@mutmutco/cli 0.9.0 → 0.10.0

package/dist/index.cjs

@@ -3052,6 +3052,18 @@ function needsUpdate(source, current) {
 function isRulesSource(orgRulesSource) {
   return orgRulesSource === "self";
 }
+function rulesSourceAuthHeaders(sourceUrl, token) {
+  if (!token) return void 0;
+  try {
+    const host = new URL(sourceUrl).hostname.toLowerCase();
+    if (host === "raw.githubusercontent.com" || host === "api.github.com") {
+      return { Authorization: `Bearer ${token}` };
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
 
 // src/saga-capture.ts
 function parseHookInput(stdin) {
@@ -3066,7 +3078,7 @@ function parseHookInput(stdin) {
 // src/index.ts
 var import_node_child_process4 = require("node:child_process");
 var import_node_util3 = require("node:util");
-var import_node_path3 = require("node:path");
+var import_node_path4 = require("node:path");
 
 // src/saga-head-maintainer.ts
 var import_node_child_process = require("node:child_process");
@@ -3099,13 +3111,18 @@ function markHeadRun(path, now = Date.now()) {
 }
 function headPrompt(state) {
   return [
-    "You maintain two durable slots of a work-session: GOAL (the current objective) and PINNED (things",
-    "worth remembering). Given the CURRENT HEAD and the recent TRANSCRIPT + DECISIONS, return an updated",
-    "GOAL and PINNED only. Keep them tight and concrete; keep anything the user pinned; never invent;",
-    "preserve Turkish characters (\xE7 \u011F \u0131 \u0130 \xF6 \u015F \xFC) exactly. Do NOT manage next or the checklist \u2014 the note",
-    "path owns those. Never restate an unverified artifact-claim (a named file, PR, flag, or board state)",
+    "You maintain ONE durable slot of a work-session: PINNED (things worth remembering). Given the CURRENT",
+    "HEAD and the recent TRANSCRIPT + DECISIONS, return an updated PINNED only. Keep it tight and concrete;",
+    "keep anything the user pinned; never invent; preserve Turkish characters (\xE7 \u011F \u0131 \u0130 \xF6 \u015F \xFC) exactly. Do",
+    "NOT manage next or the checklist \u2014 the note path owns those. The ANCHOR is the read-only North-Star \u2014",
+    "NEVER change it. Never restate an unverified artifact-claim (a named file, PR, flag, or board state)",
     "as settled fact \u2014 keep it as the belief it was recorded as.",
-    'Output ONLY a JSON object: {"goal":string,"pinned":[string]}.',
+    "You MAY also propose supersessions: each DECISION is shown with a stable 0-based index. Propose a",
+    "supersession ONLY for a NEWER decision that directly contradicts/replaces an OLDER one where neither",
+    "already carries a supersededBy. HIGH PRECISION \u2014 propose ONLY when you are confident the older claim",
+    "is now false or obsolete; the newer decision's timestamp MUST be later than the older's (newer-supersedes-",
+    "older only, never the reverse). When unsure, propose nothing. NEVER touch the anchor, next, or checklist.",
+    'Output ONLY a JSON object: {"pinned":[string],"supersede":[{"older":int,"newer":int,"reason":string}]}.',
     "",
     "CURRENT HEAD:",
     JSON.stringify(state.head ?? {}, null, 2),
@@ -3114,7 +3131,7 @@ function headPrompt(state) {
     JSON.stringify(state.actionLog ?? []),
     "",
     "DECISIONS:",
-    (state.decisions ?? []).map((d) => `- ${d}`).join("\n") || "(none)"
+    (state.decisions ?? []).map((d, i) => `[${i}] ${d}`).join("\n") || "(none)"
   ].join("\n");
 }
 function parseHeadUpdate(raw) {
@@ -3128,8 +3145,15 @@ function parseHeadUpdate(raw) {
   }
   if (!obj || typeof obj !== "object") return null;
   const u = {};
-  if (typeof obj.goal === "string") u.goal = obj.goal;
   if (Array.isArray(obj.pinned)) u.pinned = obj.pinned.filter((x) => typeof x === "string");
+  if (Array.isArray(obj.supersede)) {
+    const supersede = obj.supersede.filter((e) => {
+      if (!e || typeof e !== "object") return false;
+      const { older, newer, reason } = e;
+      return Number.isInteger(older) && older >= 0 && Number.isInteger(newer) && newer >= 0 && older !== newer && typeof reason === "string" && reason.length > 0;
+    }).map((e) => ({ older: e.older, newer: e.newer, reason: e.reason }));
+    if (supersede.length) u.supersede = supersede;
+  }
   return Object.keys(u).length ? u : null;
 }
 async function runHeadEngine(prompt, timeoutMs = HEAD_ENGINE_TIMEOUT_MS) {
@@ -3246,11 +3270,12 @@ function buildNoteCapture(summary, o, id, evidence) {
   const queueOp = o.queueAdd ? { op: "add", text: o.queueAdd } : o.queueDone != null ? { op: "done", index: Number(o.queueDone) } : void 0;
   const state = o.diagnostic ? "diagnostic" : o.verified ? "verified" : "asserted";
   const source = o.diagnostic ? "probe" : "note";
-  const anchor = {};
-  if (evidence.sha) anchor.sha = evidence.sha;
-  if (evidence.branch) anchor.branch = evidence.branch;
-  if (evidence.pr) anchor.pr = evidence.pr;
-  if (evidence.file) anchor.file = evidence.file;
+  const ev = {};
+  if (evidence.sha) ev.sha = evidence.sha;
+  if (evidence.branch) ev.branch = evidence.branch;
+  if (evidence.pr) ev.pr = evidence.pr;
+  if (evidence.file) ev.file = evidence.file;
+  const anchor = o.anchor ? { intent: o.anchor, setAt: (/* @__PURE__ */ new Date()).toISOString() } : void 0;
   return {
     event: "note",
     id,
@@ -3260,14 +3285,17 @@ function buildNoteCapture(summary, o, id, evidence) {
     queueOp,
     state,
     source,
-    evidence: Object.keys(anchor).length ? anchor : void 0,
-    surface: process.env.MMI_AGENT_SURFACE || "claude"
+    evidence: Object.keys(ev).length ? ev : void 0,
+    surface: process.env.MMI_AGENT_SURFACE || "claude",
+    supersedes: o.supersedes,
+    anchor,
+    anchorForce: o.anchorForce || void 0
   };
 }
 
 // src/version-lag.ts
 var VERSION_LABEL = "installed plugin/adapter cache freshness";
-var VERSION_FIX = "refresh/update the MMI plugin, or run the repo-local CLI: node cli/dist/index.cjs doctor --json";
+var VERSION_FIX = "update the MMI plugin via /plugin; standalone npm CLI: npm install -g @mutmutco/cli@latest";
 function parseVersion(v) {
   return v.replace(/^v/, "").split(/[.-]/).slice(0, 3).map((part) => {
     const n = Number.parseInt(part, 10);
@@ -3824,31 +3852,31 @@ function parseWorktreePorcelain(stdout) {
   }
   return out;
 }
-function formatGcPlan(plan, apply) {
+function formatGcPlan(plan2, apply) {
   const lines = [`mmi-cli gc: ${apply ? "apply" : "dry-run"}`];
-  if (!plan.branches.length && !plan.trackingRefs.length) lines.push("nothing to clean");
-  if (plan.branches.length) {
+  if (!plan2.branches.length && !plan2.trackingRefs.length) lines.push("nothing to clean");
+  if (plan2.branches.length) {
     lines.push("local branches:");
-    for (const b of plan.branches) {
+    for (const b of plan2.branches) {
       const prs = b.prNumbers.length ? ` #${b.prNumbers.join(",#")}` : "";
       const wt = b.worktreePath ? ` (worktree: ${b.worktreePath})` : "";
       lines.push(` - ${b.branch} (${b.prState}${prs})${wt}`);
     }
   }
-  if (plan.trackingRefs.length) {
+  if (plan2.trackingRefs.length) {
     lines.push("stale tracking refs:");
-    for (const r of plan.trackingRefs) {
+    for (const r of plan2.trackingRefs) {
       const prs = r.prNumbers.length ? ` #${r.prNumbers.join(",#")}` : "";
       lines.push(` - ${r.ref} (${r.prState}${prs})`);
     }
   }
-  if (plan.skipped.length) {
+  if (plan2.skipped.length) {
     lines.push("skipped:");
-    for (const s of plan.skipped) {
+    for (const s of plan2.skipped) {
       lines.push(` - ${s.branch}: ${s.reason}${s.detail ? ` (${s.detail})` : ""}`);
     }
   }
-  if (!apply && (plan.branches.length || plan.trackingRefs.length)) lines.push("rerun with --apply to delete only the listed items");
+  if (!apply && (plan2.branches.length || plan2.trackingRefs.length)) lines.push("rerun with --apply to delete only the listed items");
   return lines.join("\n");
 }
 
@@ -4037,7 +4065,25 @@ async function runStage(config = {}, opts = {}) {
 
 // src/bootstrap-verify.ts
 var requiredDocs = ["README.md", "architecture.md", "AGENTS.md", "CLAUDE.md", ".claude/settings.json", ".mmi/config.json"];
-var requiredLabels = ["bug", "feature", "task"];
+var requiredIssueTemplates = [
+  ".github/ISSUE_TEMPLATE/bug.yml",
+  ".github/ISSUE_TEMPLATE/feature.yml",
+  ".github/ISSUE_TEMPLATE/task.yml",
+  ".github/ISSUE_TEMPLATE/config.yml"
+];
+var requiredWorkflows = [".github/workflows/pr-to-board.yml"];
+var requiredLabels = ["bug", "feature", "task", "priority:high", "priority:medium", "priority:low"];
+var requiredStatusOptions = ["Todo", "In Progress", "In Review", "Done"];
+var requiredProjectWorkflows = [
+  "Auto-add sub-issues to project",
+  "Auto-close issue",
+  "Item added to project",
+  "Item closed",
+  "Pull request linked to issue",
+  "Pull request merged"
+];
+var requiredActionsVariables = ["MMI_APP_ID"];
+var requiredActionsSecrets = ["MMI_APP_PRIVATE_KEY"];
 function expectedBranches(repoClass) {
   return repoClass === "content" ? ["main"] : ["development", "rc", "main"];
 }
@@ -4064,6 +4110,20 @@ async function contentExists(deps, repo, branch, path) {
     return false;
   }
 }
+async function contentText(deps, repo, branch, path) {
+  try {
+    const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+    const response = safeJson(
+      (await deps.gh(["api", `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`])).stdout,
+      {}
+    );
+    if (response.content == null) return null;
+    if (response.encoding != null && response.encoding !== "base64") return null;
+    return Buffer.from(response.content.replace(/\s/g, ""), "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
 async function protectedBranch(deps, repo, branch) {
   try {
     await deps.gh(["api", `repos/${repo}/branches/${branch}/protection`]);
@@ -4072,6 +4132,9 @@ async function protectedBranch(deps, repo, branch) {
     return false;
   }
 }
+function optionDetail(missing) {
+  return missing.length === 0 ? void 0 : `missing: ${missing.join(", ")}`;
+}
 function localRegistryCheck(deps, path, predicate) {
   const text = deps.readLocalFile?.(path);
   if (text == null) return null;
@@ -4094,14 +4157,86 @@ async function verifyBootstrap(repo, repoClass, deps) {
   for (const path of requiredDocs) {
     checks.push({ ok: await contentExists(deps, repo, baseBranch, path), label: `bootstrap artifact exists: ${path}` });
   }
+  for (const path of requiredIssueTemplates) {
+    checks.push({ ok: await contentExists(deps, repo, baseBranch, path), label: `issue template exists: ${path}` });
+  }
+  for (const path of requiredWorkflows) {
+    checks.push({ ok: await contentExists(deps, repo, baseBranch, path), label: `automation workflow exists: ${path}` });
+  }
   checks.push({ ok: await contentExists(deps, repo, baseBranch, ".cursor/environment.json"), label: "Cursor environment committed" });
-  const labels = await ghJson(deps, ["label", "list", "--repo", repo, "--json", "name"], []);
+  const labels = await ghJson(deps, ["label", "list", "--repo", repo, "--limit", "200", "--json", "name"], []);
   const labelNames = new Set(labels.map((l) => l.name));
   for (const label of requiredLabels) {
     checks.push({ ok: labelNames.has(label), label: `label exists: ${label}` });
   }
   const actions = await ghJson(deps, ["api", `repos/${repo}/actions/permissions`], {});
   checks.push({ ok: actions.enabled === true, label: "GitHub Actions enabled" });
+  const variables = await ghJson(deps, ["variable", "list", "--repo", repo, "--json", "name"], []);
+  const variableNames = new Set(variables.map((v) => v.name));
+  for (const variable of requiredActionsVariables) {
+    checks.push({ ok: variableNames.has(variable), label: `Actions variable exists: ${variable}` });
+  }
+  const secrets = await ghJson(deps, ["secret", "list", "--repo", repo, "--json", "name"], []);
+  const secretNames = new Set(secrets.map((s) => s.name));
+  for (const secret of requiredActionsSecrets) {
+    checks.push({ ok: secretNames.has(secret), label: `Actions secret exists: ${secret}` });
+  }
+  const config = safeJson(await contentText(deps, repo, baseBranch, ".mmi/config.json") || "", null);
+  checks.push({
+    ok: Boolean(config?.projectOwner && config?.projectNumber),
+    label: ".mmi project board config exists"
+  });
+  if (config?.projectOwner && config.projectNumber != null) {
+    const project = await ghJson(
+      deps,
+      ["project", "field-list", String(config.projectNumber), "--owner", config.projectOwner, "--format", "json"],
+      {}
+    );
+    const fields = project.fields || [];
+    const statusField = fields.find((field) => field.name === "Status");
+    const labelField = fields.find((field) => field.name === "Labels");
+    checks.push({
+      ok: Boolean(statusField),
+      label: `Project Status field exists: ${config.projectOwner}#${config.projectNumber}`
+    });
+    checks.push({
+      ok: Boolean(labelField),
+      label: `Project Labels field exists: ${config.projectOwner}#${config.projectNumber}`
+    });
+    if (statusField != null) {
+      const optionNames = new Set((statusField.options || []).map((option) => option.name));
+      const missingOptions = requiredStatusOptions.filter((option) => !optionNames.has(option));
+      checks.push({
+        ok: missingOptions.length === 0,
+        label: "Project Status lanes configured",
+        detail: optionDetail(missingOptions)
+      });
+      checks.push({
+        ok: config.statusFieldId === statusField.id,
+        label: ".mmi statusFieldId matches project"
+      });
+      for (const optionName of requiredStatusOptions) {
+        const projectOption = statusField.options?.find((option) => option.name === optionName);
+        checks.push({
+          ok: Boolean(projectOption?.id && config.statusOptions?.[optionName] === projectOption.id),
+          label: `.mmi status option matches project: ${optionName}`
+        });
+      }
+    }
+    const workflowQuery = "query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { workflows(first: 30) { nodes { name enabled } } } } }";
+    const workflowResponse = await ghJson(
+      deps,
+      ["api", "graphql", "-f", `query=${workflowQuery}`, "-f", `login=${config.projectOwner}`, "-F", `number=${config.projectNumber}`],
+      {}
+    );
+    const workflows = workflowResponse.data?.organization?.projectV2?.workflows?.nodes || [];
+    for (const workflowName of requiredProjectWorkflows) {
+      checks.push({
+        ok: workflows.some((workflow) => workflow.name === workflowName && workflow.enabled === true),
+        label: `Project workflow enabled: ${workflowName}`
+      });
+    }
+  }
   const fanout = repo === "mutmutco/MMI-Hub" ? true : localRegistryCheck(deps, ".github/fanout-targets.json", (json) => Array.isArray(json?.repos) && json.repos.some((r) => r.repo === repo.split("/")[1] && r.branch === baseBranch));
   if (fanout != null) checks.push({ ok: fanout, label: `fanout target registered on ${baseBranch}` });
   const projectRegistry = localRegistryCheck(deps, "projects.json", (json) => Array.isArray(json?.projects) && json.projects.some((p) => (p.repos || []).includes(repo)));
@@ -4111,11 +4246,151 @@ async function verifyBootstrap(repo, repoClass, deps) {
 function renderBootstrapVerifyReport(report) {
   const lines = [`mmi-cli bootstrap verify: ${report.ok ? "OK" : "CHECK"} ${report.repo} (${report.class}, ${report.baseBranch})`];
   for (const check of report.checks) {
-    lines.push(`${check.ok ? "\u2713" : "\u2717"} ${check.label}${check.detail ? ` \u2014 ${check.detail}` : ""}`);
+    lines.push(`${check.ok ? "OK" : "FAIL"} ${check.label}${check.detail ? ` - ${check.detail}` : ""}`);
   }
   return lines.join("\n");
 }
 
+// src/plan.ts
+var import_node_path3 = require("node:path");
+var PLANS_DIR = "plans";
+var META_FILE = (0, import_node_path3.join)(PLANS_DIR, ".plan-meta.json");
+var planPath = (slug) => (0, import_node_path3.join)(PLANS_DIR, `${slug}.md`);
+var metaKey = (project, slug) => `${project}/${slug}`;
+function parseMeta(raw) {
+  if (!raw) return {};
+  try {
+    const o = JSON.parse(raw);
+    return o && typeof o === "object" ? o : {};
+  } catch {
+    return {};
+  }
+}
+function serializeMeta(meta) {
+  return JSON.stringify(meta, null, 2) + "\n";
+}
+function hashContent(s) {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(16);
+}
+function staleHint(slug) {
+  return `remote "${slug}" is newer \u2014 run \`mmi-cli plan pull ${slug}\` first (your local is based on an older version), or re-push with \`--force\` to overwrite`;
+}
+function formatPlanList(plans) {
+  return plans.map((p) => `${p.slug}  \xB7  ${p.updatedAt ?? "-"}  \xB7  ${p.project}`).join("\n");
+}
+var TIMEOUT_MS = 8e3;
+async function planPush(deps, slug, opts = {}) {
+  const raw = deps.readLocal(slug);
+  if (raw == null) {
+    deps.err(`no local ${planPath(slug)} to push`);
+    return;
+  }
+  const content = normalizeEol(raw);
+  const project = opts.project ?? await deps.project();
+  const meta = parseMeta(deps.readMetaRaw());
+  const entry = meta[metaKey(project, slug)];
+  const body = { project, slug, content };
+  if (opts.force) body.force = true;
+  else if (entry?.etag) body.baseEtag = entry.etag;
+  const res = await deps.fetch(`${deps.apiUrl}/plan/put`, {
+    method: "POST",
+    headers: await deps.headers({ "content-type": "application/json" }),
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(TIMEOUT_MS)
+  });
+  if (res.ok) {
+    const out = await res.json();
+    meta[metaKey(project, slug)] = { etag: out.etag, hash: hashContent(content), syncedAt: deps.now() };
+    deps.writeMetaRaw(serializeMeta(meta));
+    deps.log(`pushed ${slug}`);
+  } else if (res.status === 409) {
+    deps.err(staleHint(slug));
+  } else {
+    deps.err(`plan push failed: HTTP ${res.status}`);
+  }
+}
+async function planPull(deps, slug, opts = {}) {
+  const project = opts.project ?? await deps.project();
+  const meta = parseMeta(deps.readMetaRaw());
+  const entry = meta[metaKey(project, slug)];
+  const local = deps.readLocal(slug);
+  if (local != null && entry && !opts.force && hashContent(normalizeEol(local)) !== entry.hash) {
+    deps.err(`local ${planPath(slug)} has unpushed edits \u2014 push it, or pull with --force to overwrite`);
+    return;
+  }
+  const qs = new URLSearchParams({ project, slug }).toString();
+  const res = await deps.fetch(`${deps.apiUrl}/plan/get?${qs}`, {
+    method: "GET",
+    headers: await deps.headers(),
+    signal: AbortSignal.timeout(TIMEOUT_MS)
+  });
+  if (res.status === 404) {
+    deps.err(`no plan "${slug}" found on the server`);
+    return;
+  }
+  if (!res.ok) {
+    deps.err(`plan pull failed: HTTP ${res.status}`);
+    return;
+  }
+  const doc = await res.json();
+  const content = normalizeEol(doc.content ?? "");
+  deps.writeLocal(slug, content);
+  meta[metaKey(project, slug)] = { etag: doc.etag, hash: hashContent(content), syncedAt: deps.now() };
+  deps.writeMetaRaw(serializeMeta(meta));
+  deps.log(`pulled ${slug} \u2192 ${planPath(slug)}`);
+}
+async function planList(deps, opts = {}) {
+  const qs = opts.project ? `?${new URLSearchParams({ project: opts.project }).toString()}` : "";
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/plan/list${qs}`, {
+      method: "GET",
+      headers: await deps.headers(),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+  } catch (e) {
+    if (!opts.quiet) deps.err(`plan list: ${e.message}`);
+    return;
+  }
+  if (!res.ok) {
+    if (!opts.quiet) deps.err(`plan list failed: HTTP ${res.status}`);
+    return;
+  }
+  const { plans } = await res.json();
+  if (opts.json) {
+    deps.log(JSON.stringify(plans));
+    return;
+  }
+  if (!plans.length) {
+    if (!opts.quiet) deps.log("no plans");
+    return;
+  }
+  deps.log(formatPlanList(plans));
+}
+async function planDelete(deps, slug, opts = {}) {
+  const project = opts.project ?? await deps.project();
+  const res = await deps.fetch(`${deps.apiUrl}/plan/delete`, {
+    method: "POST",
+    headers: await deps.headers({ "content-type": "application/json" }),
+    body: JSON.stringify({ project, slug }),
+    signal: AbortSignal.timeout(TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    deps.err(`plan delete failed: HTTP ${res.status}`);
+    return;
+  }
+  deps.removeLocal(slug);
+  const meta = parseMeta(deps.readMetaRaw());
+  delete meta[metaKey(project, slug)];
+  deps.writeMetaRaw(serializeMeta(meta));
+  deps.log(`deleted ${slug}`);
+}
+
 // src/index.ts
 var execFileP3 = (0, import_node_util3.promisify)(import_node_child_process4.execFile);
 var GIT_TIMEOUT_MS = 1e4;
@@ -4250,25 +4525,25 @@ async function gcPlan(remote, limit) {
     remote
   });
 }
-async function applyGcPlan(plan, remote) {
-  for (const branch of plan.branches) {
+async function applyGcPlan(plan2, remote) {
+  for (const branch of plan2.branches) {
     if (branch.worktreePath) await execFileP3("git", ["worktree", "remove", branch.worktreePath], { timeout: GIT_TIMEOUT_MS });
     await execFileP3("git", ["branch", "-D", branch.branch], { timeout: GIT_TIMEOUT_MS });
   }
-  for (const ref of plan.trackingRefs) {
+  for (const ref of plan2.trackingRefs) {
     await execFileP3("git", ["update-ref", "-d", `refs/remotes/${remote}/${ref.branch}`], { timeout: GIT_TIMEOUT_MS });
   }
-  if (plan.branches.some((b) => b.worktreePath)) {
+  if (plan2.branches.some((b) => b.worktreePath)) {
     await execFileP3("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS });
   }
 }
 function resolveVersion() {
   try {
-    const manifest = (0, import_node_path3.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
+    const manifest = (0, import_node_path4.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
     return JSON.parse((0, import_node_fs3.readFileSync)(manifest, "utf8")).version || "0.0.0";
   } catch {
     try {
-      const pkg = (0, import_node_path3.join)(__dirname, "..", "package.json");
+      const pkg = (0, import_node_path4.join)(__dirname, "..", "package.json");
       return JSON.parse((0, import_node_fs3.readFileSync)(pkg, "utf8")).version || "0.0.0";
     } catch {
       return "0.0.0";
@@ -4277,7 +4552,7 @@ function resolveVersion() {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path4.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -4303,11 +4578,13 @@ rules.command("sync").option("--quiet", "stay silent unless something changed or
     return;
   }
   const base = (cfg.orgRulesSource ?? DEFAULT_RULES_SOURCE).replace(/\/$/, "");
+  const token = await githubToken();
   let changed = 0;
   for (const file of ["AGENTS.md", "CLAUDE.md", ".claude/settings.json"]) {
     let source;
     try {
-      const res = await fetch(`${base}/${file}`);
+      const url = `${base}/${file}`;
+      const res = await fetch(url, { headers: rulesSourceAuthHeaders(url, token) });
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       source = await res.text();
     } catch (e) {
@@ -4331,7 +4608,7 @@ async function runNote(summary, o) {
   const capture = buildNoteCapture(summary, o, (0, import_node_crypto.randomUUID)(), { sha: sha || void 0, branch: key.branch });
   await postCapture(capture);
 }
-saga.command("note <summary>").description("record a one-line structured note into your saga (the per-turn capture)").option("--next <text>", 'set "where I left off" (NEXT)').option("--decision <text>", "append a verbatim decision").option("--queue-add <text>", "add a worklist item").option("--queue-done <n>", "mark worklist item N done").option("--verified", "mark this claim as checked against source (state: verified, else asserted)").option("--diagnostic", "isolate a probe write (state: diagnostic, source: probe) \u2014 never resume/LAST 5").action((summary, o) => runNote(summary, o));
+saga.command("note <summary>").description("record a one-line structured note into your saga (the per-turn capture)").option("--next <text>", 'set "where I left off" (NEXT)').option("--decision <text>", "append a verbatim decision").option("--queue-add <text>", "add a worklist item").option("--queue-done <n>", "mark worklist item N done").option("--verified", "mark this claim as checked against source (state: verified, else asserted)").option("--diagnostic", "isolate a probe write (state: diagnostic, source: probe) \u2014 never resume/LAST 5").option("--supersedes <key>", "retire prior decisions matching an evidence key (pr:N | file:path)").option("--anchor <intent>", "set the sprint North-Star (write-protected; needs --anchor-force to change)").option("--anchor-force", "overwrite an existing anchor").action((summary, o) => runNote(summary, o));
 saga.command("probe <summary>").description("record a diagnostic probe note (alias for `saga note --diagnostic`)").option("--next <text>", 'set "where I left off" (NEXT)').option("--decision <text>", "append a verbatim decision").option("--queue-add <text>", "add a worklist item").option("--queue-done <n>", "mark worklist item N done").action((summary, o) => runNote(summary, { ...o, diagnostic: true }));
 saga.command("show").option("--quiet", "no-op silently when unconfigured/unreachable (SessionStart hook)").option("--latest-anywhere", "resume the newest saga across all repos (default: current repo)").description("print your resume block \u2014 current repo HEAD + project memory (where you left off)").action(async (opts) => {
   const cfg = await loadConfig();
@@ -4383,7 +4660,8 @@ saga.command("head-update").option("--run", "detached worker: fetch state, run t
     if (!res.ok) return;
     const state = await res.json();
     if (!state.actionLog?.length) return;
-    const update = parseHeadUpdate(await runHeadEngine(headPrompt(state)));
+    const decisionTexts = (state.decisions ?? []).map((d) => typeof d === "string" ? d : d.text);
+    const update = parseHeadUpdate(await runHeadEngine(headPrompt({ ...state, decisions: decisionTexts })));
     if (!update) return;
     await fetch(`${cfg.sagaApiUrl}/saga/head`, {
       method: "POST",
@@ -4433,10 +4711,10 @@ program2.command("gc").description("dry-run cleanup for merged/closed PR branche
   const limit = Number.parseInt(o.limit, 10);
   if (!Number.isFinite(limit) || limit < 1) return fail("gc: --limit must be a positive integer");
   try {
-    const plan = await gcPlan(o.remote, limit);
-    if (o.apply) await applyGcPlan(plan, o.remote);
-    if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, plan }, null, 2));
-    console.log(formatGcPlan(plan, Boolean(o.apply)));
+    const plan2 = await gcPlan(o.remote, limit);
+    if (o.apply) await applyGcPlan(plan2, o.remote);
+    if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, plan: plan2 }, null, 2));
+    console.log(formatGcPlan(plan2, Boolean(o.apply)));
   } catch (e) {
     fail(`gc: ${e.message}`);
   }
@@ -4482,6 +4760,77 @@ function scheduleRelatedDiscovery(o) {
   } catch {
   }
 }
+function makePlanDeps(cfg) {
+  const ensureDir = () => (0, import_node_fs3.mkdirSync)(PLANS_DIR, { recursive: true });
+  return {
+    apiUrl: cfg.sagaApiUrl,
+    fetch: (url, init) => fetch(url, init),
+    headers: (extra) => sagaHeaders(extra),
+    project: async () => (await sagaKey(cfg)).project,
+    readLocal: (slug) => {
+      try {
+        return (0, import_node_fs3.readFileSync)(planPath(slug), "utf8");
+      } catch {
+        return null;
+      }
+    },
+    writeLocal: (slug, content) => {
+      ensureDir();
+      (0, import_node_fs3.writeFileSync)(planPath(slug), content, "utf8");
+    },
+    removeLocal: (slug) => {
+      try {
+        (0, import_node_fs3.rmSync)(planPath(slug));
+      } catch {
+      }
+    },
+    readMetaRaw: () => {
+      try {
+        return (0, import_node_fs3.readFileSync)(META_FILE, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    writeMetaRaw: (raw) => {
+      ensureDir();
+      (0, import_node_fs3.writeFileSync)(META_FILE, raw, "utf8");
+    },
+    log: (m) => console.log(m),
+    err: (m) => console.error(m),
+    now: () => (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function openInEditor(path) {
+  const editor = process.env.EDITOR || process.env.VISUAL;
+  if (!editor) {
+    console.log(`plan at ${path} (set $EDITOR to open it automatically)`);
+    return;
+  }
+  try {
+    (0, import_node_child_process4.spawn)(editor, [path], { stdio: "inherit" });
+  } catch {
+    console.log(`open ${path} manually`);
+  }
+}
+async function withPlan(quiet, run) {
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) {
+    if (!quiet) fail("plan: sagaApiUrl not configured in .mmi/config.json");
+    return;
+  }
+  await run(makePlanDeps(cfg));
+}
+var plan = program2.command("plan").description("your cross-device plans/SSOTs (S3-backed, git-clean)");
+plan.command("push <slug>").description("push a local plan (plans/<slug>.md) to the server").option("--project <name>", "override the project key").option("--force", "overwrite the remote even if it changed since your last sync").action((slug, o) => withPlan(false, (d) => planPush(d, slug, o)));
+plan.command("pull <slug>").description("pull a plan from the server into plans/<slug>.md").option("--project <name>", "override the project key").option("--force", "overwrite local even if it has unpushed edits").action((slug, o) => withPlan(false, (d) => planPull(d, slug, o)));
+plan.command("list").description("list your plans (cross-device)").option("--project <name>", "filter by project").option("--json", "machine-readable output").option("--quiet", "silent when unconfigured/empty/unreachable (SessionStart hook)").action((o) => withPlan(o.quiet ?? false, (d) => planList(d, o)));
+plan.command("open <slug>").description("pull if needed, then open plans/<slug>.md in $EDITOR").option("--project <name>", "override the project key").action(
+  (slug, o) => withPlan(false, async (d) => {
+    await planPull(d, slug, { project: o.project });
+    openInEditor(planPath(slug));
+  })
+);
+plan.command("delete <slug>").description("delete a plan from the server and the local copy").option("--project <name>", "override the project key").action((slug, o) => withPlan(false, (d) => planDelete(d, slug, o)));
 var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
 issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").requiredOption("--type <type>", "bug | feature | task (sets the matching label)").requiredOption("--title <title>", "issue title").requiredOption("--body <body>", "issue body (markdown)").requiredOption("--priority <priority>", "high | medium | low (adds a priority:<p> label)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   let args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "MMI Future CLI — delivers the org rules (whole-file), plus saga and KB access. The cross-IDE engine the plugin's SessionStart hook drives.",
   "type": "module",
   "license": "UNLICENSED",