDefinition} finding(s) in token-definition files were left out.`);
+  return lines;
+}
 function renderSettings(s) {
   const lines = [
     `Threshold: ${s.threshold} (the actions below fire when the design score is above it)`,
@@ -10696,6 +10933,23 @@ function registerDesignCommands(program2) {
     console.log("Saved.");
     for (const line of renderSettings(result.data)) console.log(line);
   });
+  design.command("dispatch-findings").description("Send the latest scan's design findings to an agent: one report per file, a few files per call (owners and admins; auto-fix must be on)").option("--max-files <n>", "Files to send in this call, 1-20 (default 5)").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const body = {};
+    if (opts.maxFiles !== void 0) {
+      const n = Number(opts.maxFiles);
+      if (!Number.isInteger(n) || n < 1 || n > 20) throw new MushiCliError("E_INVALID_INPUT", "--max-files must be a whole number from 1 to 20");
+      body.maxFiles = n;
+    }
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${pid}/design/dispatch-findings`, config, { method: "POST", body: JSON.stringify(body) });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderFindingsDispatch(result.data)) console.log(line);
+  });
 }
 
 // src/commands/ux.ts
@@ -10714,7 +10968,7 @@ function uxCommandLine(args, env = process.env, platform = process.platform, npx
   const local = env.MUSHI_UX_BIN?.trim();
   if (local) return { cmd: process.execPath, argv: [local, ...args], shell: false };
   const npxArgs = ["--yes", "--package", UX_PACKAGE, "mushi-ux", ...args];
-  const found = (typeof npxCli === "string" ? [npxCli] : npxCli).find((p3) => hasFile(p3));
+  const found = (typeof npxCli === "string" ? [npxCli] : npxCli).find((p4) => hasFile(p4));
   if (found) return { cmd: process.execPath, argv: [found, ...npxArgs], shell: false };
   if (platform === "win32") return { cmd: "npx", argv: npxArgs.map(cmdQuote), shell: true };
   return { cmd: "npx", argv: npxArgs, shell: false };
@@ -10832,6 +11086,1963 @@ function registerUxRunsCommands(program2) {
   });
 }
 
+// src/commands/runner.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { accessSync, chmodSync, closeSync as closeSync2, constants as fsConstants, existsSync as existsSync6, fchownSync, fstatSync as fstatSync2, ftruncateSync, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync8, realpathSync, writeFileSync as writeFileSync5, writeSync } from "fs";
+import { arch as nodeArch, userInfo } from "os";
+import { dirname as dirname5, join as join12, resolve as resolve7 } from "path";
+import * as p3 from "@clack/prompts";
+
+// src/runner/hooks.ts
+var HOOKS_DIR_NAME = "mushi-hooks";
+var HOOK_ENV_STARTED = "ACTIONS_RUNNER_HOOK_JOB_STARTED";
+var HOOK_ENV_COMPLETED = "ACTIONS_RUNNER_HOOK_JOB_COMPLETED";
+function shSingleQuoted(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function hookScript(opts) {
+  if (!/^[0-9a-f]{64}$/.test(opts.hostId)) throw new Error("host id must be 64 hex characters");
+  if (!/^https?:\/\/[^\s'"]+$/.test(opts.endpoint)) throw new Error("endpoint must be an http(s) URL");
+  return `#!/bin/sh
+# Mushi runner job hook (job ${opts.phase}). Written by \`mushi runner hooks install\`.
+# Sends this job's memory peak, memory limit, out-of-memory kills, swap and
+# load to Mushi, so a job killed by the machine reads "test machine stopped",
+# not "your code failed". It never fails the job: it always exits 0.
+# The API key is read from ./key (mode 0600); it is never printed.
+
+PHASE=${opts.phase}
+ENDPOINT=${shSingleQuoted(opts.endpoint.replace(/\/+$/, ""))}
+HOST_ID=${opts.hostId}
+
+safe() { printf '%s' "$1" | tr -cd 'A-Za-z0-9._/-' | cut -c1-100; }
+safe_name() { printf '%s' "$1" | tr -cd 'A-Za-z0-9._/ -' | cut -c1-100; }
+digits() { printf '%s' "$1" | tr -cd '0-9' | cut -c1-20; }
+num_or_null() { case "$1" in ''|*[!0-9.]*) printf 'null' ;; *) printf '%s' "$1" ;; esac; }
+mb() { case "$1" in ''|max|*[!0-9]*) printf '' ;; *) printf '%s' $(( $1 / 1048576 )) ;; esac; }
+
+mushi_hook() {
+  HOOK_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) || return 0
+  [ -r "$HOOK_DIR/key" ] || return 0
+  command -v curl >/dev/null 2>&1 || return 0
+
+  CG=$(sed -n 's/^0:://p' /proc/self/cgroup 2>/dev/null | head -n 1)
+  CGDIR="/sys/fs/cgroup$CG"
+  PEAK=$(mb "$(cat "$CGDIR/memory.peak" 2>/dev/null)")
+  MAX=$(mb "$(cat "$CGDIR/memory.max" 2>/dev/null)")
+  if [ -z "$MAX" ]; then MAX=$(mb "$(cat "$(dirname "$CGDIR")/memory.max" 2>/dev/null)"); fi
+  OOM=$(sed -n 's/^oom_kill \\([0-9]*\\)$/\\1/p' "$CGDIR/memory.events" 2>/dev/null | head -n 1)
+  SWAP=$(awk '/^SwapTotal:/{t=$2} /^SwapFree:/{f=$2} END{if (t!="") printf "%d", (t-f)/1024}' /proc/meminfo 2>/dev/null)
+  LOAD=$(cut -d' ' -f1 /proc/loadavg 2>/dev/null)
+
+  REPO=$(safe "$GITHUB_REPOSITORY")
+  RUNNER=$(safe_name "$RUNNER_NAME")
+  JOB=$(safe "$GITHUB_JOB")
+  RUN_ID=$(digits "$GITHUB_RUN_ID")
+  ATTEMPT=$(digits "$GITHUB_RUN_ATTEMPT")
+  [ -n "$REPO" ] && [ -n "$RUN_ID" ] && [ -n "$JOB" ] || return 0
+  AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+  BODY=$(printf '{"kind":"job","host_id":"%s","runner_name":"%s","repo":"%s","run_id":%s,"run_attempt":%s,"job_key":"%s","phase":"%s","at":"%s","mem_peak_mb":%s,"mem_max_mb":%s,"oom_kills":%s,"swap_used_mb":%s,"load1":%s}' \\
+    "$HOST_ID" "$RUNNER" "$REPO" "$RUN_ID" "\${ATTEMPT:-1}" "$JOB" "$PHASE" "$AT" \\
+    "$(num_or_null "$PEAK")" "$(num_or_null "$MAX")" "$(num_or_null "$OOM")" "$(num_or_null "$SWAP")" "$(num_or_null "$LOAD")")
+
+  # The key goes to curl on stdin as a header (printf is a shell builtin, so
+  # it never appears in a process list).
+  printf 'X-Mushi-Api-Key: %s\\n' "$(cat "$HOOK_DIR/key")" | curl -sS --max-time 5 -o /dev/null \\
+    -H @- -H 'Content-Type: application/json' -X POST --data "$BODY" "$ENDPOINT/v1/ingest/runner"
+}
+
+mushi_hook >/dev/null 2>&1 || true
+exit 0
+`;
+}
+function mergeRunnerEnv(existing, hooks, force = false) {
+  const wanted = [
+    [HOOK_ENV_STARTED, hooks.started],
+    [HOOK_ENV_COMPLETED, hooks.completed]
+  ];
+  const lines = existing.length ? existing.replace(/\r\n/g, "\n").replace(/\n$/, "").split("\n") : [];
+  const conflicts = [];
+  let changed = false;
+  for (const [key, value] of wanted) {
+    const idx = lines.findIndex((l) => l.startsWith(`${key}=`));
+    if (idx === -1) {
+      lines.push(`${key}=${value}`);
+      changed = true;
+      continue;
+    }
+    const current = lines[idx].slice(key.length + 1);
+    if (current === value) continue;
+    if (!force) {
+      conflicts.push({ key, current });
+      continue;
+    }
+    lines[idx] = `${key}=${value}`;
+    changed = true;
+  }
+  return { text: changed && conflicts.length === 0 ? `${lines.join("\n")}
+` : null, conflicts };
+}
+
+// src/runner/key.ts
+var RUNNER_KEY_PATH = "/etc/mushi/runner.key";
+var RUNNER_KEY_CREDENTIAL = "runner-key";
+var LABEL_RE = /^[a-z0-9][a-z0-9-]{0,39}$/;
+function defaultRunnerKeyLabel(hostname2) {
+  const short = hostname2.split(".")[0].toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return (short || "host").slice(0, 40).replace(/-+$/, "");
+}
+function keyFromMintResponse(data) {
+  if (!data || typeof data !== "object") return null;
+  const d = data;
+  for (const k of ["key", "apiKey", "api_key", "rawKey", "plaintext"]) {
+    if (typeof d[k] === "string" && d[k].length >= 8) return d[k];
+  }
+  return null;
+}
+function assertNotCliKey(runnerKey, cliKey) {
+  if (cliKey && runnerKey === cliKey) {
+    throw new MushiCliError(
+      "E_INVALID_INPUT",
+      "That is your CLI key, not a runner key. A runner key can only report runner health; the CLI key can merge pull requests, so it never goes on a runner.",
+      "unset MUSHI_RUNNER_KEY, or set it to a key from `mushi runner key`"
+    );
+  }
+}
+var RUNNER_KEY_SHAPE = /^mushi_[A-Za-z0-9_-]{8,128}$/;
+function assertRunnerKeyShape(key) {
+  if (!RUNNER_KEY_SHAPE.test(key)) {
+    throw new MushiCliError("E_INVALID_INPUT", "That does not look like a Mushi key (mushi_\u2026).", "mint one with `mushi runner key`, or check MUSHI_RUNNER_KEY");
+  }
+  return key;
+}
+async function mintRunnerKey(config, projectId2, label) {
+  if (!LABEL_RE.test(label)) {
+    throw new MushiCliError("E_INVALID_INPUT", `Key label "${label}" must be 1-40 lowercase letters, digits and hyphens.`);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${encodeURIComponent(projectId2)}/runner-key`,
+    config,
+    { method: "POST", body: JSON.stringify({ label }) }
+  );
+  if (!result.ok) {
+    const scope = result.error.code === "INSUFFICIENT_SCOPE" || result.httpStatus === 403;
+    throw new MushiCliError(
+      "E_INVALID_INPUT",
+      `Could not create a runner key: ${result.error.code} \u2014 ${result.error.message}`,
+      scope ? "creating one needs a CLI key with mcp:write: run `mushi login --upgrade-scope`" : void 0
+    );
+  }
+  const key = keyFromMintResponse(result.data);
+  if (!key) throw new MushiCliError("E_INVALID_INPUT", "The server answered without a runner key.");
+  assertNotCliKey(key, config.apiKey);
+  return assertRunnerKeyShape(key);
+}
+async function resolveRunnerKey(config, opts) {
+  const fromEnv = (opts.env ?? process.env)["MUSHI_RUNNER_KEY"]?.trim();
+  if (fromEnv) {
+    assertNotCliKey(fromEnv, config.apiKey);
+    return { key: assertRunnerKeyShape(fromEnv), source: "env" };
+  }
+  if (!config.apiKey) {
+    throw new MushiCliError("E_AUTH_MISSING", "No runner key and no CLI key to create one.", "set MUSHI_RUNNER_KEY, or run `mushi login` first");
+  }
+  if (!opts.projectId) {
+    throw new MushiCliError("E_PROJECT_MISSING", "Which project is the runner key for?", "pass --project <uuid>, or set MUSHI_RUNNER_KEY");
+  }
+  return { key: await mintRunnerKey(config, opts.projectId, opts.label), source: "minted" };
+}
+
+// src/runner/add-plan.ts
+var REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9._-]{1,100}$/;
+var LABEL_RE2 = /^[a-z0-9][a-z0-9-]{0,39}$/;
+var USER_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+var MEMORY_RE = /^\d+(?:\.\d+)?[MG]$/;
+var RUNNER_ROOT = "/opt/mushi-runner";
+var LIB_DIR = "/usr/local/lib/mushi-runner";
+var ETC_DIR = "/etc/mushi-runner";
+var UNIT_DIR = "/etc/systemd/system";
+var SLICE = "mushi-runner.slice";
+function defaultLabel(hostname2) {
+  const short = hostname2.split(".")[0].toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return `mushi-${short || "runner"}`.slice(0, 40).replace(/-+$/, "");
+}
+function defaultMemory(totalMb) {
+  const mb = Math.floor(totalMb * 0.6);
+  return mb >= 2048 ? `${Math.floor(mb / 1024)}G` : `${Math.max(mb, 512)}M`;
+}
+function runnerArch(nodeArch2) {
+  if (nodeArch2 === "x64") return "x64";
+  if (nodeArch2 === "arm64") return "arm64";
+  return null;
+}
+function parseRunnerSha(body, target) {
+  const esc = target.replace(/[-.]/g, (c) => `\\${c}`);
+  const m = body.match(new RegExp(`<!--\\s*BEGIN SHA ${esc}\\s*-->\\s*([0-9a-f]{64})\\s*<!--\\s*END SHA ${esc}\\s*-->`, "i"));
+  return m ? m[1].toLowerCase() : null;
+}
+function parseResolvers(resolvConf) {
+  const out = [];
+  for (const line of resolvConf.split("\n")) {
+    const m = line.match(/^\s*nameserver\s+(\d{1,3}(?:\.\d{1,3}){3})\s*$/);
+    if (m && !out.includes(m[1])) out.push(m[1]);
+  }
+  return out;
+}
+function mergeIni(existing, wanted) {
+  const lines = existing.replace(/\r\n/g, "\n").split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  let changed = false;
+  for (const [section, keys] of Object.entries(wanted)) {
+    let start = lines.findIndex((l) => l.trim().toLowerCase() === `[${section.toLowerCase()}]`);
+    if (start === -1) {
+      if (lines.length && lines[lines.length - 1].trim() !== "") lines.push("");
+      lines.push(`[${section}]`);
+      start = lines.length - 1;
+    }
+    for (const [key, value] of Object.entries(keys)) {
+      let end = lines.findIndex((l, i) => i > start && /^\s*\[/.test(l));
+      if (end === -1) end = lines.length;
+      const idx = lines.findIndex((l, i) => i > start && i < end && new RegExp(`^\\s*${key}\\s*=`, "i").test(l));
+      if (idx === -1) {
+        let insertAt = end;
+        while (insertAt > start + 1 && lines[insertAt - 1].trim() === "") insertAt--;
+        lines.splice(insertAt, 0, `${key}=${value}`);
+        changed = true;
+      } else if (lines[idx].split("=").slice(1).join("=").trim().toLowerCase() !== value.toLowerCase()) {
+        lines[idx] = `${key}=${value}`;
+        changed = true;
+      }
+    }
+  }
+  return changed ? `${lines.join("\n")}
+` : null;
+}
+var q = (s) => `'${s.replace(/'/g, `'"'"'`)}'`;
+function fileStep(id, title, path, content, mode, owner = "root:root") {
+  const dir = path.slice(0, path.lastIndexOf("/")) || "/";
+  return {
+    id,
+    title,
+    sudo: true,
+    run: `mkdir -p ${q(dir)} && cat > ${q(path)} && chmod ${mode} ${q(path)} && chown ${owner} ${q(path)}`,
+    file: { path, content }
+  };
+}
+function notesForWorkflows(label, setVariable, repo) {
+  return [
+    "Point a workflow at this machine (only workflows that ask for the label run here):",
+    `  runs-on: [self-hosted, ${label}]`,
+    "Or keep GitHub-hosted runners as the fallback with a repository variable:",
+    "  runs-on: ${{ vars.LINUX_RUNNER || 'ubuntu-latest' }}",
+    setVariable ? `  (this plan sets LINUX_RUNNER=${label} on ${repo})` : `  gh variable set LINUX_RUNNER --repo ${repo} --body ${label}   (or re-run with --set-variable)`
+  ];
+}
+function wslNotes(distro) {
+  const d = distro ?? "<your distro>";
+  return [
+    "WSL2 stops a distro about 15 s after its last terminal closes, and the VM a minute later, so the runner goes offline.",
+    "Keep it running: in %USERPROFILE%\\.wslconfig on Windows set",
+    "  [general]",
+    "  instanceIdleTimeout=-1",
+    "  [wsl2]",
+    "  vmIdleTimeout=-1",
+    "then run `wsl --shutdown` once. And start the distro at logon (PowerShell, as you):",
+    `  schtasks /Create /TN "mushi-runner-keepalive-${d}" /SC ONLOGON /RL LIMITED /F /TR "wsl.exe -d ${d} -u root --exec sleep infinity"`
+  ];
+}
+function macNotes(input) {
+  return [
+    "On macOS Mushi prints the steps instead of running them. Use a user-session LaunchAgent (not a daemon), so jobs reach the keychain and the iOS simulator:",
+    "  1. Create a standard (non-admin) macOS user for the runner and log in to it once (fast user switching keeps it running).",
+    `  2. As that user, download the runner from https://github.com/actions/runner/releases (osx-${input.arch ?? "arm64"}) and check its SHA-256 against the release notes.`,
+    `  3. Register it with your own gh login: TOKEN=$(gh api -X POST repos/${input.repo}/actions/runners/registration-token --jq .token)`,
+    `     ACTIONS_RUNNER_INPUT_TOKEN="$TOKEN" ./config.sh --unattended --url https://github.com/${input.repo} --name ${input.label} --labels ${input.label}`,
+    "  4. ./svc.sh install && ./svc.sh start   (installs a LaunchAgent for that user)",
+    `  5. mushi runner hooks install --dir <runner folder>, then restart the agent.`,
+    ...notesForWorkflows(input.label, false, input.repo)
+  ];
+}
+function validate(input) {
+  if (!REPO_RE.test(input.repo)) return `"${input.repo}" is not owner/name.`;
+  if (!LABEL_RE2.test(input.label)) return `Label "${input.label}" must be lowercase letters, digits and dashes (\u2264 40).`;
+  if (!USER_RE.test(input.runnerUser)) return `Runner user "${input.runnerUser}" is not a valid user name.`;
+  if (!USER_RE.test(input.installUser)) return `Could not tell who you are ("${input.installUser}").`;
+  if (input.installUser === "root") return "Run `mushi runner add` as yourself, not as root. It uses sudo for the steps that need it, and your own gh login.";
+  if (input.installUser === input.runnerUser) return "The runner needs its own user, not yours.";
+  if (!Number.isInteger(input.uid) || input.uid < 500 || input.uid > 6e4) return "The runner uid must be between 500 and 60000.";
+  if (!MEMORY_RE.test(input.memoryMax)) return `Memory "${input.memoryMax}" must look like 8G or 6144M.`;
+  if (!/^[0-9a-f]{64}$/.test(input.hostId)) return "Could not hash a machine id for this host.";
+  if (input.wsl?.distro && !/^[A-Za-z0-9._-]+$/.test(input.wsl.distro)) return "Unexpected WSL distro name.";
+  if (input.release && !/^\d{1,4}\.\d{1,4}\.\d{1,4}$/.test(input.release.version)) return `Unexpected actions/runner version "${input.release.version}".`;
+  if (input.release && !/^[0-9a-f]{64}$/.test(input.release.sha256)) return "Unexpected actions/runner checksum.";
+  if (input.resolvers.some((ip) => !/^\d{1,3}(?:\.\d{1,3}){3}$/.test(ip))) return "Unexpected DNS resolver address.";
+  return null;
+}
+function buildAddPlan(input) {
+  const warnings = [];
+  const refuse = (why, notes2 = []) => ({ refused: why, steps: [], warnings, notes: notes2 });
+  if (input.platform === "windows") {
+    return refuse(
+      "Mushi sets up runners on Linux, WSL2 and macOS. On Windows, install WSL2 (`wsl --install`), open the distro and run `mushi runner add` there: the runner then lives in its own Linux user, apart from your Windows files."
+    );
+  }
+  const invalid = validate(input);
+  if (invalid) return refuse(invalid);
+  if (input.isPublic === true && !input.allowPublic) {
+    return refuse(
+      `${input.repo} is public. A pull request from a fork would run its code on this machine, and GitHub says self-hosted runners "should almost never be used for public repositories" (https://docs.github.com/en/actions/reference/security/secure-use). Use GitHub-hosted runners for it (public repos run free), or pass --allow-public if you accept that risk.`
+    );
+  }
+  if (input.isPublic === true) warnings.push(`${input.repo} is public and --allow-public is set, so every fork pull request your settings let run will run on this machine.`);
+  if (input.isPublic === null) warnings.push(`Could not read whether ${input.repo} is public; check it is private before you point workflows here.`);
+  if (input.forkApproval === null) {
+    warnings.push("Could not read the fork pull request approval setting (Settings \u2192 Actions \u2192 General).");
+  } else if (input.forkApproval !== "all_external_contributors") {
+    warnings.push(`Fork pull requests from some outside contributors run without approval (${input.forkApproval}). Set "Require approval for all external contributors" in Settings \u2192 Actions \u2192 General.`);
+  }
+  if (input.prTargetWorkflows && input.prTargetWorkflows.length > 0) {
+    warnings.push(`These workflows use pull_request_target, which runs with your secrets on fork pull requests; keep them off this runner: ${input.prTargetWorkflows.join(", ")}`);
+  }
+  warnings.push("Cloud agents push branches inside the repo, so fork approval does not stop code an agent wrote from running here. Review what your agents can push.");
+  if (input.platform === "macos") {
+    return { refused: null, steps: [], warnings, notes: macNotes(input) };
+  }
+  if (!input.arch) return refuse("This CPU is not supported by the GitHub runner (x64 or arm64 only).");
+  const steps = [];
+  if (input.platform === "wsl2" && input.wsl) {
+    const wanted = { boot: { systemd: "true" } };
+    if (input.wsl.isolate) {
+      wanted["automount"] = { enabled: "false" };
+      wanted["interop"] = { enabled: "false", appendWindowsPath: "false" };
+    }
+    const merged = mergeIni(input.wsl.wslConf, wanted);
+    if (merged) {
+      steps.push(fileStep("wsl-conf", "Update /etc/wsl.conf (systemd on" + (input.wsl.isolate ? "; Windows drives and Windows programs off for this distro" : "") + ")", "/etc/wsl.conf", merged, "0644"));
+    }
+    if (!input.wsl.isolate) {
+      warnings.push("Jobs in this distro can read your Windows drives (/mnt/c) and start Windows programs. Re-run with --wsl-isolate to turn both off for this distro (it needs a `wsl --shutdown`).");
+    }
+    if (!input.systemdRunning) {
+      return {
+        refused: null,
+        steps,
+        warnings,
+        notes: ["systemd is not running in this distro yet. After these steps run `wsl --shutdown` in Windows, open the distro again and run `mushi runner add` again."]
+      };
+    }
+  } else if (!input.systemdRunning) {
+    return refuse("This machine does not run systemd, which the runner service, its memory cap and the heartbeat timer need.");
+  }
+  if (!input.release) return refuse("Could not read the latest actions/runner release and its published SHA-256, so there is nothing safe to download.");
+  const target = `linux-${input.arch}`;
+  const dir = `${RUNNER_ROOT}/${input.label}`;
+  const ru = input.runnerUser;
+  const unit = `mushi-runner-${input.label}.service`;
+  const tarball = `actions-runner-${target}-${input.release.version}.tar.gz`;
+  const url = `https://github.com/actions/runner/releases/download/v${input.release.version}/${tarball}`;
+  steps.push({
+    id: "user",
+    title: `Create the ${ru} user (uid ${input.uid}, no login shell, not an admin)`,
+    sudo: true,
+    run: `if id -u ${ru} >/dev/null 2>&1; then echo '${ru} already exists'; elif getent passwd ${input.uid} >/dev/null; then echo 'uid ${input.uid} is taken; pass --uid' >&2; exit 1; else useradd --system --uid ${input.uid} --user-group --home-dir /var/lib/${ru} --create-home --shell /usr/sbin/nologin ${ru}; fi`
+  });
+  steps.push({
+    id: "download",
+    title: `Download actions/runner ${input.release.version} and check its SHA-256`,
+    sudo: true,
+    run: [
+      "set -e",
+      "tmp=$(mktemp -d)",
+      `curl -fsSL --proto '=https' -o "$tmp/runner.tgz" ${q(url)}`,
+      `echo '${input.release.sha256}  '"$tmp/runner.tgz" | sha256sum -c -`,
+      `install -d -o ${ru} -g ${ru} -m 0750 ${q(dir)}`,
+      `tar -xzf "$tmp/runner.tgz" -C ${q(dir)}`,
+      `chown -R ${ru}:${ru} ${q(dir)}`,
+      'rm -rf "$tmp"'
+    ].join("; ")
+  });
+  steps.push({
+    id: "deps",
+    title: "Install the runner's system libraries (its own script)",
+    sudo: true,
+    run: `${q(`${dir}/bin/installdependencies.sh`)}`
+  });
+  steps.push(fileStep(
+    "slice",
+    `Cap runner memory at ${input.memoryMax} (systemd slice)`,
+    `${UNIT_DIR}/${SLICE}`,
+    [
+      "[Unit]",
+      "Description=Mushi runners: memory and CPU limits",
+      "",
+      "[Slice]",
+      `MemoryMax=${input.memoryMax}`,
+      // No MemoryHigh: reclaim throttling also stalls the runner's own
+      // heartbeat, and GitHub then cancels the job as "lost communication"
+      // (seen on 2026-10-21 at PSI full 71%). A swap cap keeps a leaking
+      // build from paging the whole machine instead.
+      "MemorySwapMax=2G",
+      "CPUWeight=50",
+      "TasksMax=4096",
+      ""
+    ].join("\n"),
+    "0644"
+  ));
+  const osLabel = "Linux";
+  const archLabel = input.arch === "arm64" ? "ARM64" : "X64";
+  const hardening = [
+    "NoNewPrivileges=yes",
+    "PrivateTmp=yes",
+    "ProtectHome=yes",
+    "ProtectSystem=full",
+    "ProtectKernelTunables=yes",
+    "ProtectKernelModules=yes",
+    "ProtectControlGroups=yes",
+    "RestrictSUIDSGID=yes"
+  ];
+  if (input.mode === "ephemeral") {
+    const tokenFile = `${ETC_DIR}/${input.label}.gh-token`;
+    steps.push(fileStep(
+      "mint",
+      "Write the script that mints a one-job runner config before every job",
+      `${LIB_DIR}/${input.label}-mint.sh`,
+      [
+        "#!/bin/sh",
+        `# Mints a one-job (JIT) runner config for ${input.repo}. Runs as root before`,
+        `# each job (ExecStartPre=+). Uses ${tokenFile} (a fine-grained token with`,
+        `# Administration: write on this repo only) when it exists, else ${input.installUser}'s gh login.`,
+        "set -eu",
+        "umask 077",
+        `rm -rf ${q(`${dir}/_work`)}`,
+        `NAME="${input.label}-$(date +%s)"`,
+        // The token can create runners on the repo: use it only when root alone can read it.
+        `if [ -e ${q(tokenFile)} ]; then`,
+        `  [ "$(stat -c '%u %a' ${q(tokenFile)})" = "0 600" ] || { echo ${q(`${tokenFile} must be owned by root with mode 0600; refusing to use it`)} >&2; exit 1; }`,
+        `  GH_TOKEN=$(cat ${q(tokenFile)}); export GH_TOKEN; GH=gh`,
+        `else GH="runuser -u ${input.installUser} -- gh"; fi`,
+        `$GH api -X POST repos/${input.repo}/actions/runners/generate-jitconfig \\`,
+        `  -f name="$NAME" -F runner_group_id=1 -f work_folder=_work \\`,
+        `  -f 'labels[]=self-hosted' -f 'labels[]=${osLabel}' -f 'labels[]=${archLabel}' -f 'labels[]=${input.label}' \\`,
+        '  --jq .encoded_jit_config > "$RUNTIME_DIRECTORY/jit"',
+        `chown ${ru}:${ru} "$RUNTIME_DIRECTORY/jit"`,
+        ""
+      ].join("\n"),
+      "0755"
+    ));
+    steps.push(fileStep(
+      "start",
+      "Write the script that starts the runner with that config (read from a 0600 file, passed as an environment variable)",
+      `${LIB_DIR}/${input.label}-start.sh`,
+      [
+        "#!/bin/sh",
+        "set -eu",
+        'ACTIONS_RUNNER_INPUT_JITCONFIG=$(cat "$RUNTIME_DIRECTORY/jit")',
+        'rm -f "$RUNTIME_DIRECTORY/jit"',
+        "export ACTIONS_RUNNER_INPUT_JITCONFIG",
+        `exec ${q(`${dir}/run.sh`)}`,
+        ""
+      ].join("\n"),
+      "0755"
+    ));
+    steps.push(fileStep("service", `Write the ${unit} service (one job, then a fresh runner)`, `${UNIT_DIR}/${unit}`, [
+      "[Unit]",
+      `Description=Mushi GitHub Actions runner ${input.label} for ${input.repo} (one job per runner)`,
+      "After=network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      `User=${ru}`,
+      `Group=${ru}`,
+      `Slice=${SLICE}`,
+      `WorkingDirectory=${dir}`,
+      `RuntimeDirectory=mushi-runner-${input.label}`,
+      "RuntimeDirectoryMode=0700",
+      `ExecStartPre=+${LIB_DIR}/${input.label}-mint.sh`,
+      `ExecStart=${LIB_DIR}/${input.label}-start.sh`,
+      "Restart=always",
+      "RestartSec=15",
+      "KillSignal=SIGINT",
+      "TimeoutStopSec=5min",
+      ...hardening,
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target",
+      ""
+    ].join("\n"), "0644"));
+    if (input.ghTokenInKeyring) {
+      warnings.push(`Your gh login is in a desktop keyring, which a background service cannot read, so minting will fail. Create a fine-grained token with Administration: write on ${input.repo} only and save it as ${tokenFile} (root, mode 0600).`);
+    }
+  } else {
+    steps.push({
+      id: "register",
+      title: `Register the runner with ${input.repo} (token from your gh login, passed on stdin)`,
+      sudo: true,
+      stdinSecret: "registration-token",
+      run: `cd ${q(dir)} && runuser -u ${ru} -- sh -c 'IFS= read -r ACTIONS_RUNNER_INPUT_TOKEN; export ACTIONS_RUNNER_INPUT_TOKEN; exec ./config.sh --unattended --replace --url https://github.com/${input.repo} --name ${input.label} --labels ${input.label} --work _work'`
+    });
+    steps.push(fileStep("service", `Write the ${unit} service`, `${UNIT_DIR}/${unit}`, [
+      "[Unit]",
+      `Description=Mushi GitHub Actions runner ${input.label} for ${input.repo}`,
+      "After=network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      `User=${ru}`,
+      `Group=${ru}`,
+      `Slice=${SLICE}`,
+      `WorkingDirectory=${dir}`,
+      `ExecStart=${dir}/run.sh`,
+      "Restart=always",
+      "RestartSec=15",
+      "KillSignal=SIGINT",
+      "TimeoutStopSec=5min",
+      ...hardening,
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target",
+      ""
+    ].join("\n"), "0644"));
+  }
+  const hooksDir = `${dir}/${HOOKS_DIR_NAME}`;
+  for (const phase of ["started", "completed"]) {
+    steps.push(fileStep(
+      `hook-${phase}`,
+      `Write the job-${phase} hook (memory peak, OOM kills, swap, load per job)`,
+      `${hooksDir}/job-${phase}.sh`,
+      hookScript({ phase, endpoint: input.endpoint, hostId: input.hostId }),
+      "0755",
+      `${ru}:${ru}`
+    ));
+  }
+  steps.push({
+    id: "hook-key",
+    title: `Save the runner key (runner:write, can only report runner health) for the hooks (${hooksDir}/key, mode 0600, owned by ${ru})`,
+    sudo: true,
+    stdinSecret: "runner-key",
+    run: `umask 077 && IFS= read -r k && printf '%s\\n' "$k" > ${q(`${hooksDir}/key`)} && chown ${ru}:${ru} ${q(`${hooksDir}/key`)}`
+  });
+  steps.push({
+    id: "hook-env",
+    title: "Turn the hooks on in the runner's .env",
+    sudo: true,
+    run: [
+      `cd ${q(dir)}`,
+      `grep -q '^${HOOK_ENV_STARTED}=' .env 2>/dev/null || echo '${HOOK_ENV_STARTED}=${hooksDir}/job-started.sh' >> .env`,
+      `grep -q '^${HOOK_ENV_COMPLETED}=' .env 2>/dev/null || echo '${HOOK_ENV_COMPLETED}=${hooksDir}/job-completed.sh' >> .env`,
+      `chown ${ru}:${ru} .env`
+    ].join(" && ")
+  });
+  const keyDir = RUNNER_KEY_PATH.slice(0, RUNNER_KEY_PATH.lastIndexOf("/"));
+  steps.push({
+    id: "heartbeat-key",
+    title: `Save the runner key for the heartbeat (${RUNNER_KEY_PATH}, root only, handed to the service by systemd)`,
+    sudo: true,
+    stdinSecret: "runner-key",
+    run: `install -d -m 0700 ${keyDir} && umask 077 && IFS= read -r k && printf '%s\\n' "$k" > ${RUNNER_KEY_PATH}`
+  });
+  steps.push(fileStep("heartbeat-service", "Write the heartbeat service (runs as you, reads systemd and cgroups only)", `${UNIT_DIR}/mushi-runner-heartbeat.service`, [
+    "[Unit]",
+    "Description=Mushi runner heartbeat (memory, swap, load, runner services)",
+    "After=network-online.target",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    `User=${input.installUser}`,
+    // systemd reads the root-only key and exposes it to this service alone
+    // at $CREDENTIALS_DIRECTORY/runner-key; it is never in the unit or env.
+    `LoadCredential=${RUNNER_KEY_CREDENTIAL}:${RUNNER_KEY_PATH}`,
+    `Environment=MUSHI_API_ENDPOINT=${input.endpoint.replace(/%/g, "%%")}`,
+    `ExecStart=${systemdArgv(input.heartbeatCommand)}`,
+    "NoNewPrivileges=yes",
+    ""
+  ].join("\n"), "0644"));
+  steps.push(fileStep("heartbeat-timer", "Send the heartbeat every 2 minutes", `${UNIT_DIR}/mushi-runner-heartbeat.timer`, [
+    "[Unit]",
+    "Description=Mushi runner heartbeat every 2 minutes",
+    "",
+    "[Timer]",
+    "OnBootSec=1min",
+    "OnUnitActiveSec=2min",
+    "",
+    "[Install]",
+    "WantedBy=timers.target",
+    ""
+  ].join("\n"), "0644"));
+  const enable = [unit, "mushi-runner-heartbeat.timer"];
+  if (input.blockLan) {
+    const nftPath = `${ETC_DIR}/egress-${input.uid}.nft`;
+    steps.push({
+      id: "egress-check",
+      title: "Check that nftables is installed",
+      sudo: true,
+      run: "command -v nft >/dev/null 2>&1 || { echo 'nftables is not installed: install it (for example sudo apt install nftables) or drop --block-lan' >&2; exit 1; }"
+    });
+    steps.push(fileStep("egress-rules", `Block the ${ru} user from your LAN and tailnet (nftables table of its own)`, nftPath, egressRules(input.uid, input.resolvers), "0644"));
+    steps.push(fileStep("egress-service", "Load those rules at boot", `${UNIT_DIR}/mushi-runner-egress.service`, [
+      "[Unit]",
+      "Description=Mushi runner egress block (LAN, tailnet, link-local)",
+      "Before=network-pre.target",
+      "Wants=network-pre.target",
+      "",
+      "[Service]",
+      "Type=oneshot",
+      "RemainAfterExit=yes",
+      `ExecStart=/usr/sbin/nft -f ${nftPath}`,
+      `ExecStop=/usr/sbin/nft delete table inet mushi_runner_egress_${input.uid}`,
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target",
+      ""
+    ].join("\n"), "0644"));
+    enable.unshift("mushi-runner-egress.service");
+  }
+  steps.push({
+    id: "enable",
+    title: "Start the runner and the heartbeat",
+    sudo: true,
+    run: `systemctl daemon-reload && systemctl enable --now ${enable.join(" ")}`
+  });
+  if (input.setVariable) {
+    steps.push({
+      id: "variable",
+      title: `Set LINUX_RUNNER=${input.label} on ${input.repo} (your gh login)`,
+      sudo: false,
+      run: `gh variable set LINUX_RUNNER --repo ${input.repo} --body ${input.label}`
+    });
+  }
+  const notes = [
+    ...notesForWorkflows(input.label, input.setVariable, input.repo),
+    `Check it: mushi runner status (and journalctl -u ${unit} -f on this machine).`,
+    "Stronger isolation (a fresh container per job) is not set up by this command yet; until then keep this runner on private repos you trust."
+  ];
+  if (input.platform === "wsl2") notes.push(...wslNotes(input.wsl?.distro ?? null));
+  return { refused: null, steps, warnings, notes };
+}
+function systemdArgv(argv) {
+  return argv.map((a) => a.replace(/%/g, "%%")).map((a) => /[\s"'\\]/.test(a) ? `"${a.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : a).join(" ");
+}
+function egressRules(uid, resolvers) {
+  const table = `mushi_runner_egress_${uid}`;
+  const dns = [.../* @__PURE__ */ new Set(["10.255.255.254", ...resolvers])].filter((ip) => !ip.startsWith("127."));
+  return [
+    "#!/usr/sbin/nft -f",
+    `# Mushi runner egress block for uid ${uid}. Its own table; other rules are untouched.`,
+    `define MUSHI_RUNNER_UID = ${uid}`,
+    `table inet ${table} {}`,
+    `delete table inet ${table}`,
+    `table inet ${table} {`,
+    "  chain output {",
+    "    type filter hook output priority 0; policy accept;",
+    "    meta skuid $MUSHI_RUNNER_UID oif lo accept",
+    ...dns.length ? [`    meta skuid $MUSHI_RUNNER_UID ip daddr { ${dns.join(", ")} } meta l4proto { tcp, udp } th dport 53 accept`] : [],
+    "    meta skuid $MUSHI_RUNNER_UID ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 169.254.0.0/16 } reject",
+    "    meta skuid $MUSHI_RUNNER_UID ip6 daddr { fc00::/7, fe80::/10 } reject",
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+
+// src/runner/audit.ts
+var BACKDOOR_NAME = /sha1[-_ ]?hulud|shai[-_ ]?hulud/i;
+function labelNames(r) {
+  return (r.labels ?? []).map((l) => typeof l === "string" ? l : l.name).filter(Boolean);
+}
+function auditRepo(input) {
+  const findings = [];
+  const runners = (input.runners ?? []).map((r) => {
+    const labels = labelNames(r);
+    const setUpByMushi = labels.some((l) => l.toLowerCase().startsWith("mushi-")) || (input.heartbeatRunners?.has(r.name) ?? false);
+    return { id: r.id, name: r.name, status: r.status ?? "unknown", busy: r.busy === true, labels, setUpByMushi };
+  });
+  if (input.runners === null) {
+    findings.push({ severity: "info", message: `Could not list runners${input.runnersError ? ` (${input.runnersError})` : ""}. Listing them needs Administration: read on the repo.` });
+  }
+  for (const r of runners) {
+    if (BACKDOOR_NAME.test(r.name) || r.labels.some((l) => BACKDOOR_NAME.test(l))) {
+      findings.push({
+        severity: "critical",
+        message: `Runner "${r.name}" (id ${r.id}) is named like the Shai-Hulud 2.0 backdoor runner. Remove it (Settings \u2192 Actions \u2192 Runners), then check the machine it runs on and rotate your GitHub and npm tokens.`
+      });
+    } else if (!r.setUpByMushi) {
+      findings.push({
+        severity: "warn",
+        message: `Runner "${r.name}" (id ${r.id}) was not set up by Mushi (no mushi- label, no Mushi heartbeat). Make sure you know which machine it is.`
+      });
+    }
+  }
+  if (input.isPublic === true && runners.length > 0) {
+    findings.push({ severity: "warn", message: "This repo is public and has self-hosted runners: a fork pull request can run code on them." });
+  }
+  if (input.forkApproval === null) {
+    findings.push({ severity: "info", message: "Could not read the fork pull request approval setting." });
+  } else if (input.forkApproval !== "all_external_contributors") {
+    findings.push({
+      severity: "warn",
+      message: `Fork pull requests run without approval for some outside contributors (${input.forkApproval}). Set "Require approval for all external contributors" in Settings \u2192 Actions \u2192 General.`
+    });
+  }
+  if (input.prTargetWorkflows && input.prTargetWorkflows.length > 0) {
+    findings.push({
+      severity: "warn",
+      message: `pull_request_target runs with your secrets on fork pull requests: ${input.prTargetWorkflows.join(", ")}. Keep these off self-hosted runners and never check out the pull request's code in them.`
+    });
+  }
+  return { repo: input.repo, runners, findings };
+}
+function workflowsWithPrTarget(files) {
+  return files.filter((f) => f.text.split("\n").some((line) => {
+    const code = line.replace(/#.*$/, "");
+    return /\bpull_request_target\b/.test(code);
+  })).map((f) => f.name);
+}
+
+// src/runner/github.ts
+import { spawnSync as spawnSync2 } from "child_process";
+var nodeGh = (args) => {
+  const res = spawnSync2("gh", args, { encoding: "utf8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] });
+  if (res.error) {
+    const missing = res.error.code === "ENOENT";
+    return { ok: false, error: missing ? "gh is not installed (https://cli.github.com)" : res.error.message };
+  }
+  if (res.status !== 0) {
+    const first = (res.stderr || res.stdout || "").trim().split("\n")[0] ?? "";
+    return { ok: false, error: first.slice(0, 200) || `gh exited ${res.status}` };
+  }
+  return { ok: true, stdout: res.stdout };
+};
+function ghAuthStatus() {
+  const res = spawnSync2("gh", ["auth", "status"], { encoding: "utf8", timeout: 15e3, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: !res.error && res.status === 0, text: `${res.stdout ?? ""}${res.stderr ?? ""}` };
+}
+function repoIsPublic(gh, repo) {
+  const r = gh(["api", `repos/${repo}`, "--jq", ".private"]);
+  if (!r.ok) return null;
+  const v = r.stdout.trim();
+  return v === "true" ? false : v === "false" ? true : null;
+}
+function forkApprovalPolicy(gh, repo) {
+  const r = gh(["api", `repos/${repo}/actions/permissions/fork-pr-contributor-approval`, "--jq", ".approval_policy"]);
+  if (!r.ok) return null;
+  const v = r.stdout.trim();
+  return v && v !== "null" ? v : null;
+}
+function prTargetWorkflows(gh, repo) {
+  const list = gh(["api", `repos/${repo}/contents/.github/workflows`, "--jq", '.[] | select(.type == "file") | .path']);
+  if (!list.ok) return /404|Not Found/i.test(list.error) ? [] : null;
+  const paths = list.stdout.split("\n").map((s) => s.trim()).filter((p4) => /\.ya?ml$/.test(p4)).slice(0, 30);
+  const files = [];
+  for (const path of paths) {
+    const r = gh(["api", `repos/${repo}/contents/${path}`, "--jq", ".content"]);
+    if (!r.ok) return null;
+    files.push({ name: path.split("/").pop(), text: Buffer.from(r.stdout.replace(/\\n|\s/g, ""), "base64").toString("utf8") });
+  }
+  return workflowsWithPrTarget(files);
+}
+function latestRunnerRelease(gh, target) {
+  const r = gh(["api", "repos/actions/runner/releases/latest"]);
+  if (!r.ok) return null;
+  try {
+    const data = JSON.parse(r.stdout);
+    const version = data.tag_name?.replace(/^v/, "");
+    if (!version || !/^\d+\.\d+\.\d+$/.test(version)) return null;
+    const sha256 = parseRunnerSha(data.body ?? "", target);
+    return sha256 ? { version, sha256 } : null;
+  } catch {
+    return null;
+  }
+}
+function listRunners(gh, repo) {
+  const r = gh(["api", "--paginate", `repos/${repo}/actions/runners`, "--jq", ".runners[]"]);
+  if (!r.ok) return { runners: null, error: r.error };
+  const runners = [];
+  for (const line of r.stdout.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      runners.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return { runners, error: null };
+}
+function listOwnRepos(gh) {
+  const r = gh(["repo", "list", "--limit", "200", "--json", "nameWithOwner", "--jq", ".[].nameWithOwner"]);
+  if (!r.ok) return null;
+  return r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+}
+function currentRepo(gh) {
+  const r = gh(["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"]);
+  return r.ok ? r.stdout.trim() || null : null;
+}
+function registrationToken(gh, repo) {
+  return gh(["api", "-X", "POST", `repos/${repo}/actions/runners/registration-token`, "--jq", ".token"]);
+}
+
+// src/runner/host.ts
+import { createHash as createHash2 } from "crypto";
+import { execFileSync as execFileSync4 } from "child_process";
+import { readFileSync as readFileSync7, statfsSync } from "fs";
+import { cpus, freemem, hostname, loadavg, totalmem } from "os";
+import { dirname as dirname4, join as join11 } from "path";
+var nodeHostIO = {
+  platform: process.platform,
+  readFile(path) {
+    try {
+      return readFileSync7(path, "utf8");
+    } catch {
+      return null;
+    }
+  },
+  exec(cmd, args) {
+    try {
+      return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 });
+    } catch {
+      return null;
+    }
+  },
+  diskFreeBytes(path) {
+    try {
+      const s = statfsSync(path);
+      return Number(s.bavail) * Number(s.bsize);
+    } catch {
+      return null;
+    }
+  },
+  // Getters, so a heartbeat loop reads fresh values every tick.
+  get cpuCount() {
+    return cpus().length;
+  },
+  get totalMemBytes() {
+    return totalmem();
+  },
+  get freeMemBytes() {
+    return freemem();
+  },
+  get load1() {
+    return loadavg()[0] ?? 0;
+  },
+  get hostname() {
+    return hostname();
+  }
+};
+var HOST_ID_SALT = "mushi-runner";
+var MAX_RUNNERS = 40;
+function detectPlatform(io) {
+  if (io.platform === "darwin") return "macos";
+  if (io.platform === "win32") return "windows";
+  const version = io.readFile("/proc/version") ?? "";
+  return /microsoft/i.test(version) ? "wsl2" : "linux";
+}
+function readMachineId(io) {
+  if (io.platform === "darwin") {
+    const out = io.exec("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+    return out?.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)?.[1] ?? null;
+  }
+  for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    const id = io.readFile(path)?.trim();
+    if (id) return id;
+  }
+  return null;
+}
+function wslMachineId(io, platform) {
+  if (platform !== "wsl2") return null;
+  const boot = io.readFile("/proc/sys/kernel/random/boot_id")?.trim();
+  return boot ? hashHostId(`wsl-vm:${boot}`) : null;
+}
+function hashHostId(rawId) {
+  return createHash2("sha256").update(`${rawId.trim()}${HOST_ID_SALT}`).digest("hex");
+}
+function parseMeminfo(text2) {
+  const kb = (key) => {
+    const m = text2.match(new RegExp(`^${key}:\\s+(\\d+)\\s*kB`, "m"));
+    return m ? Number(m[1]) : null;
+  };
+  const total = kb("MemTotal");
+  if (total == null) return null;
+  const available = kb("MemAvailable") ?? kb("MemFree") ?? 0;
+  return {
+    totalMb: Math.round(total / 1024),
+    availableMb: Math.round(available / 1024),
+    swapTotalMb: Math.round((kb("SwapTotal") ?? 0) / 1024),
+    swapFreeMb: Math.round((kb("SwapFree") ?? 0) / 1024)
+  };
+}
+function parseLoadavg(text2) {
+  const v = Number(text2.trim().split(/\s+/)[0]);
+  return Number.isFinite(v) ? v : null;
+}
+function parseSwapUsage(text2) {
+  const total = text2.match(/total\s*=\s*([\d.]+)M/);
+  const used = text2.match(/used\s*=\s*([\d.]+)M/);
+  if (!total || !used) return null;
+  return { totalMb: Math.round(Number(total[1])), usedMb: Math.round(Number(used[1])) };
+}
+var MUSHI_HELPER_UNITS = /* @__PURE__ */ new Set(["mushi-runner-heartbeat.service", "mushi-runner-egress.service"]);
+function parseSystemctlUnits(text2) {
+  const out = [];
+  for (const line of text2.split("\n")) {
+    const unit = line.trim().split(/\s+/).find((tok) => /^actions\.runner\..+\.service$/.test(tok) || /^mushi-runner-.+\.service$/.test(tok) && !MUSHI_HELPER_UNITS.has(tok));
+    if (unit && !out.includes(unit)) out.push(unit);
+  }
+  return out;
+}
+function parseMushiUnitDescription(description) {
+  const m = description?.match(/^Mushi GitHub Actions runner (\S+) for ([\w.-]+\/[\w.-]+)/);
+  return m ? { name: m[1], repo: m[2] } : null;
+}
+function parseSystemctlShow(text2) {
+  const out = {};
+  for (const line of text2.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq > 0) out[line.slice(0, eq)] = line.slice(eq + 1).trim();
+  }
+  return out;
+}
+function parseUnitName(unit) {
+  const m = unit.match(/^actions\.runner\.(.+)\.service$/);
+  if (!m) return null;
+  const middle = m[1];
+  const dot = middle.lastIndexOf(".");
+  if (dot <= 0) return { name: middle, repo: null };
+  const name = middle.slice(dot + 1);
+  const ownerRepo = middle.slice(0, dot);
+  const dashes = ownerRepo.split("-").length - 1;
+  if (dashes !== 1) return { name, repo: null };
+  const [owner, repo] = ownerRepo.split("-");
+  return { name, repo: owner && repo ? `${owner}/${repo}` : null };
+}
+function runnerDirFromShow(props) {
+  const wd = props["WorkingDirectory"];
+  if (wd && wd.startsWith("/")) return wd;
+  const path = props["ExecStart"]?.match(/path=([^\s;]+)/)?.[1];
+  return path && path.startsWith("/") ? dirname4(path) : null;
+}
+function parseRunnerFile(text2) {
+  let data;
+  try {
+    data = JSON.parse(text2.replace(/^/, ""));
+  } catch {
+    return null;
+  }
+  if (!data || typeof data !== "object") return null;
+  const d = data;
+  const name = typeof d["agentName"] === "string" ? d["agentName"] : null;
+  let repo = null;
+  if (typeof d["gitHubUrl"] === "string") {
+    try {
+      const parts = new URL(d["gitHubUrl"]).pathname.split("/").filter(Boolean);
+      if (parts.length >= 2) repo = `${parts[0]}/${parts[1]}`;
+    } catch {
+      repo = null;
+    }
+  }
+  return { name, repo };
+}
+var MB = 1024 * 1024;
+function bytesToMb(text2) {
+  const t = text2?.trim();
+  if (!t || t === "max") return null;
+  const n = Number(t);
+  return Number.isFinite(n) ? Math.round(n / MB) : null;
+}
+function parseOomKills(eventsText) {
+  const m = eventsText?.match(/^oom_kill\s+(\d+)/m);
+  return m ? Number(m[1]) : null;
+}
+function readCgroupMemory(io, controlGroup) {
+  if (!controlGroup || !controlGroup.startsWith("/")) return { mem_current_mb: null, mem_max_mb: null, oom_kills: null };
+  const dir = join11("/sys/fs/cgroup", controlGroup);
+  const slice = dirname4(dir);
+  const max = bytesToMb(io.readFile(join11(dir, "memory.max"))) ?? (slice !== "/sys/fs/cgroup" ? bytesToMb(io.readFile(join11(slice, "memory.max"))) : null);
+  return {
+    mem_current_mb: bytesToMb(io.readFile(join11(dir, "memory.current"))),
+    mem_max_mb: max,
+    oom_kills: parseOomKills(io.readFile(join11(dir, "memory.events")))
+  };
+}
+function linuxRunners(io) {
+  const list = io.exec("systemctl", ["list-units", "--all", "actions.runner.*", "mushi-runner-*", "--no-legend", "--plain"]);
+  if (!list) return [];
+  const out = [];
+  for (const unit of parseSystemctlUnits(list).slice(0, MAX_RUNNERS)) {
+    const props = parseSystemctlShow(
+      io.exec("systemctl", ["show", unit, "-p", "ActiveState", "-p", "NRestarts", "-p", "ControlGroup", "-p", "WorkingDirectory", "-p", "ExecStart", "-p", "Description"]) ?? ""
+    );
+    const fromName = parseMushiUnitDescription(props["Description"]) ?? parseUnitName(unit);
+    const dir = runnerDirFromShow(props);
+    const fromFile = dir ? parseRunnerFile(io.readFile(join11(dir, ".runner")) ?? "") : null;
+    const restarts = Number(props["NRestarts"]);
+    out.push({
+      name: (fromFile?.name ?? fromName?.name ?? unit).slice(0, 100),
+      repo: fromFile?.repo ?? fromName?.repo ?? null,
+      service: unit,
+      active: props["ActiveState"] === "active",
+      restarts: Number.isFinite(restarts) && props["NRestarts"] !== "" && props["NRestarts"] !== void 0 ? restarts : null,
+      ...readCgroupMemory(io, props["ControlGroup"])
+    });
+  }
+  return out;
+}
+function parseLaunchctlList(text2) {
+  const out = [];
+  for (const line of text2.split("\n")) {
+    const [pid, , label] = line.trim().split(/\s+/);
+    if (label && label.startsWith("actions.runner.")) out.push({ label, running: pid !== void 0 && /^\d+$/.test(pid) });
+  }
+  return out;
+}
+function macRunners(io) {
+  const list = io.exec("launchctl", ["list"]);
+  if (!list) return [];
+  return parseLaunchctlList(list).slice(0, MAX_RUNNERS).map(({ label, running }) => {
+    const parsed = parseUnitName(`${label}.service`);
+    return {
+      name: (parsed?.name ?? label).slice(0, 100),
+      repo: parsed?.repo ?? null,
+      service: label,
+      active: running,
+      restarts: null,
+      mem_current_mb: null,
+      mem_max_mb: null,
+      oom_kills: null
+    };
+  });
+}
+var UnsupportedHostError = class extends Error {
+};
+function collectHeartbeat(io, mushiVersion) {
+  const platform = detectPlatform(io);
+  if (platform === "windows") {
+    throw new UnsupportedHostError("The heartbeat runs on Linux, WSL2 and macOS. On Windows, run your runner inside WSL2 and run this there.");
+  }
+  const rawId = readMachineId(io);
+  if (!rawId) throw new UnsupportedHostError("Could not read a machine id (/etc/machine-id or IOPlatformUUID).");
+  const round1 = (n) => Math.round(n * 10) / 10;
+  let memTotalMb = Math.round(io.totalMemBytes / MB);
+  let memUsedMb = Math.round((io.totalMemBytes - io.freeMemBytes) / MB);
+  let swapUsedMb = 0;
+  let swapTotalMb = 0;
+  let load1 = io.load1;
+  if (platform === "macos") {
+    const swap = parseSwapUsage(io.exec("sysctl", ["vm.swapusage"]) ?? "");
+    if (swap) {
+      swapUsedMb = swap.usedMb;
+      swapTotalMb = swap.totalMb;
+    }
+  } else {
+    const mem = parseMeminfo(io.readFile("/proc/meminfo") ?? "");
+    if (mem) {
+      memTotalMb = mem.totalMb;
+      memUsedMb = mem.totalMb - mem.availableMb;
+      swapTotalMb = mem.swapTotalMb;
+      swapUsedMb = mem.swapTotalMb - mem.swapFreeMb;
+    }
+    load1 = parseLoadavg(io.readFile("/proc/loadavg") ?? "") ?? load1;
+  }
+  const diskFree = io.diskFreeBytes("/");
+  const machineId = wslMachineId(io, platform);
+  return {
+    kind: "heartbeat",
+    host: {
+      host_id: hashHostId(rawId),
+      hostname: io.hostname.slice(0, 80),
+      platform,
+      cpu_count: io.cpuCount,
+      mem_total_mb: memTotalMb,
+      mushi_version: mushiVersion.slice(0, 40),
+      metrics: {
+        load1: round1(load1),
+        mem_used_mb: Math.max(0, memUsedMb),
+        swap_used_mb: Math.max(0, swapUsedMb),
+        swap_total_mb: swapTotalMb,
+        disk_free_gb: diskFree == null ? 0 : round1(diskFree / 1024 ** 3),
+        ...machineId ? { machine_id: machineId } : {}
+      }
+    },
+    runners: platform === "macos" ? macRunners(io) : linuxRunners(io)
+  };
+}
+
+// src/runner/overview.ts
+function field(row, ...keys) {
+  if (!row) return void 0;
+  for (const k of keys) {
+    if (row[k] !== void 0 && row[k] !== null) return row[k];
+  }
+  return void 0;
+}
+function num2(row, ...keys) {
+  const v = field(row, ...keys);
+  return typeof v === "number" && Number.isFinite(v) ? v : null;
+}
+function str(row, ...keys) {
+  const v = field(row, ...keys);
+  return typeof v === "string" && v ? v : null;
+}
+function fmtSeconds(s) {
+  if (s == null || !Number.isFinite(s)) return "unknown";
+  if (s < 90) return `${Math.round(s)} s`;
+  if (s < 90 * 60) return `${Math.round(s / 60)} min`;
+  return `${(s / 3600).toFixed(1)} h`;
+}
+function fmtMb(mb) {
+  if (mb == null) return "?";
+  return mb >= 1024 ? `${(mb / 1024).toFixed(1)} GB` : `${Math.round(mb)} MB`;
+}
+function fmtAgo(iso, now) {
+  if (!iso) return "never";
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return "unknown";
+  const s = Math.max(0, (now.getTime() - t) / 1e3);
+  if (s < 90) return "just now";
+  return `${fmtSeconds(s)} ago`;
+}
+function windowDays(w) {
+  if (typeof w === "number") return w;
+  if (w && typeof w === "object" && typeof w.days === "number") return w.days;
+  return null;
+}
+function hostRunnerStats(hosts) {
+  const out = /* @__PURE__ */ new Map();
+  for (const h of hosts) {
+    const runners = field(h, "runners");
+    if (!Array.isArray(runners)) continue;
+    for (const r of runners) {
+      const name = str(r, "name");
+      if (name) out.set(name, r);
+    }
+  }
+  return out;
+}
+function runnerState(r) {
+  const status = str(r, "status") ?? "unknown";
+  const busy = field(r, "busy") === true;
+  if (status === "online") return busy ? "BUSY" : "ONLINE";
+  if (status === "offline") return "OFFLINE";
+  return "SEEN";
+}
+function renderOverview(data, now = /* @__PURE__ */ new Date()) {
+  const lines = [];
+  const days = windowDays(data.window);
+  lines.push(`CI over the last ${days ?? "?"} day(s), where your fixes are tested.`);
+  const hosts = data.hosts ?? [];
+  const runners = data.runners ?? [];
+  const fromHosts = hostRunnerStats(hosts);
+  lines.push("");
+  lines.push("Machines");
+  if (hosts.length === 0) {
+    lines.push("  No machine has sent a heartbeat. Run `mushi runner heartbeat --once` on a runner machine to add one.");
+  }
+  for (const h of hosts) {
+    const name = oneLine(str(h, "hostname") ?? "(unnamed)", 40);
+    const platform = str(h, "platform") ?? "?";
+    const cpu = num2(h, "cpuCount", "cpu_count");
+    const memTotal = num2(h, "memTotalMb", "mem_total_mb");
+    const metrics = field(h, "metrics") ?? null;
+    const parts = [
+      `${platform}${cpu != null ? `, ${cpu} CPU` : ""}${memTotal != null ? `, ${fmtMb(memTotal)}` : ""}`,
+      `last heartbeat ${fmtAgo(str(h, "lastHeartbeatAt", "last_heartbeat_at"), now)}${field(h, "stale") === true ? " (stale: is the machine off?)" : ""}`
+    ];
+    const load = num2(metrics, "load1");
+    if (load != null) parts.push(`load ${load.toFixed(1)}`);
+    const memUsed = num2(metrics, "memUsedMb", "mem_used_mb");
+    if (memUsed != null) parts.push(`memory ${fmtMb(memUsed)} of ${fmtMb(memTotal)}`);
+    const swap = num2(metrics, "swapUsedMb", "swap_used_mb");
+    if (swap != null && swap > 0) parts.push(`swap ${fmtMb(swap)} used`);
+    const disk = num2(metrics, "diskFreeGb", "disk_free_gb");
+    if (disk != null) parts.push(`${disk.toFixed(0)} GB disk free`);
+    lines.push(`  ${name} (${parts.join(" \xB7 ")})`);
+  }
+  lines.push("");
+  lines.push("Runners");
+  if (runners.length === 0) lines.push("  No runner seen in this window.");
+  for (const r of runners) {
+    const name = str(r, "name", "runnerName", "runner_name") ?? "(unnamed)";
+    const repo = str(r, "repo");
+    const host = fromHosts.get(name);
+    const extra = [];
+    const memCur = num2(host, "memCurrentMb", "mem_current_mb");
+    const memMax = num2(host, "memMaxMb", "mem_max_mb");
+    if (memCur != null) extra.push(`memory ${fmtMb(memCur)}${memMax != null ? ` of ${fmtMb(memMax)}` : ""}`);
+    const oom = num2(host, "oomKills", "oom_kills") ?? num2(r, "oomKills", "oom_kills");
+    if (oom != null && oom > 0) extra.push(`${oom} out-of-memory kill(s)`);
+    if (host && field(host, "active") === false) extra.push("service stopped");
+    const lastJob = str(r, "lastJobAt", "last_job_at");
+    if (lastJob) extra.push(`last job ${fmtAgo(lastJob, now)}`);
+    lines.push(`  ${runnerState(r).padEnd(8)} ${oneLine(name, 40)}${repo ? `  ${oneLine(repo, 60)}` : ""}${extra.length ? `  (${extra.join(" \xB7 ")})` : ""}`);
+  }
+  const s = data.stats ?? {};
+  lines.push("");
+  lines.push(`Waiting for a runner: half of jobs started within ${fmtSeconds(s.queueP50s)}, 95% within ${fmtSeconds(s.queueP95s)}.`);
+  lines.push(`Run time: half finished within ${fmtSeconds(s.durationP50s)}, 95% within ${fmtSeconds(s.durationP95s)}.`);
+  const infra = s.infraFailures ?? 0;
+  const code = s.codeFailures ?? 0;
+  const pass = typeof s.passRate === "number" ? ` Pass rate ${Math.round(s.passRate <= 1 ? s.passRate * 100 : s.passRate)}%.` : "";
+  lines.push(`Failures: ${infra} where the test machine stopped (your fix was not tested), ${code} in your code.${pass}`);
+  const perms = data.permissions ?? null;
+  if (perms?.jobs === "missing") {
+    lines.push("Mushi cannot read your CI jobs: give its GitHub connection the Actions: read permission.");
+  }
+  if (perms?.runners === "missing") {
+    lines.push("Runner online/offline status needs the Administration: read permission on GitHub; showing runners seen in jobs instead.");
+  }
+  const advice = data.advice ?? [];
+  lines.push("");
+  if (advice.length === 0) {
+    lines.push("No advice: nothing in this window looks slow or broken.");
+  } else {
+    lines.push("What to do first");
+    for (const a of advice.slice(0, 3)) {
+      lines.push(`  ${String(a.severity).toUpperCase().padEnd(6)} ${oneLine(a.title, 110)}`);
+      if (a.detail) lines.push(`        ${oneLine(a.detail, 140)}`);
+      if (a.fix) lines.push(`        Fix: ${oneLine(a.fix, 140)}`);
+    }
+    if (advice.length > 3) lines.push(`  \u2026and ${advice.length - 3} more (--json shows all, with the evidence for each).`);
+  }
+  return lines;
+}
+
+// src/runner/compare.ts
+function formatMoney(n, currency = "USD") {
+  if (typeof n !== "number" || !Number.isFinite(n)) return "\u2014";
+  const abs = Math.abs(n).toFixed(2);
+  const sign = n < 0 ? "\u2212" : "";
+  return currency === "USD" ? `${sign}$${abs}` : `${sign}${abs} ${currency}`;
+}
+function formatDuration(s) {
+  if (typeof s !== "number" || !Number.isFinite(s)) return "\u2014";
+  if (s < 90) return `${Math.round(s)} s`;
+  if (s < 90 * 60) return `${Math.round(s / 60)} min`;
+  return `${Math.round(s / 3600 * 10) / 10} h`;
+}
+function pct(n) {
+  return typeof n === "number" && Number.isFinite(n) ? `${Math.round(n * 100)}%` : "\u2014";
+}
+function runsOnLabel(r) {
+  const labels = (r.labels ?? []).filter((l) => l.toLowerCase() !== "self-hosted").join(", ");
+  if (r.runnerClass === "github_hosted") return `GitHub-hosted${labels ? ` (${labels})` : r.os ? ` (${r.os})` : ""}`;
+  if (r.runnerClass === "self_hosted") {
+    const who = r.runner || labels || "self-hosted";
+    return `Self-hosted ${who}${r.machine && r.machine !== r.runner ? ` on ${r.machine}` : ""}`;
+  }
+  return `Never picked up${labels ? ` (${labels})` : ""}`;
+}
+var pad2 = (s, n) => s.length >= n ? `${s.slice(0, n - 1)}\u2026` : s.padEnd(n);
+function renderCompare(data, opts = {}) {
+  const lines = [];
+  const days = typeof data.window === "object" && data.window ? data.window.days ?? null : null;
+  const vis = new Map((data.repos ?? []).map((r2) => [r2.repo, r2.visibility ?? "unknown"]));
+  lines.push(`CI cost and speed${days ? `, last ${days} days` : ""} (${data.dataDays ?? 0} days of job data)`);
+  if (data.lowConfidence) lines.push("  Low confidence: under 7 days of data. Every figure below will move.");
+  if (data.sourceNote) lines.push(`  ${data.sourceNote}`);
+  const r = data.rates?.usdPerMinute;
+  if (r) lines.push(`  GitHub list prices from ${data.rates?.fetchedAt ?? "unknown date"}: Linux $${r.linux}/min, Windows $${r.windows}/min, macOS $${r.macos}/min.`);
+  lines.push("  Wait and run times are measured; minutes billed and money are estimated.");
+  const accounts = data.accounts ?? [];
+  if (accounts.length > 0) {
+    lines.push("", "GitHub accounts (included minutes are per account):");
+    for (const a of accounts) {
+      lines.push(`  ${a.owner}  ${a.plan ?? "?"} plan, ${(a.includedMinutes ?? 0).toLocaleString("en-US")} included  \xB7  ~${(a.monthMinutes ?? 0).toLocaleString("en-US")} min a month on private repos  \xB7  list ${formatMoney(a.monthListCost, a.currency)}  \xB7  after included ${formatMoney(a.monthCost, a.currency)} (estimated)`);
+    }
+  }
+  const rows = data.rows ?? [];
+  lines.push("", `${pad2("Repo", 36)} ${pad2("Runs on", 44)} ${"Jobs".padStart(5)} ${"Wait p95".padStart(9)} ${"Run p50".padStart(8)} ${"PR pass".padStart(8)} ${"Billed".padStart(7)} ${"Month (est.)".padStart(13)}`);
+  if (rows.length === 0) lines.push("  No CI jobs in this window.");
+  for (const row of rows.slice(0, opts.maxRows ?? 40)) {
+    const v = vis.get(row.repo);
+    const repo = `${row.repo}${v === "public" ? " (public)" : v === "private" ? " (private)" : ""}`;
+    const cost = row.costBasis === "github_public_free" ? "free" : row.costBasis === "github_larger_unpriced" ? "unpriced" : formatMoney(row.monthCost, row.currency);
+    lines.push(
+      `${pad2(repo, 36)} ${pad2(runsOnLabel(row), 44)} ${String(row.jobs ?? 0).padStart(5)} ${formatDuration(row.queueP95s).padStart(9)} ${formatDuration(row.runP50s).padStart(8)} ${pct(row.prPassRate).padStart(8)} ${String(row.billedMinutes ?? 0).padStart(7)} ${cost.padStart(13)}`
+    );
+  }
+  if (rows.length > (opts.maxRows ?? 40)) lines.push(`  \u2026 ${rows.length - (opts.maxRows ?? 40)} more (use --json)`);
+  const machines = data.machines ?? [];
+  if (machines.length > 0) {
+    lines.push("", "Your machines (busy time counts parallel jobs once; electricity is the extra draw under load, your figures):");
+    for (const m of machines) {
+      lines.push(`  ${m.name}${m.online === false ? " (offline)" : ""}: busy ${m.busyHours ?? 0} h (${pct(m.busyShare)})  \xB7  electricity ${formatMoney(m.monthEnergyCost, m.currency)}/month  \xB7  wear ${formatMoney(m.monthWearCost, m.currency)}/month  \xB7  wait p95 ${formatDuration(m.queueP95s)}`);
+    }
+  }
+  const measured = (data.speed ?? []).filter((s) => s.factor != null);
+  const thin = (data.speed ?? []).filter((s) => s.factor == null);
+  if (measured.length > 0 || thin.length > 0) {
+    lines.push("", "Speed, self-hosted vs GitHub-hosted (passed runs, at least 5 on each side):");
+    for (const s of measured.slice(0, 10)) {
+      lines.push(`  ${s.repo} \xB7 ${s.workflow} \xB7 ${s.job}: ${formatDuration(s.hostedP50s)} \u2192 ${formatDuration(s.selfHostedP50s)} = ${s.factor}\xD7 (${s.hostedSamples}/${s.selfHostedSamples} runs)`);
+    }
+    if (thin.length > 0) lines.push(`  ${thin.length} more job${thin.length === 1 ? "" : "s"} ran on both but with too few passed runs to measure.`);
+  }
+  const whatIfs = data.whatIfs ?? [];
+  if (whatIfs.length > 0) {
+    lines.push("", "What if (estimated, 30 days):");
+    for (const w of whatIfs.slice(0, 6)) {
+      const to = w.to?.machine ?? w.to?.label ?? w.to?.runnerClass ?? "?";
+      const speed = w.speed?.measured ? `${w.speed.factor}\xD7 measured (${w.speed.samplesFrom}/${w.speed.samplesTo} runs)` : "speed not measured, assuming 1.0";
+      lines.push(`  Move ${w.repo} \xB7 ${w.workflow} to ${to}: ${formatMoney(w.monthCostDelta, w.currency)} a month, ${(w.monthMinutesMoved ?? 0).toLocaleString("en-US")} min moved, ${speed}`);
+      for (const s of (w.stays ?? []).slice(0, 3)) lines.push(`      stays: ${s.job} \u2014 ${s.reason}`);
+      for (const warn of w.warnings ?? []) lines.push(`      ! ${warn}`);
+    }
+  }
+  const advice = data.advice ?? [];
+  if (advice.length > 0) {
+    lines.push("", "Cost advice:");
+    for (const a of advice.slice(0, 6)) {
+      lines.push(`  ${a.severity.toUpperCase().padEnd(7)} ${a.title}`);
+      if (a.evidence) lines.push(`          ${a.evidence}`);
+      if (a.fix) lines.push(`          Fix: ${a.fix}`);
+    }
+  }
+  return lines;
+}
+
+// src/runner/placement.ts
+function targetText(t) {
+  if (!t) return "?";
+  if (t.kind === "github_hosted") return `GitHub-hosted${t.label ? ` (${t.label})` : ""}`;
+  return `self-hosted \u201C${t.label}\u201D`;
+}
+function money(n, currency) {
+  const abs = Math.abs(n).toFixed(2);
+  const v = currency === "USD" ? `$${abs}` : `${abs} ${currency}`;
+  return n < 0 ? `\u2212${v}` : n > 0 ? `+${v}` : v;
+}
+function renderPlacement(data) {
+  const lines = ["Where CI runs (ADR 0037: Mushi changes only LINUX_RUNNER / RUNNER_<WORKFLOW>, with approval)"];
+  const p4 = data.policy;
+  lines.push(
+    p4 ? `  CI agreement: ${p4.noPaidHostedOnPrivate ? "no paid GitHub-hosted minutes on private repos" : "GitHub-hosted allowed"}${p4.sourceNote ? ` (${p4.sourceNote})` : ""}` : "  CI agreement: not recorded (an owner fills it in: console Settings \u2192 CI policy)"
+  );
+  if (data.tokenStored === false) lines.push("  No GitHub token is stored for this project: Mushi cannot read or change variables.");
+  for (const r of data.repos ?? []) {
+    lines.push("", `${r.repo}${r.visibility ? ` (${r.visibility})` : ""}`);
+    if (r.controller) lines.push(`  Managed by ${r.controller.name}${r.controller.owner ? ` (${r.controller.owner})` : ""}: read-only here.`);
+    if (r.workflowsRead === false) lines.push("  Workflow files not read yet.");
+    const vars = r.variables ?? [];
+    if (vars.length === 0 && r.workflowsRead !== false) lines.push("  No job reads a runner variable: every job names its runner in the workflow.");
+    for (const v of vars) {
+      const cur = v.current ? v.current.exists ? `= \u201C${v.current.value}\u201D` : "not set" : "value unknown";
+      const fb = v.fallbacks?.length ? `, else ${v.fallbacks.join(" / ")}` : "";
+      lines.push(`  vars.${v.name} ${cur}  (${v.jobs} job${v.jobs === 1 ? "" : "s"}${fb})${v.allowed === false ? "  [Mushi does not change this one]" : ""}`);
+    }
+    const labels = (r.labels ?? []).filter((l) => l.runners > 0);
+    if (labels.length > 0) lines.push(`  Runner labels: ${labels.map((l) => `${l.label} ${l.online}/${l.runners} online`).join(", ")}`);
+  }
+  const pending = (data.requests ?? []).filter((x) => ["pending_approval", "approved"].includes(x.status));
+  if (pending.length > 0) {
+    lines.push("", "Waiting for an owner or admin in the console:");
+    for (const x of pending) lines.push(`  ${x.id.slice(0, 8)}  ${x.status}  ${x.payload?.repo ?? ""} ${x.payload?.name ?? ""} \u2192 ${x.payload?.value ?? "(remove)"}`);
+  }
+  for (const w of data.watches ?? []) {
+    if (w.status === "watching" || w.status === "alert") {
+      lines.push(`  Watching ${w.repo} ${w.variable}: ${w.status}, ${w.jobs_seen ?? 0}/10 jobs${w.unexpected ? `, ${w.unexpected} on another runner` : ""}${w.slow ? `, ${w.slow} waited over 30 min` : ""}`);
+    }
+  }
+  return lines;
+}
+function renderPreview(p4) {
+  const lines = [];
+  const cur = p4.current ? p4.current.exists ? `\u201C${p4.current.value}\u201D` : "not set" : "unreadable";
+  lines.push(`${p4.repo}: vars.${p4.variable} ${cur} \u2192 ${p4.next?.value === null ? "removed" : `\u201C${p4.next?.value}\u201D`}`);
+  lines.push(`  Jobs that read it run on: ${targetText(p4.now?.target)} \u2192 ${targetText(p4.next?.target)}`);
+  const moves = p4.jobs?.moves ?? [];
+  lines.push(`  Moves (${moves.length}): ${moves.map((m) => `${m.workflow} \xB7 ${m.job}`).join(", ") || "nothing"}`);
+  for (const s of (p4.jobs?.stays ?? []).slice(0, 10)) lines.push(`  Stays: ${s.workflow} \xB7 ${s.job} \u2014 ${s.detail}`);
+  if (p4.target && p4.next?.target.kind === "self_hosted") {
+    lines.push(`  Target: ${p4.target.online}/${p4.target.runners} runner${p4.target.runners === 1 ? "" : "s"} online with \u201C${p4.target.label}\u201D${p4.target.waitP95s != null ? `, wait p95 ${Math.round(p4.target.waitP95s)} s` : ""}`);
+  }
+  if (p4.cost) lines.push(`  Cost: ${money(p4.cost.monthCostDelta, p4.cost.currency)} a month (estimated). ${p4.cost.note}`);
+  if (p4.policy?.controller) lines.push(`  Managed by ${p4.policy.controller.name}${p4.policy.controller.owner ? ` (${p4.policy.controller.owner})` : ""}.`);
+  for (const w of p4.warnings ?? []) lines.push(`  ! ${w}`);
+  if (p4.blocked) lines.push(`  Cannot request: ${p4.blocked.message} (${p4.blocked.code})`);
+  else lines.push("  Ready to request: `mushi runner placement request \u2026` asks; an owner or admin approves and runs it in the console.");
+  return lines;
+}
+
+// src/commands/runner.ts
+var HEARTBEAT_INTERVAL_MS = 12e4;
+function readIfPresent(path) {
+  let fd;
+  try {
+    fd = openSync2(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+  } catch (err) {
+    if (err.code === "ENOENT") return "";
+    throw err;
+  }
+  try {
+    return readFileSync8(fd, "utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function withFd(path, fn) {
+  const fd = openSync2(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+  try {
+    return fn(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
+var defaultRunStep = (step, stdin) => {
+  const argv = step.sudo ? ["sudo", "sh", "-c", step.run] : ["sh", "-c", step.run];
+  const res = spawnSync3(argv[0], argv.slice(1), {
+    stdio: [stdin === void 0 ? "inherit" : "pipe", "inherit", "inherit"],
+    input: stdin
+  });
+  return res.status ?? 1;
+};
+var deps = {
+  host: nodeHostIO,
+  gh: nodeGh,
+  runStep: defaultRunStep,
+  systemdRunning: () => existsSync6("/run/systemd/system"),
+  ghAuthText: () => ghAuthStatus().text
+};
+function hostIdOrThrow() {
+  const raw = readMachineId(deps.host);
+  if (!raw) throw new MushiCliError("E_INVALID_INPUT", "Could not read a machine id on this host.", "Linux and WSL2 need /etc/machine-id; macOS reads IOPlatformUUID.");
+  return hashHostId(raw);
+}
+function readRunnerKeyForHeartbeat(keyFile) {
+  const fromEnv = process.env["MUSHI_RUNNER_KEY"]?.trim();
+  if (fromEnv) return fromEnv;
+  const credDir = process.env["CREDENTIALS_DIRECTORY"];
+  const paths = [
+    ...credDir ? [join12(credDir, RUNNER_KEY_CREDENTIAL)] : [],
+    keyFile ? resolve7(keyFile) : RUNNER_KEY_PATH
+  ];
+  for (const path of paths) {
+    const key = deps.host.readFile(path)?.trim();
+    if (key) return key;
+  }
+  throw new MushiCliError(
+    "E_AUTH_MISSING",
+    `No runner key (MUSHI_RUNNER_KEY, or a readable ${keyFile ?? RUNNER_KEY_PATH}).`,
+    "create one with `mushi runner key` (it can only report runner health; your CLI key is never used here)"
+  );
+}
+async function mintRunnerKeyOnly(config, project, label) {
+  const { key } = await resolveRunnerKey(config, {
+    projectId: project ? requireUuid(project, "project id") : config.projectId,
+    label: label ?? defaultRunnerKeyLabel(deps.host.hostname),
+    env: {}
+  });
+  return key;
+}
+function sleep(ms, signal) {
+  return new Promise((done) => {
+    if (signal.aborted) return done();
+    const t = setTimeout(done, ms);
+    signal.addEventListener("abort", () => {
+      clearTimeout(t);
+      done();
+    }, { once: true });
+  });
+}
+function printPlan(plan, dryRun) {
+  for (const w of plan.warnings) console.log(`WARN  ${w}`);
+  if (plan.warnings.length) console.log("");
+  plan.steps.forEach((step, i) => {
+    console.log(`[${i + 1}/${plan.steps.length}] ${step.title}`);
+    console.log(`  $ ${step.sudo ? "sudo " : ""}sh -c ${JSON.stringify(step.run)}`);
+    if (step.stdinSecret) console.log(`    (stdin: the ${step.stdinSecret === "runner-key" ? "runner key (runner:write)" : "registration token"}, not shown)`);
+    if (step.file && dryRun) {
+      console.log(`    ${step.file.path}:`);
+      for (const line of step.file.content.replace(/\n$/, "").split("\n")) console.log(`      ${line}`);
+    }
+  });
+}
+function printNotes(notes) {
+  if (!notes.length) return;
+  console.log("");
+  for (const n of notes) console.log(n);
+}
+function heartbeatCommand() {
+  const entry = process.argv[1] ? safeRealpath(process.argv[1]) : null;
+  if (entry && !entry.includes("/_npx/") && entry.endsWith(".js")) {
+    return [process.execPath, entry, "runner", "heartbeat", "--once"];
+  }
+  return [join12(dirname5(process.execPath), "npx"), "-y", `@mushi-mushi/cli@${MUSHI_CLI_VERSION}`, "runner", "heartbeat", "--once"];
+}
+function safeRealpath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+function auditLines(a) {
+  const lines = [`${a.repo}`];
+  if (a.runners.length === 0) lines.push("  No self-hosted runners.");
+  for (const r of a.runners) {
+    lines.push(`  ${(r.busy ? "BUSY" : r.status.toUpperCase()).padEnd(8)} ${r.name}  [${r.labels.join(", ")}]${r.setUpByMushi ? "  (Mushi)" : ""}`);
+  }
+  for (const f of a.findings) lines.push(`  ${f.severity.toUpperCase().padEnd(8)} ${f.message}`);
+  return lines;
+}
+function registerRunnerCommands(program2) {
+  const runner = program2.command("runner").description("Where your tests run and why a fix waits to land: CI runners, their machines, and one-command runner setup");
+  runner.command("status").description("Machines, runners, queue and run times, test-machine vs code failures, and what to do first").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--project <id>", "Same as --project-id").option("--all", "Every project your key can read (account-level key)").option("--days <n>", "Window in days (1-30)", "7").option("--refresh", "Read GitHub first instead of the last 10-minute sync (at most once a minute per project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const days = Number(opts.days);
+    if (!Number.isInteger(days) || days < 1 || days > 30) {
+      throw new MushiCliError("E_INVALID_INPUT", "--days must be a whole number from 1 to 30.");
+    }
+    const qs = new URLSearchParams();
+    const raw = opts.all ? void 0 : opts.projectId ?? opts.project ?? config.projectId;
+    if (raw) qs.set("project_id", requireUuid(raw, "project id"));
+    qs.set("days", String(days));
+    if (opts.refresh) qs.set("refresh", "1");
+    const result = await apiCall(`/v1/admin/ci/overview?${qs}`, config, {}, { timeoutMs: opts.refresh ? 6e4 : void 0 });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderOverview(result.data)) console.log(line);
+  });
+  runner.command("compare").description("What CI costs and how fast it runs, per repo: GitHub-hosted vs your own machines, with what-ifs (estimated)").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--project <id>", "Same as --project-id").option("--all", "Every project your key can read (account-level key)").option("--days <n>", "Window in days (1-30)", "30").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Read-only: nothing is changed on GitHub. Wait and run times are measured from
+GitHub's job times; billed minutes and money are estimated from GitHub's list
+prices (dated), your plan's included minutes, and your electricity figures
+(console: Settings \u2192 CI cost).`).action(async (opts) => {
+    const config = requireConfig();
+    const days = Number(opts.days);
+    if (!Number.isInteger(days) || days < 1 || days > 30) {
+      throw new MushiCliError("E_INVALID_INPUT", "--days must be a whole number from 1 to 30.");
+    }
+    const qs = new URLSearchParams();
+    const raw = opts.all ? void 0 : opts.projectId ?? opts.project ?? config.projectId;
+    if (raw) qs.set("project_id", requireUuid(raw, "project id"));
+    qs.set("days", String(days));
+    const result = await apiCall(`/v1/admin/ci/compare?${qs}`, config, {}, { timeoutMs: 6e4 });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderCompare(result.data)) console.log(line);
+  });
+  const placement = runner.command("placement").description("Where each repo's CI runs, and changing it through one runner variable with approval (ADR 0037)");
+  const placementBody = (opts, config) => {
+    if (!opts.remove && !opts.value) throw new MushiCliError("E_INVALID_INPUT", "Pass --value <runner label>, or --remove to delete the variable.");
+    if (opts.remove && opts.value) throw new MushiCliError("E_INVALID_INPUT", "Pass either --value or --remove, not both.");
+    if (!/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(opts.repo)) throw new MushiCliError("E_INVALID_INPUT", "--repo must be owner/repo.");
+    const raw = opts.projectId ?? opts.project ?? config.projectId;
+    if (!raw) throw new MushiCliError("E_INVALID_INPUT", "Pass --project-id (or configure a project).");
+    return { projectId: requireUuid(raw, "project id"), repo: opts.repo, variable: opts.variable, value: opts.remove ? null : opts.value };
+  };
+  placement.command("show").description("Each repo: the runner variables its workflows read and their values, the CI agreement, runner labels, pending requests").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--project <id>", "Same as --project-id").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const raw = opts.projectId ?? opts.project ?? config.projectId;
+    if (!raw) throw new MushiCliError("E_INVALID_INPUT", "Pass --project-id (or configure a project).");
+    const result = await apiCall(`/v1/admin/ci/placement?project_id=${encodeURIComponent(requireUuid(raw, "project id"))}`, config, {}, { timeoutMs: 6e4 });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderPlacement(result.data)) console.log(line);
+  });
+  const placementAction = (verb) => async (opts) => {
+    const config = requireConfig();
+    const body = { ...placementBody(opts, config), ...verb === "request" && opts.reason ? { reason: opts.reason.slice(0, 500) } : {} };
+    const path = verb === "preview" ? "/v1/admin/ci/placement/preview" : "/v1/admin/ci/placement/requests";
+    const result = await apiCall(path, config, { method: "POST", body: JSON.stringify(body) }, { timeoutMs: 6e4 });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    if (verb === "preview") {
+      for (const line of renderPreview(result.data)) console.log(line);
+      return;
+    }
+    const r = result.data;
+    for (const line of renderPreview(r.preview)) console.log(line);
+    console.log(`
+Requested ${r.id} (${r.status}). ${r.next ?? "An owner or admin approves and runs it in the console."}`);
+  };
+  const changeOptions = (cmd) => cmd.requiredOption("--repo <owner/repo>", "Repository connected to the project").option("--variable <name>", "LINUX_RUNNER or RUNNER_<WORKFLOW>", "LINUX_RUNNER").option("--value <label>", "The runner label jobs should ask for").option("--remove", "Remove the variable (jobs use the workflow's fallback, usually GitHub-hosted)").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--project <id>", "Same as --project-id").option("--json", "Machine-readable JSON output");
+  changeOptions(
+    placement.command("preview").description("Dry run: what would move, what stays and why, the target runners, cost, the CI agreement's verdict. Changes nothing")
+  ).action(placementAction("preview"));
+  changeOptions(
+    placement.command("request").description("Ask for the change. Nothing changes until an owner or admin approves and runs it in the console")
+  ).option("--reason <text>", "Why, shown to the approver").action(placementAction("request"));
+  placement.command("revert <requestId>").description("Ask to undo a change that ran (it needs its own approval in the console)").option("--json", "Machine-readable JSON output").action(async (requestId, opts) => {
+    const config = requireConfig();
+    const id = requireUuid(requestId, "request id");
+    const result = await apiCall(`/v1/admin/ci/placement/requests/${id}/revert`, config, { method: "POST" });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Requested revert ${result.data.id} of ${result.data.revertOf} (${result.data.status}). An owner or admin approves and runs it in the console.`);
+  });
+  runner.command("heartbeat").description("Send this machine's memory, swap, load and runner services to Mushi (every 2 minutes, or once)").option("--once", "Send one heartbeat and exit (for a systemd timer or cron)").option("--dry-run", "Print the heartbeat JSON and send nothing").option("--key-file <path>", `File holding the runner key (default ${RUNNER_KEY_PATH})`).addHelpText("after", `
+What is sent: the hostname, platform, CPU count, total memory, a sha256 hash of
+the machine id (never the id), load, memory and swap in use, free disk, and for
+each GitHub runner service: its name, repo, unit name, whether it runs, restarts,
+memory use, memory limit and out-of-memory kills.
+Never sent: file contents, environment values, process arguments, secrets.
+
+It sends with a runner key (scope runner:write), which can only report runner
+health, never your CLI key. The key is read from MUSHI_RUNNER_KEY, the systemd
+credential "${RUNNER_KEY_CREDENTIAL}", --key-file, or ${RUNNER_KEY_PATH}.
+Create one with \`mushi runner key\`.`).action(async (opts) => {
+    const build = () => {
+      try {
+        return collectHeartbeat(deps.host, MUSHI_CLI_VERSION);
+      } catch (err) {
+        if (err instanceof UnsupportedHostError) throw new MushiCliError("E_INVALID_INPUT", err.message);
+        throw err;
+      }
+    };
+    if (opts.dryRun) {
+      console.log(JSON.stringify(build(), null, 2));
+      return;
+    }
+    const cli = loadConfig();
+    const runnerKey = readRunnerKeyForHeartbeat(opts.keyFile);
+    assertNotCliKey(runnerKey, cli.apiKey);
+    const config = { ...cli, apiKey: runnerKey, endpoint: cli.endpoint ?? CLOUD_API_ENDPOINT };
+    const signal = getAbortSignal();
+    for (; ; ) {
+      const body = build();
+      const result = await apiCall("/v1/ingest/runner", config, { method: "POST", body: JSON.stringify(body) });
+      if (opts.once) {
+        if (!result.ok) die(result);
+        console.log(`Sent a heartbeat for ${body.host.hostname} with ${body.runners.length} runner(s).`);
+        return;
+      }
+      if (result.ok) {
+        console.log(`${(/* @__PURE__ */ new Date()).toISOString()} heartbeat sent (${body.runners.length} runner(s)).`);
+      } else {
+        process.stderr.write(`${(/* @__PURE__ */ new Date()).toISOString()} heartbeat failed: ${result.error.code} \u2014 ${result.error.message}
+`);
+      }
+      await sleep(HEARTBEAT_INTERVAL_MS, signal);
+      if (signal.aborted) return;
+    }
+  });
+  const hooks = runner.command("hooks").description("Job hooks that report memory peak and OOM kills for every job");
+  hooks.command("install").description("Write job hooks into a runner folder and turn them on in its .env").requiredOption("--dir <path>", "The runner folder (where config.sh and .runner live)").option("--force", "Replace hooks the runner's .env already points somewhere else").option("--project <id>", "Project the runner key is for (defaults to the configured project)").option("--label <name>", "Label of the runner key (default: this host; shown as runner:<label>)").option("--dry-run", "Show what would be written and change nothing").addHelpText("after", `
+The hooks read the runner's own cgroup (memory.peak, memory.max, oom_kill), swap
+and load, and send one sample per job. They always exit 0, so they never fail a
+job. They send with a runner key (scope runner:write): a key that can only report
+runner health. CI jobs run as the same user as the hooks and could read it; if
+one steals it, all it can do is send fake numbers. Your CLI key never goes here.
+The key comes from MUSHI_RUNNER_KEY, or a new one is created with your CLI key
+(needs mcp:write). It is saved in <dir>/${HOOKS_DIR_NAME}/key with mode 0600,
+never in the scripts, and never printed.
+GitHub docs: https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/run-scripts`).action(async (opts) => {
+    const dir = resolve7(opts.dir);
+    if (!existsSync6(join12(dir, "config.sh")) && !existsSync6(join12(dir, "run.sh"))) {
+      throw new MushiCliError("E_INVALID_INPUT", `${dir} does not look like a runner folder (no config.sh or run.sh).`);
+    }
+    const config = loadConfig();
+    const endpoint = config.endpoint ?? CLOUD_API_ENDPOINT;
+    const hostId = hostIdOrThrow();
+    const hooksDir = join12(dir, HOOKS_DIR_NAME);
+    const files = {
+      started: join12(hooksDir, "job-started.sh"),
+      completed: join12(hooksDir, "job-completed.sh")
+    };
+    const envPath = join12(dir, ".env");
+    const envBefore = readIfPresent(envPath);
+    const merged = mergeRunnerEnv(envBefore, files, opts.force);
+    if (merged.conflicts.length) {
+      for (const c of merged.conflicts) process.stderr.write(`${c.key} already runs ${c.current}
+`);
+      throw new MushiCliError("E_INVALID_INPUT", "The runner's .env already sets a job hook.", "chain it from the Mushi hook yourself, or pass --force to replace it");
+    }
+    if (opts.dryRun) {
+      console.log(`Would write ${files.started} and ${files.completed} (mode 0755), and ${join12(hooksDir, "key")} (mode 0600, a runner:write key, not shown).`);
+      const added = (merged.text ?? "").split("\n").filter((l) => l && !envBefore.split(/\r?\n/).includes(l));
+      console.log(added.length ? `Would add to ${envPath}:
+${added.map((l) => `  ${l}`).join("\n")}` : `${envPath} already has the hooks.`);
+      return;
+    }
+    const { key: runnerKey, source } = await resolveRunnerKey(config, {
+      projectId: opts.project ? requireUuid(opts.project, "project id") : config.projectId,
+      label: opts.label ?? defaultRunnerKeyLabel(deps.host.hostname)
+    });
+    mkdirSync2(hooksDir, { recursive: true, mode: 493 });
+    for (const phase of ["started", "completed"]) {
+      writeFileSync5(files[phase], hookScript({ phase, endpoint, hostId }), { mode: 493 });
+    }
+    const keyPath = join12(hooksDir, "key");
+    writeFileSync5(keyPath, `${runnerKey}
+`, { mode: 384 });
+    console.log(source === "env" ? "Using the runner key from MUSHI_RUNNER_KEY." : "Created a runner key (runner:write: it can only report runner health).");
+    if (merged.text) {
+      const fd = openSync2(envPath, fsConstants.O_RDWR | fsConstants.O_CREAT | (fsConstants.O_NOFOLLOW ?? 0), 420);
+      try {
+        const now = mergeRunnerEnv(readFileSync8(fd, "utf8"), files, opts.force);
+        if (now.conflicts.length) throw new MushiCliError("E_INVALID_INPUT", "The runner's .env changed and now sets a job hook.", "run the command again");
+        if (now.text) {
+          ftruncateSync(fd, 0);
+          writeSync(fd, now.text, 0);
+        }
+      } finally {
+        closeSync2(fd);
+      }
+    }
+    const owner = withFd(dir, (fd) => fstatSync2(fd));
+    const me = process.getuid?.();
+    if (me === 0 && owner.uid !== 0) {
+      for (const path of [hooksDir, files.started, files.completed, keyPath, envPath]) {
+        withFd(path, (fd) => fchownSync(fd, owner.uid, owner.gid));
+      }
+    } else if (me !== void 0 && owner.uid !== me) {
+      console.log(`The runner folder belongs to uid ${owner.uid}. Give it the hook files: sudo chown -R ${owner.uid}:${owner.gid} ${hooksDir}`);
+    }
+    console.log(`Installed the job hooks in ${hooksDir}.`);
+    console.log("Restart the runner service so it reads its .env again, for example:");
+    console.log(`  cd ${dir} && sudo ./svc.sh stop && sudo ./svc.sh start`);
+  });
+  runner.command("key").description("Create a runner key (runner:write) and save it for the heartbeat; it is never printed").option("--project <id>", "Project the key is for (defaults to the configured project)").option("--label <name>", "Key label shown in the console (default: this host; shown as runner:<label>)").option("--out <path>", "Where to save it (mode 0600)", RUNNER_KEY_PATH).addHelpText("after", `
+A runner key can only report runner health. CI jobs on a self-hosted runner can
+read files the runner user can read; if a job steals this key, all it can do is
+send fake numbers. Your CLI key (which can merge pull requests) never goes on a
+runner. Creating one needs a CLI key with mcp:write (mushi login --upgrade-scope).
+${RUNNER_KEY_PATH} is root-only; the heartbeat timer gets it from systemd.`).action(async (opts) => {
+    const config = requireConfig();
+    const key = await mintRunnerKeyOnly(config, opts.project, opts.label);
+    const out = resolve7(opts.out);
+    const dir = dirname5(out);
+    const writable = (() => {
+      try {
+        accessSync(existsSync6(dir) ? dir : dirname5(dir), fsConstants.W_OK);
+        return existsSync6(dir) || process.getuid?.() === 0;
+      } catch {
+        return false;
+      }
+    })();
+    if (writable) {
+      mkdirSync2(dir, { recursive: true, mode: 448 });
+      writeFileSync5(out, `${key}
+`, { mode: 384 });
+      chmodSync(out, 384);
+    } else {
+      const step = {
+        id: "runner-key",
+        title: `Save the runner key to ${out} (root, mode 0600)`,
+        sudo: true,
+        stdinSecret: "runner-key",
+        run: `install -d -m 0700 '${dir.replace(/'/g, `'"'"'`)}' && umask 077 && IFS= read -r k && printf '%s\\n' "$k" > '${out.replace(/'/g, `'"'"'`)}'`
+      };
+      console.log(`$ sudo sh -c ${JSON.stringify(step.run)}   (stdin: the runner key, not shown)`);
+      const code = deps.runStep(step, `${key}
+`);
+      if (code !== 0) throw new MushiCliError("E_INVALID_INPUT", `Could not save the runner key to ${out} (exit ${code}).`, "the new key was not shown; revoke it in the console and run this again");
+    }
+    console.log(`Saved a runner key to ${out}. It can only report runner health.`);
+  });
+  runner.command("add").description("Set this machine up as a GitHub Actions runner for one repo, with safe defaults").requiredOption("--repo <owner/name>", "The repo the runner serves").option("--label <label>", "Runner label workflows opt in with (default mushi-<host>)").option("--memory <size>", "Memory cap for runner jobs, e.g. 8G (default 60% of RAM)").option("--ephemeral", "One job per runner, a fresh runner config per job (default)").option("--persistent", "One long-lived runner that takes job after job").option("--allow-public", "Allow a public repo (fork pull requests would run on this machine)").option("--block-lan", "Block the runner user from your LAN, tailnet and link-local addresses (nftables)").option("--wsl-isolate", "On WSL2: turn off Windows drives and Windows programs for this distro").option("--set-variable", "Set the LINUX_RUNNER repo variable to the label").option("--uid <n>", "uid for the runner user", "1990").option("--user <name>", "Name of the runner user", "gha-runner").option("--project <id>", "Mushi project the runner key is for (defaults to the configured project)").option("--yes", "Run the steps without asking").option("--dry-run", "Print the whole plan and change nothing").addHelpText("after", `
+Safe defaults: private repos only; one job per runner; a dedicated user with no
+admin rights and no view of /home; a memory cap so a build cannot freeze the
+machine; a label of its own so GitHub-hosted runners stay the fallback. Every
+command that needs root runs through sudo and is shown first. Self-hosted
+runners are free on GitHub; this keeps your agents' fix PRs tested on a machine
+you already own when your included minutes run out.
+Docs: https://kensaur.us/mushi-mushi/docs/operating/ci-runners`).action(async (opts) => {
+    if (opts.ephemeral && opts.persistent) throw new MushiCliError("E_INVALID_INPUT", "Pick --ephemeral or --persistent, not both.");
+    const host = deps.host;
+    const platform = detectPlatform(host);
+    const config = loadConfig();
+    const endpoint = config.endpoint ?? CLOUD_API_ENDPOINT;
+    const archName = runnerArch(nodeArch());
+    const gh = deps.gh;
+    const repo = opts.repo.trim();
+    const preflight = platform === "windows" || !/^[\w.-]+\/[\w.-]+$/.test(repo) ? { isPublic: null, forkApproval: null, prTargetWorkflows: null, release: null, keyring: false } : {
+      isPublic: repoIsPublic(gh, repo),
+      forkApproval: forkApprovalPolicy(gh, repo),
+      prTargetWorkflows: prTargetWorkflows(gh, repo),
+      release: archName && platform !== "macos" ? latestRunnerRelease(gh, `linux-${archName}`) : null,
+      keyring: /keyring/i.test(deps.ghAuthText())
+    };
+    const rawId = platform === "windows" ? null : readMachineId(host);
+    const meminfo = host.readFile("/proc/meminfo") ?? "";
+    const totalMb = Number(meminfo.match(/^MemTotal:\s+(\d+)/m)?.[1] ?? 0) / 1024 || host.totalMemBytes / 1024 / 1024;
+    const plan = buildAddPlan({
+      repo,
+      label: opts.label ?? defaultLabel(host.hostname),
+      mode: opts.persistent ? "persistent" : "ephemeral",
+      platform,
+      arch: archName,
+      memoryMax: opts.memory ?? defaultMemory(totalMb),
+      runnerUser: opts.user,
+      uid: Number(opts.uid),
+      installUser: userInfo().username,
+      release: preflight.release,
+      endpoint,
+      hostId: rawId ? hashHostId(rawId) : "",
+      heartbeatCommand: heartbeatCommand(),
+      blockLan: opts.blockLan === true,
+      resolvers: parseResolvers(host.readFile("/etc/resolv.conf") ?? ""),
+      systemdRunning: deps.systemdRunning(),
+      wsl: platform === "wsl2" ? { distro: process.env["WSL_DISTRO_NAME"] ?? null, wslConf: host.readFile("/etc/wsl.conf") ?? "", isolate: opts.wslIsolate === true } : null,
+      setVariable: opts.setVariable === true,
+      isPublic: preflight.isPublic,
+      allowPublic: opts.allowPublic === true,
+      forkApproval: preflight.forkApproval,
+      prTargetWorkflows: preflight.prTargetWorkflows,
+      ghTokenInKeyring: preflight.keyring
+    });
+    if (outputIsJson()) {
+      console.log(JSON.stringify(plan, null, 2));
+      return;
+    }
+    if (plan.refused) {
+      for (const w of plan.warnings) console.log(`WARN  ${w}`);
+      printNotes(plan.notes);
+      throw new MushiCliError("E_INVALID_INPUT", plan.refused, "nothing was changed");
+    }
+    printPlan(plan, opts.dryRun === true);
+    if (opts.dryRun || plan.steps.length === 0) {
+      printNotes(plan.notes);
+      if (opts.dryRun) console.log("\nDry run: nothing was changed.");
+      return;
+    }
+    if (!opts.yes) {
+      if (!process.stdin.isTTY) throw new MushiCliError("E_INVALID_INPUT", "Not a terminal, so nothing was run.", "re-run with --yes, or with --dry-run to review the plan");
+      const go = await p3.confirm({ message: `Run these ${plan.steps.length} steps? sudo will ask for your password.` });
+      if (go !== true) {
+        console.log("Nothing was changed.");
+        return;
+      }
+    }
+    let runnerKey = null;
+    if (plan.steps.some((s) => s.stdinSecret === "runner-key")) {
+      const resolved = await resolveRunnerKey(config, {
+        projectId: opts.project ? requireUuid(opts.project, "project id") : config.projectId,
+        label: defaultRunnerKeyLabel(host.hostname)
+      });
+      runnerKey = resolved.key;
+      console.log(resolved.source === "env" ? "Using the runner key from MUSHI_RUNNER_KEY." : "Created a runner key (runner:write: it can only report runner health).");
+    }
+    for (const [i, step] of plan.steps.entries()) {
+      console.log(`
+[${i + 1}/${plan.steps.length}] ${step.title}`);
+      let stdin;
+      if (step.file) stdin = step.file.content;
+      if (step.stdinSecret === "runner-key") stdin = `${runnerKey}
+`;
+      if (step.stdinSecret === "registration-token") {
+        const tok = registrationToken(gh, repo);
+        if (!tok.ok) throw new MushiCliError("E_INVALID_INPUT", `Could not get a registration token: ${tok.error}`, "your gh login needs Administration: write on the repo");
+        stdin = `${tok.stdout.trim()}
+`;
+      }
+      const code = deps.runStep(step, stdin);
+      if (code !== 0) {
+        throw new MushiCliError("E_INVALID_INPUT", `Step ${i + 1} (${step.id}) failed with exit code ${code}. Later steps did not run.`, "fix the cause and run the same command again: the steps are safe to repeat");
+      }
+    }
+    console.log("\nDone.");
+    printNotes(plan.notes);
+  });
+  runner.command("audit").description("List the self-hosted runners on your repos and flag the ones to look at").option("--repo <owner/name>", "One repo (default: the repo of this folder)").option("--all", "Every repo your gh login lists (up to 200)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const gh = deps.gh;
+    let repos;
+    if (opts.all) {
+      const list = listOwnRepos(gh);
+      if (!list) throw new MushiCliError("E_INVALID_INPUT", "Could not list your repos with gh.", "run `gh auth login` first");
+      repos = list;
+    } else {
+      const one = opts.repo ?? currentRepo(gh);
+      if (!one) throw new MushiCliError("E_INVALID_INPUT", "Which repo?", "pass --repo owner/name, or --all");
+      repos = [one];
+    }
+    let heartbeatRunners = null;
+    const config = loadConfig();
+    if (config.apiKey) {
+      const qs = config.projectId ? `?project_id=${encodeURIComponent(config.projectId)}&days=7` : "?days=7";
+      const ov = await apiCall(`/v1/admin/ci/overview${qs}`, { ...config, endpoint: config.endpoint ?? CLOUD_API_ENDPOINT });
+      if (ov.ok) {
+        heartbeatRunners = /* @__PURE__ */ new Set();
+        for (const h of ov.data.hosts ?? []) {
+          for (const r of h["runners"] ?? []) if (r.name) heartbeatRunners.add(r.name);
+        }
+      }
+    }
+    const audits = [];
+    for (const repo of repos) {
+      const { runners, error } = listRunners(gh, repo);
+      if (opts.all && runners !== null && runners.length === 0) continue;
+      audits.push(auditRepo({
+        repo,
+        runners,
+        runnersError: error,
+        heartbeatRunners,
+        forkApproval: forkApprovalPolicy(gh, repo),
+        prTargetWorkflows: prTargetWorkflows(gh, repo),
+        isPublic: repoIsPublic(gh, repo)
+      }));
+    }
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify({ repos: audits }, null, 2));
+    } else {
+      if (audits.length === 0) console.log(`No self-hosted runners on ${repos.length} repo(s).`);
+      for (const a of audits) for (const line of auditLines(a)) console.log(line);
+    }
+    if (audits.some((a) => a.findings.some((f) => f.severity === "critical"))) process.exitCode = 1;
+  });
+}
+
+// src/commands/verify.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, resolve as resolve8 } from "path";
+var WORKFLOW_MAX_BYTES = 64 * 1024;
+var WORKFLOW_SHAPE = /uses:\s*kensaurus\/mushi-mushi\/\.github\/actions\/fix-verify@/;
+var VERIFY_WORKFLOW_PATH = ".github/workflows/mushi-verify.yml";
+function registerVerifyCommands(program2) {
+  const verify = program2.command("verify").description("Verified merge: the workflow that proves an agent fix with a test (see also `mushi fixes verify`)");
+  verify.command("workflow").description(`Print the mushi-verify workflow for this project, or write it with --out (save as ${VERIFY_WORKFLOW_PATH})`).option("--project <id>", "Project ID (defaults to the configured project)").option("--out <path>", `Write the YAML to this file, e.g. ${VERIFY_WORKFLOW_PATH}`).option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi verify workflow                              # print it
+  mushi verify workflow --out ${VERIFY_WORKFLOW_PATH}
+
+The runner labels and test command come from the console: Settings \u2192 Fixes \u2192
+Verified merge. Docs: https://kensaur.us/mushi-mushi/docs/admin/verified-merge`).action(async (opts) => {
+    const config = requireConfig();
+    const projectId2 = resolveProjectId(opts.project, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${projectId2}/verify-workflow`, config);
+    if (!result.ok) die(result);
+    const yaml = result.data?.yaml;
+    if (typeof yaml !== "string" || !yaml.trim()) {
+      throw new MushiCliError("E_API_ERROR", "The server sent no workflow.", "Update the CLI (mushi upgrade) or copy it from the console: Settings \u2192 Fixes \u2192 Verified merge.");
+    }
+    const text2 = yaml.endsWith("\n") ? yaml : `${yaml}
+`;
+    if (text2.length > WORKFLOW_MAX_BYTES || !WORKFLOW_SHAPE.test(text2) || text2.includes("\0")) {
+      throw new MushiCliError("E_API_ERROR", "The server sent something that is not the Mushi verify workflow.", "Copy it from the console instead: Settings \u2192 Fixes \u2192 Verified merge.");
+    }
+    const out = opts.out ? resolve8(opts.out) : null;
+    if (out && !/\.ya?ml$/i.test(out)) {
+      throw new MushiCliError("E_INVALID_INPUT", `--out must be a .yml or .yaml file: ${out}`, "For example: --out .github/workflows/mushi-verify.yml");
+    }
+    if (out) {
+      mkdirSync3(dirname6(out), { recursive: true });
+      writeFileSync6(out, text2);
+    }
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify({ ok: true, projectId: projectId2, yaml: text2, ...out ? { path: out } : {} }, null, 2));
+      return;
+    }
+    if (!out) {
+      process.stdout.write(text2);
+      return;
+    }
+    console.log(`Wrote ${out}.`);
+    console.log('Commit it to your default branch. Agent PRs then get a "Mushi verify" check.');
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).option("--profile <name>", "Use a named credential profile for this invocation (or set MUSHI_PROFILE)").option("-o, --output <format>", "Output format: text | json", "text").hook("preAction", (_thisCommand, actionCommand) => {
@@ -10897,6 +13108,8 @@ registerSpendCommands(program);
 registerDesignCommands(program);
 registerUxCommands(program);
 registerUxRunsCommands(program);
+registerRunnerCommands(program);
+registerVerifyCommands(program);
 registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
   printAndExit(err);