@mutmutco/cli 2.10.1 → 2.11.0

package/dist/index.cjs

@@ -3480,8 +3480,8 @@ function parseHookInput(stdin) {
 }
 
 // src/index.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_util5 = require("node:util");
+var import_node_child_process6 = require("node:child_process");
+var import_node_util6 = require("node:util");
 var import_node_path5 = require("node:path");
 var import_node_os = require("node:os");
 
@@ -3495,7 +3495,7 @@ var HEAD_PROMPT_ACTION_LIMIT = 50;
 var HEAD_PROMPT_DECISION_LIMIT = 80;
 function resolveEngine(platform, custom) {
   if (custom) return { cmd: custom, args: [], shell: true };
-  return { cmd: "claude", args: ["-p"], shell: platform === "win32" };
+  return { cmd: "claude", args: ["-p", "--no-session-persistence"], shell: platform === "win32" };
 }
 function headTsPath(key) {
   const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -4025,32 +4025,153 @@ ${buildReportBody(body, sourceRepo)}`;
 }
 
 // src/board.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_util4 = require("node:util");
+
+// src/github-client.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_util3 = require("node:util");
+var rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
+var execFileP = (file, args, options = {}) => rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: 1e4, killSignal: "SIGTERM", ...options });
+var cachedGhCliToken;
+async function githubToken() {
+  if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
+  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
+  cachedGhCliToken ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
+  return cachedGhCliToken;
+}
+var GitHubApiError = class extends Error {
+  status;
+  stderr;
+  graphqlErrors;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "GitHubApiError";
+    this.status = opts.status ?? 0;
+    this.stderr = message;
+    this.graphqlErrors = opts.graphqlErrors;
+  }
+};
+var DEFAULT_TIMEOUT_MS = 2e4;
+function joinUrl(base, path2) {
+  if (path2.startsWith("http://") || path2.startsWith("https://")) return path2;
+  return `${base.replace(/\/+$/, "")}/${path2.replace(/^\/+/, "")}`;
+}
+function withPerPage(url) {
+  if (/[?&]per_page=/.test(url)) return url;
+  return url.includes("?") ? `${url}&per_page=100` : `${url}?per_page=100`;
+}
+function nextLink(linkHeader) {
+  if (!linkHeader) return void 0;
+  for (const part of linkHeader.split(",")) {
+    const match = part.match(/<([^>]+)>\s*;\s*rel="next"/);
+    if (match) return match[1];
+  }
+  return void 0;
+}
+async function errorFromResponse(res) {
+  let detail = "";
+  try {
+    const text = await res.text();
+    try {
+      const parsed = JSON.parse(text);
+      detail = parsed.message ?? text;
+    } catch {
+      detail = text;
+    }
+  } catch {
+    detail = "";
+  }
+  const suffix = detail ? `: ${detail.trim()}` : "";
+  return new GitHubApiError(`HTTP ${res.status}${suffix} (${res.url})`, { status: res.status });
+}
+function createGitHubClient(options = {}) {
+  const baseUrl = options.baseUrl ?? process.env.GITHUB_API_URL ?? "https://api.github.com";
+  const token = options.token ?? githubToken;
+  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  async function request(method, url, init = {}) {
+    const t = await token();
+    const headers = {
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "mmi-cli",
+      ...t ? { Authorization: `Bearer ${t}` } : {},
+      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {},
+      ...init.headers
+    };
+    const res = await fetchImpl(url, {
+      method,
+      headers,
+      body: init.body !== void 0 ? JSON.stringify(init.body) : void 0,
+      signal: AbortSignal.timeout(init.timeoutMs ?? defaultTimeoutMs)
+    });
+    if (!res.ok) throw await errorFromResponse(res);
+    return res;
+  }
+  async function parseJson(res) {
+    if (res.status === 204) return void 0;
+    const text = await res.text();
+    if (!text) return void 0;
+    return JSON.parse(text);
+  }
+  return {
+    async rest(method, path2, init) {
+      const res = await request(method, joinUrl(baseUrl, path2), init);
+      return parseJson(res);
+    },
+    async restPaginate(path2, init) {
+      const items = [];
+      let url = withPerPage(joinUrl(baseUrl, path2));
+      while (url) {
+        const res = await request("GET", url, init);
+        const page = await parseJson(res);
+        if (Array.isArray(page)) items.push(...page);
+        url = nextLink(res.headers.get("link"));
+      }
+      return items;
+    },
+    async graphql(query, variables, init) {
+      const res = await request("POST", joinUrl(baseUrl, "graphql"), {
+        ...init,
+        body: { query, ...variables ? { variables } : {} }
+      });
+      const parsed = await parseJson(res);
+      if (parsed?.errors?.length) {
+        const message = parsed.errors.map((e) => e.message ?? e.type ?? "unknown GraphQL error").join("; ");
+        throw new GitHubApiError(`GraphQL: ${message}`, { status: 200, graphqlErrors: parsed.errors });
+      }
+      if (!parsed || parsed.data === void 0 || parsed.data === null) {
+        throw new GitHubApiError("GraphQL response did not include data", { status: 200 });
+      }
+      return parsed.data;
+    }
+  };
+}
+var cachedDefaultClient;
+function defaultGitHubClient() {
+  cachedDefaultClient ??= createGitHubClient();
+  return cachedDefaultClient;
+}
 
 // ../infra/board-vocab.mjs
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
-var BOARD_GH_TIMEOUT_MS = 2e4;
+var rawExecFileP2 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
-var execFileP = (file, args, options = {}) => (
+var execFileP2 = (file, args, options = {}) => (
   // encoding 'utf8' guarantees string output at runtime; the cast pins the type (promisify's
   // overloads widen to string|Buffer when options is spread in).
-  rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: BOARD_GIT_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
+  rawExecFileP2(file, args, { encoding: "utf8", windowsHide: true, timeout: BOARD_GIT_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
 );
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["Todo", "In Progress", "In Review"]);
 var STATUS_ORDER = new Map(BOARD_STATUSES.map((s, i) => [s, i]));
 var TYPE_LABELS = ["bug", "feature", "task"];
-var defaultGh = async (args) => {
-  const { stdout, stderr } = await execFileP("gh", args, { timeout: BOARD_GH_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024 });
-  return { stdout: String(stdout), stderr: String(stderr) };
-};
 var defaultGit = async (args) => {
   try {
-    const { stdout } = await execFileP("git", args, { timeout: BOARD_GIT_TIMEOUT_MS });
+    const { stdout } = await execFileP2("git", args, { timeout: BOARD_GIT_TIMEOUT_MS });
     return stdout.trim();
   } catch {
     return "";
@@ -4104,36 +4225,52 @@ query($owner: String!, $number: Int!, $after: String) {
     }
   }
 }`;
-var ISSUE_PROJECT_ITEM_QUERY = `
-query($repoOwner: String!, $repoName: String!, $number: Int!) {
-  repository(owner: $repoOwner, name: $repoName) {
-    issue(number: $number) {
-      id
-      number
-      title
-      url
-      state
-      repository { nameWithOwner }
-      labels(first: 10) { nodes { name } }
-      assignees(first: 10) { nodes { login } }
-      projectItems(first: 20) {
-        nodes {
-          id
-          project { id title }
-          fieldValues(first: 8) {
-            nodes {
-              ... on ProjectV2ItemFieldSingleSelectValue {
-                name
-                optionId
-                field { ... on ProjectV2SingleSelectField { id name } }
+var SINGLE_ITEM_CONTENT_FRAGMENT = `
+        id
+        number
+        title
+        url
+        state
+        repository { nameWithOwner }
+        labels(first: 10) { nodes { name } }
+        assignees(first: 10) { nodes { login } }
+        projectItems(first: 20) {
+          nodes {
+            id
+            project { id title }
+            fieldValues(first: 8) {
+              nodes {
+                ... on ProjectV2ItemFieldSingleSelectValue {
+                  name
+                  optionId
+                  field { ... on ProjectV2SingleSelectField { id name } }
+                }
               }
             }
           }
-        }
+        }`;
+var ISSUE_PROJECT_ITEM_QUERY = `
+query($repoOwner: String!, $repoName: String!, $number: Int!) {
+  viewer { login }
+  repository(owner: $repoOwner, name: $repoName) {
+    issueOrPullRequest(number: $number) {
+      __typename
+      ... on Issue {${SINGLE_ITEM_CONTENT_FRAGMENT}
+      }
+      ... on PullRequest {${SINGLE_ITEM_CONTENT_FRAGMENT}
       }
     }
   }
 }`;
+var UPDATE_ITEM_FIELD_MUTATION = `
+mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+  updateProjectV2ItemFieldValue(input: { projectId: $projectId, itemId: $itemId, fieldId: $fieldId, value: { singleSelectOptionId: $optionId } }) {
+    projectV2Item { id }
+  }
+}`;
+async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
+  await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
+}
 function resolveBoardConfig(cfg) {
   const missing = [];
   if (!cfg.projectOwner) missing.push("projectOwner");
@@ -4256,7 +4393,7 @@ function renderBoardReport(report) {
   return lines.join("\n");
 }
 async function collectBoardItems(cfg, options, deps) {
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const git = deps.git ?? defaultGit;
   const currentRepo = options.repo ?? repoFromGitRemote(await git(["remote", "get-url", "origin"])) ?? "";
   if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
@@ -4269,7 +4406,7 @@ async function collectBoardItems(cfg, options, deps) {
   let partial = false;
   do {
     try {
-      const page = await fetchProjectPage(gh, cfg, after);
+      const page = await fetchProjectPage(client, cfg, after);
       viewer ||= page.viewer.login;
       const project2 = page.organization?.projectV2;
       if (!project2) throw new Error(`project ${cfg.projectOwner}#${cfg.projectNumber} not found`);
@@ -4287,19 +4424,15 @@ async function collectBoardItems(cfg, options, deps) {
   } while (after);
   return { items: nodesToItems(nodes, warnings, cfg), viewer, repo: currentRepo, projectId, projectTitle, warnings, partial };
 }
-async function repoCanPush(repo, gh) {
+async function repoCanPush(repo, client) {
   try {
-    const { stdout } = await gh(["api", `repos/${repo}`, "--jq", ".permissions.push"]);
-    const value = stdout.trim();
-    if (value === "true") return true;
-    if (value === "false") return false;
-    const parsed = JSON.parse(value);
-    return typeof parsed.permissions?.push === "boolean" ? parsed.permissions.push : void 0;
+    const parsed = await client.rest("GET", `repos/${repo}`);
+    return typeof parsed?.permissions?.push === "boolean" ? parsed.permissions.push : void 0;
   } catch {
     return void 0;
   }
 }
-async function resolveWritableReposForClaimables(items, gh, allowPartial) {
+async function resolveWritableReposForClaimables(items, client, allowPartial) {
   const candidateRepos = [...new Set(items.filter((item) => item.status === "Todo" && item.assignees.length === 0).map((item) => item.repository))];
   const repos = /* @__PURE__ */ new Set();
   const warnings = [];
@@ -4308,7 +4441,7 @@ async function resolveWritableReposForClaimables(items, gh, allowPartial) {
   const worker = async () => {
     while (next < candidateRepos.length) {
       const repo = candidateRepos[next++];
-      const canPush = await repoCanPush(repo, gh);
+      const canPush = await repoCanPush(repo, client);
       if (canPush === true) {
         repos.add(repo.toLowerCase());
         continue;
@@ -4326,9 +4459,9 @@ async function resolveWritableReposForClaimables(items, gh, allowPartial) {
 }
 async function readBoard(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const collected = await collectBoardItems(cfg, options, deps);
-  const writable = await resolveWritableReposForClaimables(collected.items, gh, options.allowPartial ?? false);
+  const writable = await resolveWritableReposForClaimables(collected.items, client, options.allowPartial ?? false);
   collected.warnings.push(...writable.warnings);
   collected.partial = collected.partial || writable.partial;
   const groups = partitionBoardItems(collected.items, collected.viewer, collected.repo, writable.repos);
@@ -4341,7 +4474,7 @@ async function readBoard(options, deps = {}) {
     partial: collected.partial
   };
   if (options.includeBundleDetails) {
-    await attachBundleDetails(report, gh, options.allowPartial ?? false);
+    await attachBundleDetails(report, client, options.allowPartial ?? false);
   }
   return report;
 }
@@ -4352,67 +4485,50 @@ function findBoardItem(items, selector) {
   if (!found) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
   return found;
 }
+async function resolveCurrentRepo(options, deps) {
+  const git = deps.git ?? defaultGit;
+  const currentRepo = options.repo ?? repoFromGitRemote(await git(["remote", "get-url", "origin"])) ?? "";
+  if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
+  return currentRepo;
+}
 async function moveBoardItem(options, deps = {}) {
   if (!BOARD_STATUSES.includes(options.status)) {
     throw new Error(`unknown status '${options.status}'; expected one of ${BOARD_STATUSES.join(", ")}`);
   }
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
-  const collected = await collectBoardItems(cfg, options, deps);
-  const selector = parseIssueSelector(options.selector, collected.repo);
-  const item = findBoardItem(collected.items, selector);
+  const client = deps.client ?? defaultGitHubClient();
+  const currentRepo = await resolveCurrentRepo(options, deps);
+  const selector = parseIssueSelector(options.selector, currentRepo);
+  const lookup = await fetchIssueProjectItem(client, cfg, selector);
+  const item = lookup.item;
+  if (!item) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
   if (item.contentType !== "Issue") throw new Error(`${item.ref} is not an issue`);
   const optionId = cfg.statusOptions[options.status];
   try {
-    await gh([
-      "project",
-      "item-edit",
-      "--id",
-      item.itemId,
-      "--project-id",
-      cfg.projectId,
-      "--field-id",
-      cfg.statusFieldId,
-      "--single-select-option-id",
-      optionId
-    ]);
+    await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, optionId);
   } catch (e) {
     const warning = `partial move: ${item.ref} status was not changed to ${options.status} (${ghError(e)})`;
     if (!options.allowPartial) throw new Error(warning);
-    return { item, viewer: collected.viewer, repo: collected.repo, status: item.status, partial: true, warning };
+    return { item, viewer: lookup.viewer, repo: currentRepo, status: item.status, partial: true, warning };
   }
   return {
     item: { ...item, status: options.status, statusOptionId: optionId },
-    viewer: collected.viewer,
-    repo: collected.repo,
+    viewer: lookup.viewer,
+    repo: currentRepo,
     status: options.status,
     partial: false
   };
 }
 async function showBoardItem(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
-  const collected = await collectBoardItems(cfg, options, deps);
-  const selector = parseIssueSelector(options.selector, collected.repo);
-  let item;
-  try {
-    item = findBoardItem(collected.items, selector);
-  } catch (e) {
-    const fallback = await fetchIssueProjectItem(gh, cfg, selector);
-    if (!fallback) throw e;
-    item = fallback;
-  }
+  const client = deps.client ?? defaultGitHubClient();
+  const currentRepo = await resolveCurrentRepo(options, deps);
+  const selector = parseIssueSelector(options.selector, currentRepo);
+  const { item } = await fetchIssueProjectItem(client, cfg, selector);
+  if (!item) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
   if (item.contentType === "Issue") {
     try {
-      const { stdout } = await gh(["issue", "view", String(item.number), "--repo", item.repository, "--json", "body,comments"]);
-      const detail = JSON.parse(stdout);
-      item.details = {
-        body: detail.body ?? "",
-        comments: (detail.comments ?? []).map((comment) => ({
-          author: comment.author?.login ?? "",
-          body: comment.body ?? ""
-        }))
-      };
+      item.details = await fetchIssueDetails(client, item.repository, item.number);
     } catch (e) {
       if (!options.allowPartial) throw new Error(`detail read failed: ${item.ref}: ${ghError(e)}`);
     }
@@ -4421,17 +4537,17 @@ async function showBoardItem(options, deps = {}) {
 }
 async function claimBoardIssue(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial }, deps);
   const selector = parseIssueSelector(options.selector, collected.repo);
   try {
     findBoardItem(collected.items, selector);
   } catch (e) {
-    const fallback = await fetchIssueProjectItem(gh, cfg, selector);
+    const fallback = (await fetchIssueProjectItem(client, cfg, selector)).item;
     if (!fallback) throw e;
     collected.items.push(fallback);
   }
-  const writable = await resolveWritableReposForClaimables(collected.items, gh, options.allowPartial ?? false);
+  const writable = await resolveWritableReposForClaimables(collected.items, client, options.allowPartial ?? false);
   collected.warnings.push(...writable.warnings);
   collected.partial = collected.partial || writable.partial;
   const report = {
@@ -4448,7 +4564,7 @@ async function claimBoardIssue(options, deps = {}) {
   }
   let item = findClaimableItem(report, selector);
   if (item.contentType !== "Issue") throw new Error(`${item.ref} is not an issue`);
-  const fresh = await fetchIssueProjectItem(gh, cfg, { repo: item.repository, number: item.number });
+  const fresh = (await fetchIssueProjectItem(client, cfg, { repo: item.repository, number: item.number })).item;
   if (!fresh) throw new Error(`${item.ref} is not on this project board`);
   if (fresh.status !== "Todo") throw new Error(`${item.ref} is not claimable: Status is ${fresh.status}`);
   if (fresh.assignees.length) throw new Error(`${item.ref} is already assigned to @${fresh.assignees.join(", @")}`);
@@ -4456,23 +4572,12 @@ async function claimBoardIssue(options, deps = {}) {
   const assignee = options.assignee ?? "@me";
   const assignedLogin = assignee === "@me" ? report.viewer : assignee.replace(/^@/, "");
   try {
-    await gh(["issue", "edit", String(item.number), "--repo", item.repository, "--add-assignee", assignee]);
+    await client.rest("POST", `repos/${item.repository}/issues/${item.number}/assignees`, { body: { assignees: [assignedLogin] } });
   } catch (e) {
     throw new Error(`claim failed before board status changed: ${ghError(e)}`);
   }
   try {
-    await gh([
-      "project",
-      "item-edit",
-      "--id",
-      item.itemId,
-      "--project-id",
-      cfg.projectId,
-      "--field-id",
-      cfg.statusFieldId,
-      "--single-select-option-id",
-      cfg.statusOptions["In Progress"]
-    ]);
+    await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, cfg.statusOptions["In Progress"]);
   } catch (e) {
     const warning = `partial claim: ${item.ref} was assigned to @${assignedLogin}, but Status was not moved to In Progress (${ghError(e)})`;
     if (!options.allowPartial) throw new Error(warning);
@@ -4491,22 +4596,11 @@ async function claimBoardIssue(options, deps = {}) {
     partial: false
   };
 }
-async function setBoardItemPriority(gh, cfg, itemId, priority) {
+async function setBoardItemPriority(client, cfg, itemId, priority) {
   if (!isPriorityFieldConfigured(cfg)) return void 0;
   const optionId = resolvePriorityOptionId(cfg, priority);
   if (!optionId || !cfg.priorityFieldId || !cfg.projectId) return void 0;
-  await gh([
-    "project",
-    "item-edit",
-    "--id",
-    itemId,
-    "--project-id",
-    cfg.projectId,
-    "--field-id",
-    cfg.priorityFieldId,
-    "--single-select-option-id",
-    optionId
-  ]);
+  await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
 async function backfillBoardPriorities(options, deps = {}) {
@@ -4514,7 +4608,7 @@ async function backfillBoardPriorities(options, deps = {}) {
   if (!isPriorityFieldConfigured(cfg)) {
     throw new Error("priority field is not configured in Hub registry META (priorityFieldId + priorityOptions)");
   }
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const collected = await collectBoardItems(cfg, { repo: options.repo }, deps);
   const issues = collected.items.filter((item) => item.contentType === "Issue");
   const concurrency = Math.max(1, options.concurrency ?? 8);
@@ -4525,7 +4619,7 @@ async function backfillBoardPriorities(options, deps = {}) {
       return;
     }
     try {
-      const priority = await recoverIssuePriority(gh, item);
+      const priority = await recoverIssuePriority(client, item);
       if (!priority) {
         result.skipped += 1;
         return;
@@ -4537,18 +4631,7 @@ async function backfillBoardPriorities(options, deps = {}) {
       }
       const optionId = cfg.priorityOptions?.[priority];
       if (!optionId) throw new Error(`no option id for ${priority}`);
-      await gh([
-        "project",
-        "item-edit",
-        "--id",
-        item.itemId,
-        "--project-id",
-        cfg.projectId,
-        "--field-id",
-        cfg.priorityFieldId,
-        "--single-select-option-id",
-        optionId
-      ]);
+      await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.priorityFieldId, optionId);
       result.set += 1;
       result.details.push(`${item.ref} \u2192 ${priority}`);
     } catch (e) {
@@ -4561,88 +4644,65 @@ async function backfillBoardPriorities(options, deps = {}) {
   }
   return result;
 }
-async function recoverIssuePriority(gh, item) {
+async function recoverIssuePriority(client, item) {
   for (const label of item.labels) {
     const fromLabel = labelToFieldPriority(label);
     if (fromLabel) return fromLabel;
   }
-  const { stdout } = await gh(["api", `repos/${item.repository}/issues/${item.number}/events`, "--paginate"]);
-  return recoverPriorityFromEvents(parsePaginatedEvents(stdout));
+  const events = await client.restPaginate(
+    `repos/${item.repository}/issues/${item.number}/events`
+  );
+  return recoverPriorityFromEvents(events);
 }
-function parsePaginatedEvents(stdout) {
-  const trimmed = stdout.trim();
-  if (!trimmed) return [];
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (Array.isArray(parsed)) return parsed;
-  } catch {
-  }
-  return trimmed.split(/\r?\n/).filter(Boolean).flatMap((line) => {
-    try {
-      const parsed = JSON.parse(line);
-      return Array.isArray(parsed) ? parsed : [];
-    } catch {
-      return [];
-    }
+async function fetchProjectPage(client, cfg, after) {
+  return client.graphql(PROJECT_ITEMS_QUERY, {
+    owner: cfg.projectOwner,
+    number: cfg.projectNumber,
+    ...after ? { after } : {}
   });
 }
-async function fetchProjectPage(gh, cfg, after) {
-  const args = [
-    "api",
-    "graphql",
-    "-f",
-    `query=${PROJECT_ITEMS_QUERY}`,
-    "-f",
-    `owner=${cfg.projectOwner}`,
-    "-F",
-    `number=${cfg.projectNumber}`
-  ];
-  if (after) args.push("-f", `after=${after}`);
-  const { stdout } = await gh(args);
-  const parsed = JSON.parse(stdout);
-  if (!parsed.data) throw new Error("gh GraphQL response did not include data");
-  return parsed.data;
+function isGraphQLNotFound(e) {
+  const errors = e.graphqlErrors;
+  return Boolean(e instanceof GitHubApiError && errors?.length && errors.every((entry) => entry.type === "NOT_FOUND"));
 }
-async function fetchIssueProjectItem(gh, cfg, selector) {
+async function fetchIssueProjectItem(client, cfg, selector) {
   const [repoOwner, repoName] = selector.repo.split("/");
-  if (!repoOwner || !repoName) return void 0;
-  const { stdout } = await gh([
-    "api",
-    "graphql",
-    "-f",
-    `query=${ISSUE_PROJECT_ITEM_QUERY}`,
-    "-f",
-    `repoOwner=${repoOwner}`,
-    "-f",
-    `repoName=${repoName}`,
-    "-F",
-    `number=${selector.number}`
-  ]);
-  const parsed = JSON.parse(stdout);
-  const issue2 = parsed.data?.repository?.issue;
-  if (!issue2) {
-    const pageNodes = parsed.data?.organization?.projectV2?.items.nodes ?? [];
-    return nodesToItems(pageNodes, [], cfg).find(
-      (item) => item.repository.toLowerCase() === selector.repo.toLowerCase() && item.number === selector.number
-    );
+  if (!repoOwner || !repoName) return { viewer: "" };
+  let data;
+  try {
+    data = await client.graphql(ISSUE_PROJECT_ITEM_QUERY, {
+      repoOwner,
+      repoName,
+      number: selector.number
+    });
+  } catch (e) {
+    if (isGraphQLNotFound(e)) return { viewer: "" };
+    throw e;
   }
-  const projectItem = (issue2.projectItems?.nodes ?? []).find((item) => item.project?.id === cfg.projectId);
-  if (!projectItem) return void 0;
-  return nodeToItem({
-    id: projectItem.id,
-    fieldValues: projectItem.fieldValues,
-    content: {
-      __typename: "Issue",
-      id: issue2.id,
-      number: issue2.number,
-      title: issue2.title,
-      url: issue2.url,
-      state: issue2.state,
-      repository: issue2.repository,
-      labels: issue2.labels,
-      assignees: issue2.assignees
-    }
-  }, cfg);
+  const viewer = data.viewer?.login ?? "";
+  const content = data.repository?.issueOrPullRequest;
+  if (!content) return { viewer };
+  const projectItem = (content.projectItems?.nodes ?? []).find((item) => item.project?.id === cfg.projectId);
+  if (!projectItem) return { viewer };
+  const { projectItems: _projectItems, ...contentFields } = content;
+  return {
+    viewer,
+    item: nodeToItem({
+      id: projectItem.id,
+      fieldValues: projectItem.fieldValues,
+      content: contentFields
+    }, cfg)
+  };
+}
+async function fetchIssueDetails(client, repo, number) {
+  const issue2 = await client.rest("GET", `repos/${repo}/issues/${number}`);
+  const comments = await client.restPaginate(
+    `repos/${repo}/issues/${number}/comments`
+  );
+  return {
+    body: issue2?.body ?? "",
+    comments: comments.map((comment) => ({ author: comment.user?.login ?? "", body: comment.body ?? "" }))
+  };
 }
 function nodesToItems(nodes, warnings, cfg) {
   const items = [];
@@ -4701,20 +4761,12 @@ function nodeToItem(node, cfg) {
 function isSupportedContent(content) {
   return Boolean(content && (content.__typename === "Issue" || content.__typename === "PullRequest"));
 }
-async function attachBundleDetails(report, gh, allowPartial) {
+async function attachBundleDetails(report, client, allowPartial) {
   const candidates = detailCandidates(report);
   if (candidates.length <= 1) return;
   for (const item of candidates) {
     try {
-      const { stdout } = await gh(["issue", "view", String(item.number), "--repo", item.repository, "--json", "body,comments"]);
-      const detail = JSON.parse(stdout);
-      item.details = {
-        body: detail.body ?? "",
-        comments: (detail.comments ?? []).map((comment) => ({
-          author: comment.author?.login ?? "",
-          body: comment.body ?? ""
-        }))
-      };
+      item.details = await fetchIssueDetails(client, item.repository, item.number);
     } catch (e) {
       const warning = `partial detail read: ${item.ref}: ${ghError(e)}`;
       if (!allowPartial) throw new Error(warning);
@@ -5347,12 +5399,12 @@ function buildInstalledPluginVersionCheck(input) {
 }
 
 // src/stage-runner.ts
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 var import_node_fs3 = require("node:fs");
 var import_node_path3 = require("node:path");
 var import_node_net = require("node:net");
-var import_node_util4 = require("node:util");
-var execFileP2 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
+var import_node_util5 = require("node:util");
+var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process5.execFile);
 function stageStatePath(cwd = process.cwd()) {
   return (0, import_node_path3.join)(cwd, "tmp", "stage", "state.json");
 }
@@ -5387,7 +5439,7 @@ function isPortFree(port) {
   });
 }
 async function shell(command, cwd, timeoutMs) {
-  await execFileP2(command, [], {
+  await execFileP3(command, [], {
     cwd,
     shell: true,
     timeout: timeoutMs,
@@ -5406,7 +5458,7 @@ function readState(path2) {
 async function killTree(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return;
   if (process.platform === "win32") {
-    await execFileP2("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }).catch(() => void 0);
+    await execFileP3("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }).catch(() => void 0);
     return;
   }
   try {
@@ -5469,7 +5521,7 @@ async function startStage(config = {}, opts = {}) {
   }
   const sub = (s) => s != null && stagePort != null ? s.replace(/\$\{?STAGE_PORT\}?/g, String(stagePort)) : s;
   const up = sub(config.up.trim());
-  const child = (0, import_node_child_process4.spawn)(up, {
+  const child = (0, import_node_child_process5.spawn)(up, {
     cwd,
     shell: true,
     detached: true,
@@ -5759,22 +5811,29 @@ function safeJson(text, fallback) {
     return fallback;
   }
 }
-async function ghJson(deps, args, fallback) {
+async function restJson(deps, path2, fallback) {
   try {
-    return safeJson((await deps.gh(args)).stdout, fallback);
+    return await deps.client.rest("GET", path2) ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function restPagedJson(deps, path2, fallback) {
+  try {
+    return await deps.client.restPaginate(path2);
   } catch {
     return fallback;
   }
 }
 async function resolveOwners(deps) {
-  const members = await ghJson(deps, ["api", `orgs/${OWNER}/members?role=admin`, "--paginate"], []);
+  const members = await restPagedJson(deps, `orgs/${OWNER}/members?role=admin`, []);
   return members.map((m) => m.login);
 }
 function collaboratorRole(c) {
   return c.role_name ?? (c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : "write");
 }
 async function auditRepoCollaborators(repo, owners, deps) {
-  const collabs = await ghJson(deps, ["api", `repos/${repo}/collaborators?affiliation=direct`, "--paginate"], []);
+  const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
   const findings = [];
   for (const c of collabs) {
     if (owners.has(c.login)) continue;
@@ -5795,7 +5854,7 @@ async function auditRepoCollaborators(repo, owners, deps) {
 async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
   let restrictions = null;
   try {
-    restrictions = safeJson((await deps.gh(["api", `repos/${repo}/branches/${branch}/protection/restrictions`])).stdout, null);
+    restrictions = await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection/restrictions`) ?? null;
   } catch {
     restrictions = null;
   }
@@ -5879,7 +5938,7 @@ async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /*
   return { repo, class: repoClass, ok: !findings.some((f) => f.severity === "high"), findings };
 }
 async function auditOrgBasePermission(deps) {
-  const org = await ghJson(deps, ["api", `orgs/${OWNER}`], {});
+  const org = await restJson(deps, `orgs/${OWNER}`, {});
   const perm = org.default_repository_permission;
   if (perm && perm !== "read" && perm !== "none") {
     return [{
@@ -6022,9 +6081,16 @@ function safeJson2(text, fallback) {
     return fallback;
   }
 }
-async function ghJson2(deps, args, fallback) {
+async function restJson2(deps, path2, fallback) {
+  try {
+    return await deps.client.rest("GET", path2) ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function restPagedJson2(deps, path2, fallback) {
   try {
-    return safeJson2((await deps.gh(args)).stdout, fallback);
+    return await deps.client.restPaginate(path2);
   } catch {
     return fallback;
   }
@@ -6032,7 +6098,7 @@ async function ghJson2(deps, args, fallback) {
 async function contentExists(deps, repo, branch, path2) {
   try {
     const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
-    await deps.gh(["api", `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`]);
+    await deps.client.rest("GET", `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`);
     return true;
   } catch {
     return false;
@@ -6040,7 +6106,7 @@ async function contentExists(deps, repo, branch, path2) {
 }
 async function getProtection(deps, repo, branch) {
   try {
-    return safeJson2((await deps.gh(["api", `repos/${repo}/branches/${branch}/protection`])).stdout, {});
+    return await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection`) ?? {};
   } catch {
     return null;
   }
@@ -6068,7 +6134,7 @@ async function rulesetDetails(deps, repo, list) {
       details.push(ruleset);
       continue;
     }
-    details.push(await ghJson2(deps, ["api", `repos/${repo}/rulesets/${ruleset.id}`], ruleset));
+    details.push(await restJson2(deps, `repos/${repo}/rulesets/${ruleset.id}`, ruleset));
   }
   return details;
 }
@@ -6081,11 +6147,11 @@ async function verifyBootstrap(repo, repoClass, deps) {
   const branchesWanted = expectedBranches(repoClass);
   const baseBranch = repoClass === "content" ? "main" : "development";
   const checks = [];
-  const repoInfo = await ghJson2(deps, ["api", `repos/${repo}`], {});
+  const repoInfo = await restJson2(deps, `repos/${repo}`, {});
   checks.push({ ok: Boolean(repoInfo.default_branch), label: "repo exists" });
   checks.push({ ok: repoInfo.default_branch === baseBranch, label: `default branch is ${baseBranch}`, detail: repoInfo.default_branch || "missing" });
   checks.push({ ok: repoInfo.has_wiki === true, label: "wiki enabled", detail: repoInfo.has_wiki === true ? void 0 : "has_wiki is false or unavailable" });
-  const branchList = await ghJson2(deps, ["api", `repos/${repo}/branches`, "--paginate"], []);
+  const branchList = await restPagedJson2(deps, `repos/${repo}/branches`, []);
   const branchNames = new Set(branchList.map((b) => b.name));
   for (const branch of branchesWanted) {
     checks.push({ ok: branchNames.has(branch), label: `branch exists: ${branch}` });
@@ -6118,14 +6184,14 @@ async function verifyBootstrap(repo, repoClass, deps) {
     checks.push({ ok: await contentExists(deps, repo, baseBranch, trainScript), label: `train tooling script exists: ${trainScript}` });
   }
   checks.push({ ok: await contentExists(deps, repo, baseBranch, ".cursor/environment.json"), label: "Cursor environment committed" });
-  const labels = await ghJson2(deps, ["label", "list", "--repo", repo, "--limit", "200", "--json", "name"], []);
+  const labels = await restPagedJson2(deps, `repos/${repo}/labels`, []);
   const labelNames = new Set(labels.map((l) => l.name));
   for (const label of requiredLabels) {
     checks.push({ ok: labelNames.has(label), label: `label exists: ${label}` });
   }
   const strays = strayDefaultLabels.filter((l) => labelNames.has(l));
   checks.push({ ok: strays.length === 0, label: "no stray GitHub-default labels", detail: presentDetail(strays) });
-  const actions = await ghJson2(deps, ["api", `repos/${repo}/actions/permissions`], {});
+  const actions = await restJson2(deps, `repos/${repo}/actions/permissions`, {});
   checks.push({ ok: actions.enabled === true, label: "GitHub Actions enabled" });
   const config = deps.projectMeta ?? null;
   checks.push({
@@ -6133,12 +6199,18 @@ async function verifyBootstrap(repo, repoClass, deps) {
     label: "registry project board META exists"
   });
   if (config?.projectOwner && config.projectNumber != null) {
-    const project2 = await ghJson2(
-      deps,
-      ["project", "field-list", String(config.projectNumber), "--owner", config.projectOwner, "--format", "json"],
-      {}
-    );
-    const fields = project2.fields || [];
+    const fieldsQuery = `query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { fields(first: 50) { nodes { ... on ProjectV2FieldCommon { id name } ... on ProjectV2SingleSelectField { id name options { id name } } } } } } }`;
+    const fields = await (async () => {
+      try {
+        const data = await deps.client.graphql(fieldsQuery, {
+          login: config.projectOwner,
+          number: config.projectNumber
+        });
+        return (data.organization?.projectV2?.fields?.nodes ?? []).filter((f) => Boolean(f?.id && f?.name));
+      } catch {
+        return [];
+      }
+    })();
     const statusField = fields.find((field) => field.name === "Status");
     const labelField = fields.find((field) => field.name === "Labels");
     checks.push({
@@ -6195,12 +6267,17 @@ async function verifyBootstrap(repo, repoClass, deps) {
       }
     }
     const workflowQuery = "query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { workflows(first: 30) { nodes { name enabled } } } } }";
-    const workflowResponse = await ghJson2(
-      deps,
-      ["api", "graphql", "-f", `query=${workflowQuery}`, "-f", `login=${config.projectOwner}`, "-F", `number=${config.projectNumber}`],
-      {}
-    );
-    const workflows = workflowResponse.data?.organization?.projectV2?.workflows?.nodes || [];
+    const workflowResponse = await (async () => {
+      try {
+        return await deps.client.graphql(workflowQuery, {
+          login: config.projectOwner,
+          number: config.projectNumber
+        });
+      } catch {
+        return {};
+      }
+    })();
+    const workflows = workflowResponse.organization?.projectV2?.workflows?.nodes || [];
     for (const workflowName of requiredProjectWorkflows) {
       checks.push({
         ok: workflows.some((workflow) => workflow.name === workflowName && workflow.enabled === true),
@@ -6212,11 +6289,7 @@ async function verifyBootstrap(repo, repoClass, deps) {
   if (fanout != null) checks.push({ ok: fanout, label: `fanout target registered on ${baseBranch}` });
   const projectRegistry = localRegistryCheck(deps, "projects.json", (json) => Array.isArray(json?.projects) && json.projects.some((p) => (p.repos || []).includes(repo)));
   if (projectRegistry != null) checks.push({ ok: projectRegistry, label: "cloud-agent project registry includes repo" });
-  const rulesetList = await ghJson2(
-    deps,
-    ["api", `repos/${repo}/rulesets?includes_parents=true`],
-    []
-  );
+  const rulesetList = await restJson2(deps, `repos/${repo}/rulesets?includes_parents=true`, []);
   const rulesets = await rulesetDetails(deps, repo, rulesetList);
   const activeOrgRulesets = rulesets.filter(
     (r) => r.source_type === "Organization" && r.target === "branch" && r.enforcement === "active"
@@ -6402,7 +6475,7 @@ var ORG_CONFIG_PATH = "/org/config";
 var PROJECTS_ENVELOPE_KEY = "projects";
 
 // src/registry-client.ts
-var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_TIMEOUT_MS2 = 8e3;
 async function fetchTrainAuthority(repo, deps) {
   if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
   const token = await deps.token();
@@ -6412,7 +6485,7 @@ async function fetchTrainAuthority(repo, deps) {
     const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/train-authority?repo=${encodeURIComponent(repo)}`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
     if (!res.ok) return { ok: false, error: `train-authority HTTP ${res.status}` };
     const body = await res.json();
@@ -6431,7 +6504,7 @@ async function fetchProjectsList(deps) {
     const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}${PROJECTS_LIST_PATH}`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
     if (!res.ok) return null;
     const body = await res.json();
@@ -6455,7 +6528,7 @@ async function fetchProjectBySlugChecked(slug, deps) {
     const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
     if (res.status === 404) return { ok: true, project: null };
     if (!res.ok) return { ok: false, error: `HTTP ${res.status}` };
@@ -6477,7 +6550,7 @@ async function fetchDeployStatusBySlug(slug, deps) {
     const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}/deploy-status`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
     if (!res.ok) return null;
     const body = await res.json();
@@ -6496,7 +6569,7 @@ async function fetchOrgConfig(deps) {
     const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
     if (!res.ok) return null;
     return await res.json();
@@ -6514,7 +6587,7 @@ async function postJson(pathSuffix, payload, deps, method = "POST") {
       method,
       headers: { Authorization: `Bearer ${token}`, "content-type": "application/json" },
       body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
     let body = null;
     try {
@@ -6532,6 +6605,9 @@ async function registerProject(payload, deps) {
 async function upsertProject(slug, patch, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}`, patch, deps);
 }
+async function attestAppGaps(slug, repo, deps) {
+  return postJson(`/projects/${encodeURIComponent(slug)}/attest-app`, { repo }, deps);
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps);
 }
@@ -6570,7 +6646,21 @@ function stageRequiredSecrets(stage2, meta) {
 function stageKey(stage2, key) {
   return key.includes("/") ? key : `${stage2}/${key}`;
 }
+function hasRuntimeSecretContract(contract) {
+  return Boolean(contract) && !Array.isArray(contract);
+}
+function appAttestationOf(meta) {
+  const a = meta?.appAttested;
+  if (!a || typeof a !== "object" || Array.isArray(a)) return null;
+  const { at, by } = a;
+  return typeof at === "string" && at.length > 0 && typeof by === "string" && by.length > 0 ? { at, by } : null;
+}
+function attestedLine(att) {
+  return `App-owned readiness attested by @${att.by} on ${att.at.slice(0, 10)} \u2014 the static checklist is cleared (the doctor reads no product repo files); re-run \`mmi-cli project attest\` after app-owned structural changes.`;
+}
 function appGapsFor(meta, model, slug, projectType) {
+  const attested = appAttestationOf(meta);
+  if (attested) return [attestedLine(attested)];
   if (projectType === "content" || model === "content") return ["Content/KB repo: keep app-owned work to docs/content changes; release train does not apply."];
   if (projectType === "desktop-game") {
     return [
@@ -6602,6 +6692,9 @@ function appGapsFor(meta, model, slug, projectType) {
     "Make app config fail clearly for missing required env in prod/rc instead of relying on hidden defaults.",
     "Keep app-owned README.md and architecture.md aligned with v2 central deploy/secrets reality."
   ];
+  if (meta && !hasRuntimeSecretContract(meta.requiredRuntimeSecrets)) {
+    gaps.unshift("No runtime secrets declared \u2014 declare requiredRuntimeSecrets (a per-stage name map) in the registry META, or attest the app needs none with an explicit empty stage map ({ dev: [], rc: [], main: [] }).");
+  }
   if (slug === "mmi-katip") {
     gaps.push("Katip-specific app plan: declare Google Workspace service-account requirements, use the service account numeric OAuth2 client ID for DWD, remove prod-hidden impersonation defaults, and make non-critical Google Workspace failures degrade instead of crash-looping.");
   }
@@ -6741,7 +6834,8 @@ async function buildV2Doctor(repoOrSlug, deps) {
     hubOwned: { meta: { ok: metaMissing.length === 0, missing: metaMissing }, deployCoords, deployState, secrets: secrets2 },
     secretsError,
     autoHealAvailable: Object.keys(autoHeal.patch),
-    appOwnedGaps: autoHeal.appOwnedGaps
+    appOwnedGaps: autoHeal.appOwnedGaps,
+    appAttested: appAttestationOf(meta) ?? void 0
   };
 }
 function renderReadinessIssueBody(existingBody, report, opts = {}) {
@@ -6834,6 +6928,10 @@ function buildProjectSetPatch(input) {
   }
   return patch;
 }
+function repoFromRemoteUrl(remoteUrl) {
+  const m = remoteUrl.trim().match(/^(?:[a-z][a-z0-9+.-]*:\/\/)?(?:[^@\s/]+@)?github\.com[:/]([^/\s:]+)\/([^/\s]+?)(?:\.git)?\/?$/i);
+  return m ? `${m[1]}/${m[2]}` : void 0;
+}
 function requireProjectTarget(commandName, explicitTarget, currentRepo) {
   const target = explicitTarget?.trim() || currentRepo?.trim();
   if (!target) {
@@ -7113,12 +7211,14 @@ function formatVaultPointer(p) {
 }
 var TIMEOUT_MS2 = 8e3;
 var repoOf = (slug) => `${OWNER2}/${slug}`;
+async function vaultSlug(deps, opts) {
+  return (opts.repo ? opts.repo.split("/").pop() : await deps.slug()).toLowerCase();
+}
 async function targetRepo(deps, opts) {
-  return opts.repo ?? repoOf(await deps.slug());
+  return opts.repo ?? repoOf(await vaultSlug(deps, opts));
 }
 async function secretsWhere(deps, opts) {
-  const slug = opts.repo ? opts.repo.split("/").pop().toLowerCase() : await deps.slug();
-  deps.log(formatVaultPointer(vaultPointer(slug)));
+  deps.log(formatVaultPointer(vaultPointer(await vaultSlug(deps, opts))));
 }
 async function readErr(res) {
   try {
@@ -7300,7 +7400,7 @@ async function secretsSet(deps, key, opts) {
     );
     return;
   }
-  deps.log(`set ${key} (${classifyTier(await deps.slug(), key)} tier)`);
+  deps.log(`set ${key} (${classifyTier(await vaultSlug(deps, opts), key)} tier)`);
 }
 async function secretsEdit(deps, key, opts) {
   return secretsSet(deps, key, opts);
@@ -7352,8 +7452,8 @@ async function secretsRevoke(deps, repo, login, key, _opts) {
   }
   deps.log(`revoked @${login}'s access to ${key} in ${repo}`);
 }
-async function secretsUse(deps, key, _opts) {
-  const slug = await deps.slug();
+async function secretsUse(deps, key, opts) {
+  const slug = await vaultSlug(deps, opts);
   const tier = classifyTier(slug, key);
   const path2 = secretParamName(slug, key);
   deps.log(
@@ -7438,30 +7538,23 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/index.ts
-var rawExecFileP2 = (0, import_node_util5.promisify)(import_node_child_process5.execFile);
+var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process6.execFile);
 var DEFAULT_EXEC_TIMEOUT_MS = 1e4;
-var execFileP3 = (file, args, options = {}) => (
+var execFileP4 = (file, args, options = {}) => (
   // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
   // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
-  rawExecFileP2(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
+  rawExecFileP3(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
 );
 var GIT_TIMEOUT_MS = DEFAULT_EXEC_TIMEOUT_MS;
 var GC_GH_TIMEOUT_MS = 2e4;
-var cachedGhCliToken;
-async function githubToken() {
-  if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
-  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
-  cachedGhCliToken ??= execFileP3("gh", ["auth", "token"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
-  return cachedGhCliToken;
-}
 var cachedGithubLogin;
 async function githubLogin() {
-  cachedGithubLogin ??= execFileP3("gh", ["api", "user", "--jq", ".login"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
+  cachedGithubLogin ??= execFileP4("gh", ["api", "user", "--jq", ".login"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
   return cachedGithubLogin;
 }
 async function awsCallerArn() {
   try {
-    const { stdout } = await execFileP3(
+    const { stdout } = await execFileP4(
       "aws",
       ["sts", "get-caller-identity", "--query", "Arn", "--output", "text"],
       { timeout: GIT_TIMEOUT_MS }
@@ -7521,7 +7614,7 @@ var DEFAULT_RULES_SOURCE = "https://raw.githubusercontent.com/mutmutco/MMI-Hub/d
 var SESSION_FILE = ".mmi/.session";
 var gitOut = async (args) => {
   try {
-    return (await execFileP3("git", [...args])).stdout.trim();
+    return (await execFileP4("git", [...args])).stdout.trim();
   } catch {
     return "";
   }
@@ -7593,18 +7686,18 @@ async function readStdin() {
 async function ghPrs(limit) {
   const args = (state) => ["pr", "list", "--state", state, "--limit", String(limit), "--json", "number,headRefName,state"];
   const [open, closed] = await Promise.all([
-    execFileP3("gh", args("open"), { timeout: GC_GH_TIMEOUT_MS }),
-    execFileP3("gh", args("closed"), { timeout: GC_GH_TIMEOUT_MS })
+    execFileP4("gh", args("open"), { timeout: GC_GH_TIMEOUT_MS }),
+    execFileP4("gh", args("closed"), { timeout: GC_GH_TIMEOUT_MS })
   ]);
   return [...JSON.parse(open.stdout || "[]"), ...JSON.parse(closed.stdout || "[]")];
 }
 async function worktreeBranches() {
-  const { stdout } = await execFileP3("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
+  const { stdout } = await execFileP4("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
   const parsed = parseWorktreePorcelain(stdout);
   return await Promise.all(parsed.map(async (w) => {
     let dirty = true;
     try {
-      const { stdout: status } = await execFileP3("git", ["-C", w.path, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
+      const { stdout: status } = await execFileP4("git", ["-C", w.path, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
       dirty = status.trim().length > 0;
     } catch {
       dirty = true;
@@ -7616,7 +7709,7 @@ async function gcPlan(remote, limit) {
   const [branches, current, stale, prs, worktrees] = await Promise.all([
     gitOut(["branch", "--format=%(refname:short)"]),
     gitOut(["rev-parse", "--abbrev-ref", "HEAD"]),
-    execFileP3("git", ["remote", "prune", remote, "--dry-run"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseRemotePruneDryRun(`${r.stdout}${r.stderr}`)).catch(() => []),
+    execFileP4("git", ["remote", "prune", remote, "--dry-run"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseRemotePruneDryRun(`${r.stdout}${r.stderr}`)).catch(() => []),
     ghPrs(limit),
     worktreeBranches()
   ]);
@@ -7644,8 +7737,8 @@ async function applyGcPlan(plan2, remote) {
   const result = { removedBranches: [], removedTrackingRefs: [], failed: [], pruned: false };
   for (const branch of plan2.branches) {
     try {
-      if (branch.worktreePath) await execFileP3("git", ["worktree", "remove", "--force", branch.worktreePath], { timeout: GIT_TIMEOUT_MS });
-      await execFileP3("git", ["branch", "-D", branch.branch], { timeout: GIT_TIMEOUT_MS });
+      if (branch.worktreePath) await execFileP4("git", ["worktree", "remove", "--force", branch.worktreePath], { timeout: GIT_TIMEOUT_MS });
+      await execFileP4("git", ["branch", "-D", branch.branch], { timeout: GIT_TIMEOUT_MS });
       result.removedBranches.push(branch.branch);
     } catch (e) {
       result.failed.push(`${branch.branch}: ${e.message.split("\n")[0]}`);
@@ -7653,7 +7746,7 @@ async function applyGcPlan(plan2, remote) {
   }
   for (const ref of plan2.trackingRefs) {
     try {
-      await execFileP3("git", ["update-ref", "-d", `refs/remotes/${remote}/${ref.branch}`], { timeout: GIT_TIMEOUT_MS });
+      await execFileP4("git", ["update-ref", "-d", `refs/remotes/${remote}/${ref.branch}`], { timeout: GIT_TIMEOUT_MS });
       result.removedTrackingRefs.push(ref.branch);
     } catch (e) {
       result.failed.push(`${remote}/${ref.branch}: ${e.message.split("\n")[0]}`);
@@ -7661,7 +7754,7 @@ async function applyGcPlan(plan2, remote) {
   }
   if (plan2.branches.some((b) => b.worktreePath)) {
     try {
-      await execFileP3("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS });
+      await execFileP4("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS });
       result.pruned = true;
     } catch (e) {
       result.failed.push(`worktree prune: ${e.message.split("\n")[0]}`);
@@ -7691,7 +7784,7 @@ function readRepoVersion() {
 }
 async function fetchReleasedVersion() {
   try {
-    const { stdout } = await execFileP3("gh", pluginManifestVersionArgs(), { timeout: 5e3 });
+    const { stdout } = await execFileP4("gh", pluginManifestVersionArgs(), { timeout: 5e3 });
     return parseManifestVersion(stdout);
   } catch {
     return void 0;
@@ -7705,9 +7798,9 @@ async function applyVersionAutoUpdate(report, log) {
   const target = report.releasedVersion ?? "latest";
   if (action === "plugin-pull") {
     try {
-      const root = (await execFileP3("git", ["-C", process.env.CLAUDE_PLUGIN_ROOT, "rev-parse", "--show-toplevel"], { timeout: PLUGIN_PULL_TIMEOUT_MS })).stdout.trim();
+      const root = (await execFileP4("git", ["-C", process.env.CLAUDE_PLUGIN_ROOT, "rev-parse", "--show-toplevel"], { timeout: PLUGIN_PULL_TIMEOUT_MS })).stdout.trim();
       log(`  \u21BB refreshing MMI plugin ${report.currentVersion} \u2192 ${target} (effective next session)\u2026`);
-      await execFileP3("git", ["-C", root, "pull", "--ff-only"], { timeout: PLUGIN_PULL_TIMEOUT_MS });
+      await execFileP4("git", ["-C", root, "pull", "--ff-only"], { timeout: PLUGIN_PULL_TIMEOUT_MS });
       return { ...report, ok: true };
     } catch {
       return report;
@@ -7734,7 +7827,7 @@ async function requireFreshTrainCli(commandName) {
 var consoleIo = { log: (m) => console.log(m), err: (m) => console.error(m) };
 var CLAUDE_PLUGIN_TIMEOUT_MS = 12e4;
 function runHostBin(bin, args, opts) {
-  return isWin ? execFileP3("cmd.exe", ["/c", bin, ...args], opts) : execFileP3(bin, args, opts);
+  return isWin ? execFileP4("cmd.exe", ["/c", bin, ...args], opts) : execFileP4(bin, args, opts);
 }
 async function runClaudePlugin(args) {
   try {
@@ -7805,7 +7898,7 @@ async function runDocsSync(opts, io = consoleIo) {
     isDirty: async (f) => await gitOut(["status", "--porcelain", "--", f]) !== "",
     originContent: async (f) => {
       try {
-        return (await execFileP3("git", ["show", `origin/${def}:${f}`], { maxBuffer: 10 * 1024 * 1024 })).stdout;
+        return (await execFileP4("git", ["show", `origin/${def}:${f}`], { maxBuffer: 10 * 1024 * 1024 })).stdout;
       } catch {
         return null;
       }
@@ -7838,14 +7931,17 @@ async function runSagaShow(opts, io = consoleIo) {
   try {
     const key = await sagaKey(cfg);
     const qs = opts.latestAnywhere ? "scope=anywhere" : new URLSearchParams({ project: key.project, branch: key.branch }).toString();
-    const res = await fetch(`${cfg.sagaApiUrl}/saga/head?${qs}`, { headers: await sagaHeaders(), signal: AbortSignal.timeout(8e3) });
+    const res = await fetch(`${cfg.sagaApiUrl}/saga/head?${qs}`, { headers: await sagaHeaders(), signal: AbortSignal.timeout(3e3) });
     if (res.ok) {
       io.log(resumeCue());
       return io.log(await res.text());
     }
     if (!opts.quiet) io.log(`saga show failed: HTTP ${res.status}`);
   } catch (e) {
-    if (!opts.quiet) io.err(`saga show: ${e.message}`);
+    if (!opts.quiet) {
+      const reason = e.name === "TimeoutError" ? "backend unreachable (timed out after 3s)" : e.message;
+      io.err(`saga show: ${reason} \u2014 continuing without saga; diagnose with \`mmi-cli saga health --json\``);
+    }
   }
 }
 saga.command("show").option("--quiet", "no-op silently when unconfigured/unreachable (SessionStart hook)").option("--latest-anywhere", "resume the newest saga across all repos (default: current repo)").description("print your resume block \u2014 current repo HEAD + project memory (where you left off)").action((opts) => runSagaShow(opts));
@@ -7865,7 +7961,7 @@ saga.command("head-update").option("--run", "detached worker: fetch state, run t
     if (!headGateDue(tsPath)) return;
     markHeadRun(tsPath);
     try {
-      (0, import_node_child_process5.spawn)(process.execPath, [process.argv[1], "saga", "head-update", "--run"], {
+      (0, import_node_child_process6.spawn)(process.execPath, [process.argv[1], "saga", "head-update", "--run"], {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -7982,7 +8078,7 @@ var kb = program2.command("kb").description("org knowledgebase (read-only)");
 kb.command("get <path>").description("print a KB document by path").action(async (path2) => {
   const src = resolveKbSource((await loadConfig()).kbSource);
   try {
-    const { stdout } = await execFileP3("gh", buildKbGetArgs(src, path2), { timeout: 1e4 });
+    const { stdout } = await execFileP4("gh", buildKbGetArgs(src, path2), { timeout: 1e4 });
     process.stdout.write(stdout);
   } catch (e) {
     const err = e;
@@ -7992,7 +8088,7 @@ kb.command("get <path>").description("print a KB document by path").action(async
 kb.command("list [prefix]").description("list KB document paths (optionally under a prefix)").action(async (prefix) => {
   const src = resolveKbSource((await loadConfig()).kbSource);
   try {
-    const { stdout } = await execFileP3("gh", buildKbTreeArgs(src), { timeout: 1e4 });
+    const { stdout } = await execFileP4("gh", buildKbTreeArgs(src), { timeout: 1e4 });
     const paths = parseKbTree(stdout, prefix);
     if (!paths.length) return fail(`kb list: no documents${prefix ? ` under ${prefix}` : ""}`);
     console.log(paths.join("\n"));
@@ -8003,21 +8099,23 @@ kb.command("list [prefix]").description("list KB document paths (optionally unde
 });
 async function ghCreate(args) {
   try {
-    const { stdout } = await execFileP3("gh", args);
+    const { stdout } = await execFileP4("gh", args);
     return parseCreatedUrl(stdout);
   } catch (e) {
     const err = e;
     fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}`);
   }
 }
-async function ghJson3(args, timeout = 1e4) {
-  const { stdout } = await execFileP3("gh", args, { timeout });
+async function ghJson(args, timeout = 1e4) {
+  const { stdout } = await execFileP4("gh", args, { timeout });
   return JSON.parse(stdout);
 }
 async function resolveRepo(repo) {
   if (repo) return repo;
+  const fromOrigin = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]));
+  if (fromOrigin) return fromOrigin;
   try {
-    const { stdout } = await execFileP3("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { timeout: 5e3 });
+    const { stdout } = await execFileP4("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { timeout: 5e3 });
     return stdout.trim() || void 0;
   } catch {
     return void 0;
@@ -8033,19 +8131,14 @@ async function attachToProject(issueNumber, repo, priority) {
   try {
     const viewArgs = ["issue", "view", String(issueNumber), "--json", "id", "--jq", ".id"];
     if (targetRepo2) viewArgs.push("--repo", targetRepo2);
-    const { stdout: idOut } = await execFileP3("gh", viewArgs, { timeout: 1e4 });
+    const { stdout: idOut } = await execFileP4("gh", viewArgs, { timeout: 1e4 });
     const contentId = idOut.trim();
     if (!contentId) throw new Error("could not resolve issue node id");
-    const { stdout } = await execFileP3("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: 1e4 });
+    const { stdout } = await execFileP4("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: 1e4 });
     const projectItemId = parseAddedItemId(stdout);
     if (projectItemId && priority) {
       try {
-        await setBoardItemPriority(
-          async (args) => execFileP3("gh", args, { timeout: 1e4 }),
-          cfg,
-          projectItemId,
-          priority
-        );
+        await setBoardItemPriority(defaultGitHubClient(), cfg, projectItemId, priority);
       } catch (e) {
         const err = e;
         process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(err.stderr || err.message || String(e)).trim()}
@@ -8064,7 +8157,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process5.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process6.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -8120,7 +8213,7 @@ function openInEditor(path2) {
     return;
   }
   try {
-    (0, import_node_child_process5.spawn)(editor, [path2], { stdio: "inherit" });
+    (0, import_node_child_process6.spawn)(editor, [path2], { stdio: "inherit" });
   } catch {
     console.log(`open ${path2} manually`);
   }
@@ -8178,7 +8271,9 @@ function makeSecretsDeps(cfg) {
     apiUrl: cfg.sagaApiUrl,
     fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
     headers: (extra) => sagaHeaders(extra),
-    slug: async () => (await sagaKey(cfg)).project,
+    // Vault paths are lowercase kebab (AGENTS.md naming); sagaKey carries the repo name's original
+    // casing, which leaked mixed-case into `secrets where` output (#681).
+    slug: async () => (await sagaKey(cfg)).project.toLowerCase(),
     readSecretValue: () => readSecretStdin(),
     log: (m) => console.log(m),
     err: (m) => console.error(m)
@@ -8278,22 +8373,22 @@ async function v2ReadinessDeps(cfg) {
 async function updateV2ReadinessIssue(repo, report, healed) {
   const title = "v2 readiness: central deploy + secrets alignment";
   const freshBody = renderReadinessIssueBody("", report, { healed });
-  const list = await execFileP3("gh", ["issue", "list", "--repo", repo, "--state", "open", "--search", "v2 readiness in:title", "--json", "number,title", "--limit", "20"], { timeout: 2e4 });
+  const list = await execFileP4("gh", ["issue", "list", "--repo", repo, "--state", "open", "--search", "v2 readiness in:title", "--json", "number,title", "--limit", "20"], { timeout: 2e4 });
   const issues = JSON.parse(list.stdout || "[]");
   const existing = issues.find((i) => i.title.toLowerCase().includes("v2 readiness"));
   if (!existing) {
-    const created = await execFileP3("gh", ["issue", "create", "--repo", repo, "--title", title, "--body", freshBody, "--label", "feature"], { timeout: 2e4 });
+    const created = await execFileP4("gh", ["issue", "create", "--repo", repo, "--title", title, "--body", freshBody, "--label", "feature"], { timeout: 2e4 });
     const url = created.stdout.trim();
     const number = Number(url.match(/\/issues\/(\d+)$/)?.[1] ?? 0);
     return { number, url, action: "created" };
   }
-  const view = await execFileP3("gh", ["issue", "view", String(existing.number), "--repo", repo, "--json", "body,url", "--jq", "{body:.body,url:.url}"], { timeout: 2e4 });
+  const view = await execFileP4("gh", ["issue", "view", String(existing.number), "--repo", repo, "--json", "body,url", "--jq", "{body:.body,url:.url}"], { timeout: 2e4 });
   const current = JSON.parse(view.stdout || "{}");
   const nextBody = renderReadinessIssueBody(current.body ?? "", report, { healed });
-  await execFileP3("gh", ["issue", "edit", String(existing.number), "--repo", repo, "--body", nextBody], { timeout: 2e4 });
+  await execFileP4("gh", ["issue", "edit", String(existing.number), "--repo", repo, "--body", nextBody], { timeout: 2e4 });
   return { number: existing.number, url: current.url ?? `https://github.com/${repo}/issues/${existing.number}`, action: "updated" };
 }
-var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); set is master-only");
+var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); attest is project-admin; set is master-only");
 async function projectTarget(commandName, explicitTarget) {
   return requireProjectTarget(commandName, explicitTarget, explicitTarget ? void 0 : await resolveRepo());
 }
@@ -8330,7 +8425,7 @@ project.command("resolve <owner/repo>").description("deploy coords for a stage \
   }
   fail(msg);
 });
-project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
+project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files \u2014 appOwnedGaps are advisory templates; clear them with `project attest`; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -8380,6 +8475,18 @@ project.command("readiness [owner/repo]").description("update the repo v2 readin
   const issue2 = await updateV2ReadinessIssue(target, report, []);
   console.log(JSON.stringify({ ok: true, repo: target, issue: issue2, ready: report.ok }));
 });
+project.command("attest [owner/repo]").description("attest this repo's app-owned v2 readiness work is done (project-admin of the repo or master) \u2014 clears doctor's static appOwnedGaps; re-running overwrites; defaults to the current repo").option("--json", "machine-readable output").action(async (repoOrSlug) => {
+  const cfg = await loadConfig();
+  let target;
+  try {
+    target = await projectTarget("project attest", repoOrSlug);
+  } catch (e) {
+    return fail(e.message);
+  }
+  const repo = target.includes("/") ? target : `mutmutco/${slugOf(target)}`;
+  const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
+  reportWrite("project attest", res);
+});
 project.command("set [owner/repo]").description("MASTER-ONLY: upsert a project META (idempotent merge; defaults to the current repo; no clobber of unspecified fields)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--var <KEY=VALUE...>", "META field to set (repeatable): name, division, projectId, branch, wikiRepo, vaultPath, kbPointer").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
@@ -8494,7 +8601,7 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
     const la = ["label", "create", label, "--color", "ededed"];
     if (o.repo) la.push("--repo", o.repo);
     try {
-      await execFileP3("gh", la, { timeout: 1e4 });
+      await execFileP4("gh", la, { timeout: 1e4 });
     } catch {
     }
   }
@@ -8509,7 +8616,7 @@ issue.command("discover-related").description("find related issues for an existi
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("issue discover-related: could not resolve repo");
   try {
-    const issues = await ghJson3([
+    const issues = await ghJson([
       "issue",
       "list",
       "--repo",
@@ -8524,7 +8631,7 @@ issue.command("discover-related").description("find related issues for an existi
     const candidates = findRelatedIssues({ number, title: o.title, body: o.body }, issues);
     if (o.json) return console.log(JSON.stringify({ number, repo, candidates }, null, 2));
     if (!candidates.length) return;
-    const viewed = await ghJson3([
+    const viewed = await ghJson([
       "issue",
       "view",
       String(number),
@@ -8534,11 +8641,11 @@ issue.command("discover-related").description("find related issues for an existi
       "comments"
     ]);
     if (viewed.comments.some((comment) => comment.body.includes(relatedMarker(number)))) return;
-    await execFileP3("gh", ["issue", "comment", String(number), "--repo", repo, "--body", buildRelatedComment(number, candidates)], { timeout: 1e4 });
+    await execFileP4("gh", ["issue", "comment", String(number), "--repo", repo, "--body", buildRelatedComment(number, candidates)], { timeout: 1e4 });
   } catch {
   }
 });
-program2.command("report").description("file a friction report on the Hub board (GitHub auth, dedups open reports) and print {number,url} JSON").requiredOption("--title <title>", "one-line friction summary").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").option("--type <type>", "bug | feature | task (sets the matching label)", "task").option("--priority <priority>", "urgent | high | medium | low (board Priority field when configured)", "medium").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO})`).option("--force", "file a new issue even when an open report looks like a duplicate").action(async (o) => {
+program2.command("report").description("file a friction report on the Hub board (GitHub auth, dedups open reports) and print {number,url} JSON").requiredOption("--title <title>", "one-line friction summary").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").option("--type <type>", "bug | feature | task (sets the matching label)", "task").option("--priority <priority>", "urgent | high | medium | low (board Priority field when configured)", "medium").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO})`).option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 report always prints JSON; #682)").action(async (o) => {
   let body;
   let priority;
   let args;
@@ -8561,7 +8668,7 @@ program2.command("report").description("file a friction report on the Hub board
   if (!o.force) {
     let openReports = [];
     try {
-      openReports = await ghJson3([
+      openReports = await ghJson([
         "issue",
         "list",
         "--repo",
@@ -8580,7 +8687,7 @@ program2.command("report").description("file a friction report on the Hub board
     const dup = findDuplicateReport({ title: o.title, body }, openReports);
     if (dup) {
       try {
-        await execFileP3("gh", ["issue", "comment", String(dup.number), "--repo", targetRepo2, "--body", buildDupComment(dup.number, body, sourceRepo)], { timeout: 1e4 });
+        await execFileP4("gh", ["issue", "comment", String(dup.number), "--repo", targetRepo2, "--body", buildDupComment(dup.number, body, sourceRepo)], { timeout: 1e4 });
       } catch (e) {
         const err = e;
         return fail(`report: duplicate of #${dup.number} (${dup.url}) but the +1 comment failed: ${(err.stderr || err.message || String(e)).trim()}`);
@@ -8589,7 +8696,7 @@ program2.command("report").description("file a friction report on the Hub board
     }
   }
   try {
-    await execFileP3("gh", ["label", "create", REPORT_LABEL, "--color", "ededed", "--repo", targetRepo2], { timeout: 1e4 });
+    await execFileP4("gh", ["label", "create", REPORT_LABEL, "--color", "ededed", "--repo", targetRepo2], { timeout: 1e4 });
   } catch {
   }
   const created = await ghCreate(args);
@@ -8604,7 +8711,7 @@ pr.command("create").description("create a PR and print {number,url} JSON").requ
 async function remoteBranchExists(branch) {
   if (!branch) return void 0;
   try {
-    const { stdout } = await execFileP3("git", ["ls-remote", "--heads", "origin", branch], { timeout: GIT_TIMEOUT_MS });
+    const { stdout } = await execFileP4("git", ["ls-remote", "--heads", "origin", branch], { timeout: GIT_TIMEOUT_MS });
     return stdout.trim().length > 0;
   } catch {
     return void 0;
@@ -8613,15 +8720,15 @@ async function remoteBranchExists(branch) {
 pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
-  const headRef = (await execFileP3("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName", "--jq", ".headRefName"], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
-  const startingPath = (await execFileP3("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
+  const headRef = (await execFileP4("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName", "--jq", ".headRefName"], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
+  const startingPath = (await execFileP4("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   const beforeWorktrees = parseWorktreePorcelain(
-    (await execFileP3("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
+    (await execFileP4("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
   const remoteBefore = repoArgs.length ? void 0 : await remoteBranchExists(headRef);
   let remoteDeleteAttempted = false;
   let remoteNotAttemptedReason = repoArgs.length ? "repo-option" : void 0;
-  await execFileP3("gh", ["pr", "merge", number, ...repoArgs, method, "--delete-branch"], { timeout: GC_GH_TIMEOUT_MS }).catch((e) => {
+  await execFileP4("gh", ["pr", "merge", number, ...repoArgs, method, "--delete-branch"], { timeout: GC_GH_TIMEOUT_MS }).catch((e) => {
     const message = String(e.message || "");
     if (/already been merged/i.test(message)) {
       remoteNotAttemptedReason = "pr-already-merged";
@@ -8644,7 +8751,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   } : await cleanupPrMergeLocalBranch(headRef, {
     beforeWorktrees,
     startingPath,
-    execGit: async (args) => (await execFileP3("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
+    execGit: async (args) => (await execFileP4("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
   });
   console.log(JSON.stringify({
     merged: number,
@@ -8769,7 +8876,7 @@ function stageKeepAlive() {
 program2.command("port-range <repo>").description("assign (idempotently) + print the repo's local stage port block via the atomic ORG#config.portCursor allocator (committed-file fallback)").option("--json", "machine-readable output").action(async (repo, o) => {
   const path2 = (0, import_node_path5.join)(process.cwd(), "infra", "port-ranges.json");
   const allocate = async (seed) => {
-    const { stdout } = await execFileP3("node", [(0, import_node_path5.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
+    const { stdout } = await execFileP4("node", [(0, import_node_path5.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
     const parsed = JSON.parse(stdout);
     if (!Array.isArray(parsed.range) || parsed.range.length !== 2) throw new Error("port-ddb: no range in output");
     return parsed.range;
@@ -8875,8 +8982,8 @@ for (const commandName of ["rcand", "release", "hotfix"]) {
       if (commandName === "hotfix") return fail("hotfix: CLI apply is reserved; use the /hotfix skill PR path after explicit master-admin approval");
       try {
         const result = await runTrainApply(commandName, {
-          run: async (file, args) => (await execFileP3(file, args, { timeout: file === "gh" ? 3e4 : GIT_TIMEOUT_MS })).stdout,
-          runSelf: async (args) => (await execFileP3(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
+          run: async (file, args) => (await execFileP4(file, args, { timeout: file === "gh" ? 3e4 : GIT_TIMEOUT_MS })).stdout,
+          runSelf: async (args) => (await execFileP4(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
           trainAuthority: async (repo) => {
             const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
             return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
@@ -8907,7 +9014,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
   const slug = (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
   const meta = await fetchProjectBySlug(slug, { baseUrl: cfg.sagaApiUrl, token: githubToken });
   const report = await verifyBootstrap(repo, o.class, {
-    gh: async (args) => execFileP3("gh", args, { timeout: 2e4 }),
+    client: defaultGitHubClient(),
     projectMeta: meta,
     readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs5.existsSync)(path2) ? (0, import_node_fs5.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
@@ -8920,7 +9027,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     })(),
     listEnabledGcpApis: async (gcpProject) => {
       try {
-        const { stdout } = await execFileP3(
+        const { stdout } = await execFileP4(
           "gcloud",
           ["services", "list", "--enabled", "--project", gcpProject, "--format", "value(config.name)"],
           { timeout: 3e4 }
@@ -8954,7 +9061,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
   const manifest = loadBootstrapSeeds((0, import_node_fs5.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
-  const gh = async (args) => execFileP3("gh", args, { timeout: 2e4 });
+  const gh = async (args) => execFileP4("gh", args, { timeout: 2e4 });
   const readFile2 = (p) => (0, import_node_fs5.existsSync)(p) ? (0, import_node_fs5.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const vars = {};
@@ -9071,7 +9178,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
 });
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
   const o = { json: rawFlag("--json"), repo: rawValue("--repo", ""), class: rawValue("--class", "deployable") };
-  const deps = { gh: async (args) => execFileP3("gh", args, { timeout: 2e4 }) };
+  const deps = { client: defaultGitHubClient() };
   let targets;
   const cfg = await loadConfig();
   const registryProjects = await fetchProjectsList(registryClientDeps(cfg));
@@ -9219,17 +9326,17 @@ async function runDoctor(opts, io = consoleIo) {
   const CLONE_FIX = 'run: git config --global url."https://github.com/".insteadOf "git@github.com:"';
   const [login, pathProbe, releasedVersion, cfg, callerArn, cloneProbe] = await Promise.all([
     githubLogin(),
-    execFileP3(isWin ? "where" : "which", ["mmi-cli"]).then(() => true).catch(() => false),
+    execFileP4(isWin ? "where" : "which", ["mmi-cli"]).then(() => true).catch(() => false),
     fetchReleasedVersion(),
     loadConfig(),
     awsCallerArn(),
-    execFileP3("git", ["config", "--global", "--get-all", REWRITE_KEY]).then(({ stdout }) => stdout.split("\n").some((l) => l.trim() === "git@github.com:")).catch(() => false)
+    execFileP4("git", ["config", "--global", "--get-all", REWRITE_KEY]).then(({ stdout }) => stdout.split("\n").some((l) => l.trim() === "git@github.com:")).catch(() => false)
     // unset → repair below
   ]);
   let ghInstalled = true;
   if (!login) {
     try {
-      await execFileP3("gh", ["--version"]);
+      await execFileP4("gh", ["--version"]);
     } catch {
       ghInstalled = false;
     }
@@ -9256,7 +9363,7 @@ async function runDoctor(opts, io = consoleIo) {
   let cloneOk = cloneProbe;
   if (!cloneOk && !opts.banner && !opts.json) {
     try {
-      await execFileP3("git", ["config", "--global", "--add", REWRITE_KEY, "git@github.com:"]);
+      await execFileP4("git", ["config", "--global", "--add", REWRITE_KEY, "git@github.com:"]);
       cloneOk = true;
       io.err("  \u21BB repaired: git insteadOf git@github.com \u2192 https (plugin clone over HTTPS)");
     } catch {