@mutmutco/cli 2.52.1 → 2.54.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -3601,7 +3601,7 @@ async function sweepDeferredWorktreesWithRetry(store, deps, opts = {}) {
   }
   return last;
 }
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function removeWorktreeWithRecovery(wtPath, deps) {
   const maxAttempts = deps.maxAttempts ?? 3;
   const backoff = deps.backoffMs ?? [250, 1e3];
@@ -4609,7 +4609,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithSpineResolution(deps, sourceRef, label, resolve5, extraTolerated = []) {
+async function mergeWithSpineResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -4623,7 +4623,7 @@ async function mergeWithSpineResolution(deps, sourceRef, label, resolve5, extraT
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on non-spine path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve5}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -4740,7 +4740,7 @@ function requireProjectMetaForTrain(load, repo) {
 var CORRELATE_ATTEMPTS = 5;
 var CORRELATE_DELAY_MS = 1500;
 var CORRELATE_SKEW_SLACK_MS = 1e4;
-var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
@@ -4959,6 +4959,23 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
     `timed out waiting for required train checks on ${sha}: ${lastError ? `last error: ${lastError}` : lastStatus}`
   );
 }
+function partialTrainRecoveryError(cause, input) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  const branch = input.stage;
+  const releaseState = input.stage === "rc" ? "GitHub Release n/a" : "GitHub Release not created";
+  const releaseCommand = input.stage === "main" ? `
+  2. gh release create ${input.tag} --target main --generate-notes --latest --repo ${input.repo}` : "";
+  const deployStep = input.stage === "main" ? "3" : "2";
+  return new Error(
+    `${causeMessage}
+
+partial train state: tag ${input.tag} is already pushed; origin/${branch} has not been pushed; ${releaseState}; deploy not dispatched.
+Recovery sequence:
+  1. git push origin ${branch}` + releaseCommand + `
+  ${deployStep}. mmi-cli tenant redeploy ${input.repo} ${input.stage} --watch
+Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
+  );
+}
 async function ensureTagPushed(deps, tag, sha) {
   const remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]);
   const remoteSha = clean(remoteOut).split(/\s+/)[0] || "";
@@ -5167,19 +5184,25 @@ async function mergeSourceToMain(deps, deployModel, args) {
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
   await ensureTagPushed(deps, tag, releaseSha);
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
-  const checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+  let checks;
+  try {
+    checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+  } catch (e) {
+    throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
+  }
   await deps.run("git", ["push", "origin", "main"]);
   const releaseUrl = clean(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
-  const publishDispatch = deployDispatch.deployStatus === "failure" ? null : await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report");
+  const publishDispatch = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  if (!publishDispatch && deployDispatch.deployStatus === "failure" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
+  if (!publishDispatch && deployDispatch.deployStatus !== "success" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
+    const reason = deployDispatch.deployStatus === "failure" ? "box deploy failed \u2014 redeploy the box before publishing" : "box deploy not confirmed (run with --watch) \u2014 publish after the box deploy lands";
     dispatch = {
       ...dispatch,
-      note: `${dispatch.note}; tenant-publish.yml skipped (box deploy failed \u2014 redeploy the box before publishing)`
+      note: `${dispatch.note}; tenant-publish.yml skipped (${reason})`
     };
   }
   return { checks, releaseUrl, announceNote, dispatch };
@@ -5217,7 +5240,12 @@ async function runTrainApplyPipeline(mode, input) {
     const resumeNote = resume.tag ? resume.note : void 0;
     await ensureTagPushed(deps, tag2, rcSha);
     const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
-    const checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+    let checks2;
+    try {
+      checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+    } catch (e) {
+      throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
+    }
     const autoRunSince = (deps.now ?? Date.now)();
     await deps.run("git", ["push", "origin", "rc"]);
     const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
@@ -5653,7 +5681,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -5712,7 +5740,7 @@ function hardExit(code) {
 async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
-  await new Promise((resolve5) => setImmediate(resolve5));
+  await new Promise((resolve6) => setImmediate(resolve6));
   process.exit(code);
 }
 async function failGraceful(msg) {
@@ -6084,18 +6112,23 @@ function headPrompt(state) {
   const decisions = shownDecisions(state.decisions);
   const actions = (state.actionLog ?? []).slice(-HEAD_PROMPT_ACTION_LIMIT);
   return [
-    "You maintain ONE durable slot of a work-session: PINNED (things worth remembering). Given the CURRENT",
-    "HEAD and the recent TRANSCRIPT + DECISIONS, return an updated PINNED only. Keep it tight and concrete;",
-    "keep anything the user pinned; never invent; preserve Turkish characters (\xE7 \u011F \u0131 \u0130 \xF6 \u015F \xFC) exactly. Do",
-    "NOT manage next or the checklist \u2014 the note path owns those. The ANCHOR is the read-only North-Star \u2014",
-    "NEVER change it. Never restate an unverified artifact-claim (a named file, PR, flag, or board state)",
-    "as settled fact \u2014 keep it as the belief it was recorded as.",
+    "You maintain two durable slots of a work-session: PINNED (things worth remembering) and a NEXT",
+    "SUGGESTION (a best-effort one-line hint for the next useful step). Given the CURRENT HEAD and the",
+    "recent TRANSCRIPT + DECISIONS, return an updated PINNED and, optionally, a next suggestion. Keep",
+    "PINNED tight and concrete; keep anything the user pinned; never invent; preserve Turkish characters",
+    "(\xE7 \u011F \u0131 \u0130 \xF6 \u015F \xFC) exactly. Do NOT manage the checklist \u2014 the note path owns that. The ANCHOR is the",
+    "read-only North-Star \u2014 NEVER change it. Never restate an unverified artifact-claim (a named file,",
+    "PR, flag, or board state) as settled fact \u2014 keep it as the belief it was recorded as.",
     "You MAY also propose supersessions: each DECISION is shown with its original stable 0-based index. Propose a",
     "supersession ONLY for a NEWER decision that directly contradicts/replaces an OLDER one where neither",
     "already carries a supersededBy. HIGH PRECISION \u2014 propose ONLY when you are confident the older claim",
     "is now false or obsolete; the newer decision's timestamp MUST be later than the older's (newer-supersedes-",
-    "older only, never the reverse). When unsure, propose nothing. NEVER touch the anchor, next, or checklist.",
-    'Output ONLY a JSON object: {"pinned":[string],"supersede":[{"older":int,"newer":int,"reason":string}]}.',
+    "older only, never the reverse). When unsure, propose nothing. NEVER touch the anchor or checklist.",
+    'For "next": propose a single concise actionable line (\u2264140 chars) describing the most useful next step',
+    "for a future session, derived from the transcript. This is a best-effort suggestion shown only when",
+    "the user has not set their own NEXT. Use an empty string if nothing concrete emerges \u2014 never invent.",
+    "Preserve Turkish characters exactly.",
+    'Output ONLY a JSON object: {"pinned":[string],"next":string,"supersede":[{"older":int,"newer":int,"reason":string}]}.',
     "",
     "CURRENT HEAD:",
     JSON.stringify(state.head ?? {}, null, 2),
@@ -6119,6 +6152,9 @@ function parseHeadUpdate(raw) {
   if (!obj || typeof obj !== "object") return null;
   const u = {};
   if (Array.isArray(obj.pinned)) u.pinned = obj.pinned.filter((x) => typeof x === "string");
+  if (typeof obj.next === "string" && obj.next.trim()) {
+    u.nextAuto = obj.next.trim().slice(0, 280);
+  }
   if (Array.isArray(obj.supersede)) {
     const supersede = obj.supersede.filter((e) => {
       if (!e || typeof e !== "object") return false;
@@ -6131,12 +6167,12 @@ function parseHeadUpdate(raw) {
 }
 async function runHeadEngine(prompt, timeoutMs = HEAD_ENGINE_TIMEOUT_MS) {
   const { cmd, args, shell: shell2 } = resolveEngine(process.platform, process.env.SAGA_HEAD_ENGINE);
-  return await new Promise((resolve5) => {
+  return await new Promise((resolve6) => {
     let child;
     try {
       child = (0, import_node_child_process3.spawn)(cmd, args, { shell: shell2, windowsHide: true });
     } catch {
-      return resolve5("");
+      return resolve6("");
     }
     let out = "";
     let done = false;
@@ -6144,7 +6180,7 @@ async function runHeadEngine(prompt, timeoutMs = HEAD_ENGINE_TIMEOUT_MS) {
       if (done) return;
       done = true;
       clearTimeout(timer);
-      resolve5(v);
+      resolve6(v);
     };
     const timer = setTimeout(() => {
       try {
@@ -6292,8 +6328,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve5) => {
-    timer = setTimeout(resolve5, timeoutMs);
+  const timeout = new Promise((resolve6) => {
+    timer = setTimeout(resolve6, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -6966,7 +7002,7 @@ var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process5.exe
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
 function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -6976,7 +7012,7 @@ function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
       child.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve5), graceMs);
+    const timer = setTimeout(() => finish(resolve6), graceMs);
     child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -7186,10 +7222,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve5(false));
-    srv.once("listening", () => srv.close(() => resolve5(true)));
+    srv.once("error", () => resolve6(false));
+    srv.once("listening", () => srv.close(() => resolve6(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -7365,6 +7401,18 @@ function writeState(path2, state) {
   mkdirFor(path2);
   (0, import_node_fs9.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
+function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
+  const reservation = {
+    pid: 0,
+    command: "",
+    cwd,
+    statePath,
+    startedAt: now().toISOString(),
+    port
+  };
+  writeState(statePath, reservation);
+  if (globalStatePath && globalStatePath !== statePath) writeState(globalStatePath, reservation);
+}
 async function cleanupStageState(state, paths, timeoutMs, fallbackCwd) {
   await killTree(state.pid);
   if (state.teardown?.command.trim()) {
@@ -7388,7 +7436,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve5) => setTimeout(resolve5, 500));
+  await new Promise((resolve6) => setTimeout(resolve6, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -7409,7 +7457,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+    await new Promise((resolve6) => setTimeout(resolve6, 1e3));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -7505,6 +7553,8 @@ async function runStage(config = {}, opts = {}) {
   if (problems.length) throw new Error(problems.join("; "));
   const cwd = opts.cwd ?? process.cwd();
   const timeoutMs = opts.timeoutMs ?? 6e4;
+  const statePath = opts.statePath ?? stageStatePath(cwd);
+  const globalStatePath = await resolveGlobalStatePath(cwd, opts.globalStatePath);
   const portGuard = resolveStagePortGuard(opts);
   await stopStage({ ...opts, cwd, requiredIdentityCwd: opts.requiredIdentityCwd ?? cwd });
   const reserved = await reservedPortsForWorktree(cwd);
@@ -7515,11 +7565,20 @@ async function runStage(config = {}, opts = {}) {
     stagePort = await resolveStagePort(config, portGuard, reserved);
   }
   const sub = (s) => substituteStagePort(s, stagePort);
-  await ensureStageRuntimeEnv(config, opts, cwd);
+  if (stagePort != null) {
+    writeStagePortReservation(stagePort, cwd, statePath, globalStatePath, opts.now ?? (() => /* @__PURE__ */ new Date()));
+  }
   const extraEnv = stageExtraEnv(config, stagePort);
   const build2 = config.build?.trim();
   const ranBuild = Boolean(build2);
-  if (build2) await shell(sub(build2), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
+  try {
+    await ensureStageRuntimeEnv(config, opts, cwd);
+    if (build2) await shell(sub(build2), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
+  } catch (e) {
+    (0, import_node_fs9.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs9.rmSync)(globalStatePath, { force: true });
+    throw e;
+  }
   const started = await startStage(config, {
     ...opts,
     cwd,
@@ -8519,15 +8578,28 @@ function planDirtyForAutosave(localHash, meta, project2, slug, queue) {
   if (metaEntry?.hash === localHash) return false;
   return true;
 }
-function planSlugsNeedingAutosave(deps, project2, slugs) {
+function resolveAutosaveProject(meta, queue, defaultProject, slug) {
+  const candidates = /* @__PURE__ */ new Set();
+  const suffix = `/${slug}`;
+  for (const key of Object.keys(meta)) {
+    if (key.endsWith(suffix)) candidates.add(key.slice(0, -suffix.length));
+  }
+  for (const entry of queue) {
+    if (entry.slug === slug) candidates.add(entry.project);
+  }
+  if (candidates.size === 1) return [...candidates][0];
+  return defaultProject;
+}
+function plansNeedingAutosave(deps, project2, slugs) {
   const meta = parseMeta(deps.readMetaRaw());
   const queue = parseQueue(deps.readQueueRaw());
   const out = [];
   for (const slug of slugs) {
     const raw = deps.readLocal(slug);
     if (raw == null) continue;
+    const autosaveProject = resolveAutosaveProject(meta, queue, project2, slug);
     const hash = hashContent(normalizeEol(raw));
-    if (planDirtyForAutosave(hash, meta, project2, slug, queue)) out.push(slug);
+    if (planDirtyForAutosave(hash, meta, autosaveProject, slug, queue)) out.push({ project: autosaveProject, slug });
   }
   return out;
 }
@@ -8555,11 +8627,11 @@ async function planAutoEnqueueDirty(deps, opts = {}) {
     }
   }
   const enqueued = [];
-  for (const slug of planSlugsNeedingAutosave(deps, project2, slugs)) {
-    const raw = deps.readLocal(slug);
+  for (const entry of plansNeedingAutosave(deps, project2, slugs)) {
+    const raw = deps.readLocal(entry.slug);
     if (raw == null) continue;
-    enqueuePlanPush(deps, { project: project2, slug, hash: hashContent(normalizeEol(raw)) }, { detach: false });
-    enqueued.push(slug);
+    enqueuePlanPush(deps, { project: entry.project, slug: entry.slug, hash: hashContent(normalizeEol(raw)) }, { detach: false });
+    enqueued.push(entry.slug);
   }
   if (enqueued.length) deps.detachSync();
   return enqueued;
@@ -11210,6 +11282,11 @@ function defaultWorktreePath(repoRoot, branch) {
   const safe = branch.replace(/[/\\]+/g, "-");
   return (0, import_node_path15.join)((0, import_node_path15.dirname)(repoRoot), "mmi-worktrees", safe);
 }
+function resolveWorktreeBase(from, remote) {
+  const remotePrefix = `${remote}/`;
+  const fetchBranch = from.startsWith(remotePrefix) ? from.slice(remotePrefix.length) : void 0;
+  return { base: from, fetchBranch };
+}
 
 // src/northstar-context.ts
 var SESSION_START_NORTHSTAR_TIMEOUT_MS = 3e3;
@@ -11350,7 +11427,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -12414,7 +12491,7 @@ var PR_LAND_STATE_READ_DELAY_MS = 2e3;
 async function readGhPrStateWithRetry(fetchState2, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -13621,35 +13698,18 @@ async function detectPublicIp(fetchImpl = fetch) {
   if (!validStageLiveIp(ip)) throw new Error(`public IP detection returned a non-IP body from ${IP_ECHO_URL}: "${ip.slice(0, 80)}"`);
   return ip;
 }
-function ghDispatchArgs(workflow, inputs) {
-  const args = ["workflow", "run", workflow, "--repo", STAGE_LIVE_HUB_REPO];
-  for (const [key, value] of Object.entries(inputs)) args.push("-f", `${key}=${value}`);
-  return args;
-}
 function stageLiveUpSteps(t) {
   return [
     { label: `detect your public IP (${IP_ECHO_URL}, bounded)` },
-    {
-      label: `deploy ${t.ref ?? "<current branch>"} to the ${t.slug} dev stage via the central deployer`,
-      command: `gh ${ghDispatchArgs("tenant-deploy.yml", { slug: t.slug, repo: t.repo, ref: t.ref ?? "<branch>", stage: "dev" }).join(" ")}`
-    },
-    {
-      label: `gate ${t.host} to your IP at the Cloudflare edge (ephemeral firewall_custom skip rule)`,
-      command: `gh ${ghDispatchArgs("tenant-control.yml", { slug: t.slug, stage: "dev", action: "cf-gate-allow", host: t.host, ip: "<your ip>" }).join(" ")}`
-    },
+    { label: `deploy ${t.ref ?? "<current branch>"} to the ${t.slug} dev stage via the Hub backend (tenant-deploy)` },
+    { label: `gate ${t.host} to your IP at the Cloudflare edge via the Hub backend (tenant-control cf-gate-allow)` },
     { label: "tear down when done", command: "mmi-cli stage --live --down --apply" }
   ];
 }
 function stageLiveDownSteps(t) {
   return [
-    {
-      label: `stop the ${t.slug} dev runtime`,
-      command: `gh ${ghDispatchArgs("tenant-control.yml", { slug: t.slug, stage: "dev", action: "stop" }).join(" ")}`
-    },
-    {
-      label: "remove the Cloudflare edge gate (the stage goes dark even if restarted)",
-      command: `gh ${ghDispatchArgs("tenant-control.yml", { slug: t.slug, stage: "dev", action: "cf-gate-clear", host: t.host }).join(" ")}`
-    }
+    { label: `stop the ${t.slug} dev runtime via the Hub backend (tenant-control stop)` },
+    { label: `remove the Cloudflare edge gate for ${t.host} via the Hub backend (tenant-control cf-gate-clear)` }
   ];
 }
 async function runStageLiveUp(deps, t) {
@@ -13657,8 +13717,8 @@ async function runStageLiveUp(deps, t) {
   const ip = (await deps.detectIp()).trim();
   if (!validStageLiveIp(ip)) throw new Error(`stage --live: detected public IP is not a literal IPv4/IPv6 address: "${ip.slice(0, 80)}"`);
   if (!t.host?.trim()) throw new Error("stage --live: cannot resolve the dev edge host (registry edgeDomains.dev)");
-  await deps.run("gh", ghDispatchArgs("tenant-deploy.yml", { slug: t.slug, repo: t.repo, ref: t.ref, stage: "dev" }));
-  await deps.run("gh", ghDispatchArgs("tenant-control.yml", { slug: t.slug, stage: "dev", action: "cf-gate-allow", host: t.host, ip }));
+  await deps.deployDev({ repo: t.repo, ref: t.ref });
+  await deps.control({ repo: t.repo, action: "cf-gate-allow", host: t.host, ip });
   return {
     command: "stage --live",
     mode: "up",
@@ -13672,8 +13732,8 @@ async function runStageLiveUp(deps, t) {
 }
 async function runStageLiveDown(deps, t) {
   if (!t.host?.trim()) throw new Error("stage --live: cannot resolve the dev edge host (registry edgeDomains.dev)");
-  await deps.run("gh", ghDispatchArgs("tenant-control.yml", { slug: t.slug, stage: "dev", action: "stop" }));
-  await deps.run("gh", ghDispatchArgs("tenant-control.yml", { slug: t.slug, stage: "dev", action: "cf-gate-clear", host: t.host }));
+  await deps.control({ repo: t.repo, action: "stop" });
+  await deps.control({ repo: t.repo, action: "cf-gate-clear", host: t.host });
   return {
     command: "stage --live",
     mode: "down",
@@ -14174,7 +14234,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -14400,12 +14460,13 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
       "report",
       meta.publishDir
     );
-    const publish = deploy.deployStatus === "failure" ? null : await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, true, "report");
+    const publish = deploy.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, true, "report") : null;
     let dispatch = appendPublishDispatch(deploy, publish);
-    if (!publish && deploy.deployStatus === "failure" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
+    if (!publish && deploy.deployStatus !== "success" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
+      const reason = deploy.deployStatus === "failure" ? "box deploy failed \u2014 redeploy the box before publishing" : "box deploy not confirmed (run with --watch) \u2014 publish after the box deploy lands";
       dispatch = {
         ...dispatch,
-        note: `${dispatch.note}; tenant-publish.yml skipped (box deploy failed \u2014 redeploy the box before publishing)`
+        note: `${dispatch.note}; tenant-publish.yml skipped (${reason})`
       };
     }
     deployNote = dispatch.note;
@@ -16847,8 +16908,8 @@ function vaultPointer(slug) {
     slug,
     root,
     tiers: {
-      project: `${root}/${PROJECT_TIER_SEGMENT}/*  (project-admin self-serve)`,
-      org: [`${root}/rc/*`, `${root}/main/*`].map((p) => `${p}  (master-gated)`)
+      project: `${root}/{dev,rc,main}/*  (project-admin self-serve for this repo)`,
+      org: [`/mmi-future/{shared,cloudflare,mmi-hub,...}/*  (org-infra, master-gated)`]
     },
     stages: ["dev", "rc", "main"],
     // Google OAuth is one client per repo; creds live at every stage under the standard key names
@@ -16861,15 +16922,16 @@ function vaultPointer(slug) {
 function formatVaultPointer(p) {
   const lines = [
     `vault root: ${p.root}`,
-    `  project tier (self-serve): ${p.tiers.project}`,
-    `  org tier (master-gated):   ${p.tiers.org.join("  \xB7  ")}`,
+    `  project repo tree: ${p.tiers.project}`,
+    `  org-infra tree:    ${p.tiers.org.join("  \xB7  ")}`,
     `stages: ${p.stages.join(", ")}  (local is port-agnostic, reuses dev)`,
     `well-known keys:`,
     ...Object.entries(p.wellKnown).map(([k, keys]) => `  ${k}: ${keys.join(", ")}`),
     ``,
     `enumerate actual keys:  mmi-cli secrets list`,
     `read one:               mmi-cli secrets get <stage>/<KEY>   (e.g. main/GOOGLE_CLIENT_ID)`,
-    `set a project-tier key: mmi-cli secrets set <KEY>           (value via stdin; org tier needs a master grant)`,
+    `set a key:              mmi-cli secrets set <stage>/<KEY>   (value via stdin; project-admin self-serves own repo)`,
+    `import Rails creds:     mmi-cli secrets import-rails-credentials --stage main --map secret_key_base=SECRET_KEY_BASE`,
     `copy provider keys:     mmi-cli secrets copy --from rc --to dev --keys RECALL_API_KEY,GEMINI_API_KEY`
   ];
   return lines.join("\n");
@@ -17222,6 +17284,89 @@ async function secretsSet(deps, key, opts) {
   }
   return putSecret(deps, key, value, opts);
 }
+function parseRailsCredentialMapping(raw, stage2) {
+  const eq = raw.indexOf("=");
+  if (eq <= 0 || eq === raw.length - 1) return null;
+  const credentialPath = raw.slice(0, eq).trim();
+  const envKey = raw.slice(eq + 1).trim();
+  const vaultKey = stageKey2(stage2, envKey);
+  if (!credentialPath || !envKey || !isValidSecretKey(vaultKey)) return null;
+  return { credentialPath, envKey, vaultKey };
+}
+function credentialValueAt(root, path2) {
+  let cur = root;
+  for (const part of path2.split(".").filter(Boolean)) {
+    if (!cur || typeof cur !== "object" || !(part in cur)) return void 0;
+    cur = cur[part];
+  }
+  return cur;
+}
+function credentialValueToSecret(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value === "string") return value || null;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return JSON.stringify(value);
+}
+async function secretsImportRailsCredentials(deps, opts) {
+  const mappings = opts.mappings.map((m) => parseRailsCredentialMapping(m, opts.stage));
+  const bad = mappings.findIndex((m) => !m);
+  if (bad !== -1) {
+    deps.err(`invalid Rails credential mapping ${JSON.stringify(opts.mappings[bad])}; use credential.path=ENV_KEY`);
+    return false;
+  }
+  const parsed = mappings;
+  if (!parsed.length) {
+    deps.err("secrets import-rails-credentials: at least one --map credential.path=ENV_KEY is required");
+    return false;
+  }
+  if (opts.removeFiles && !deps.removeFile) {
+    deps.err("secrets import-rails-credentials: --remove-files is unavailable in this execution context");
+    return false;
+  }
+  let credentials;
+  try {
+    credentials = await deps.decryptRailsCredentials({
+      appDir: opts.appDir,
+      credentialsFile: opts.credentialsFile,
+      masterKeyFile: opts.masterKeyFile
+    });
+  } catch (e) {
+    deps.err(`secrets import-rails-credentials: could not decrypt Rails credentials: ${e.message}`);
+    return false;
+  }
+  const imports = [];
+  for (const mapping of parsed) {
+    const value = credentialValueToSecret(credentialValueAt(credentials, mapping.credentialPath));
+    if (!value) {
+      deps.err(`credential path ${mapping.credentialPath} not found or empty; nothing written`);
+      return false;
+    }
+    imports.push({ ...mapping, value });
+  }
+  if (opts.dryRun) {
+    for (const item of imports) deps.log(`would import ${item.credentialPath} -> ${item.vaultKey}`);
+    deps.log(`${imports.length} Rails credential mapping(s) checked; no values printed and nothing written`);
+    return true;
+  }
+  let written = 0;
+  for (const item of imports) {
+    const ok = await putSecret(deps, item.vaultKey, item.value, opts);
+    if (!ok) {
+      deps.err(
+        `Rails credentials import stopped after a partial write (${written}/${imports.length}); local encrypted files left untouched`
+      );
+      return false;
+    }
+    written += 1;
+    deps.log(`imported ${item.credentialPath} -> ${item.vaultKey}`);
+  }
+  if (opts.removeFiles) {
+    const files = [...new Set([opts.credentialsFile, opts.masterKeyFile].filter((p) => Boolean(p)))];
+    for (const file of files) await deps.removeFile(file);
+    if (files.length) deps.log(`removed ${files.length} local Rails encrypted credential file(s) after successful import`);
+  }
+  return true;
+}
 async function secretsEdit(deps, key, opts) {
   return secretsSet(deps, key, opts);
 }
@@ -17332,12 +17477,52 @@ async function secretsUse(deps, key, opts) {
       `  \u2022 Runtime / agents: read it keylessly at runtime via the box's OIDC role (it can read its own ${tier} tier). Never bake it into an image or commit it.`,
       `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
       "  \u2022 Local dev: pull it into a gitignored .env from the vault. To confirm access without printing in PowerShell: `$null = mmi-cli secrets get " + key + "`; in POSIX shells: `mmi-cli secrets get " + key + " >/dev/null`. Never paste it into tracked files or chat.",
-      tier === "project" ? "  \u2022 If this dev secret graduates to a real prod credential, ask the master to promote it to the org tier (rc/ or main/)." : "  \u2022 This is an ORG-tier secret \u2014 master-gated. If you need standing access, ask the master for a `secrets grant`."
+      tier === "project" ? "  \u2022 Bare keys default to dev/. Use an explicit rc/<KEY> or main/<KEY> when the stage needs its own value." : "  \u2022 For your own product repo, project-admins self-serve this stage key. Org-infra/cross-slug keys remain master-gated."
     ].join("\n")
   );
 }
 
 // src/secrets-commands.ts
+var import_node_fs22 = require("node:fs");
+var import_node_path20 = require("node:path");
+var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
+var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
+var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
+function collectMap(value, previous = []) {
+  return [...previous, value];
+}
+async function decryptRailsCredentials(input) {
+  const appDir = (0, import_node_path20.resolve)(input.appDir ?? process.cwd());
+  const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
+  const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
+  const credentialsPath = (0, import_node_path20.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path20.resolve)(appDir, masterKeyFile);
+  const env = {
+    ...process.env,
+    MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
+    MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
+  };
+  if ((0, import_node_fs22.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs22.readFileSync)(masterKeyPath, "utf8").trim();
+  }
+  const script = [
+    'require "json"',
+    'require "active_support/encrypted_configuration"',
+    'config_path = ENV.fetch("MMI_RAILS_CREDENTIALS_FILE")',
+    'key_path = ENV.fetch("MMI_RAILS_MASTER_KEY_FILE")',
+    'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
+    "puts JSON.generate(config.config)"
+  ].join("; ");
+  const args = ["exec", "ruby", "-e", script];
+  const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
+  const cmdArgs = process.platform === "win32" ? ["/c", "bundle", ...args] : args;
+  const { stdout } = await execFileP2(cmd, cmdArgs, {
+    cwd: appDir,
+    env,
+    timeout: RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS
+  });
+  return JSON.parse(stdout);
+}
 async function readSecretStdin() {
   if (process.stdin.isTTY) {
     process.stderr.write(
@@ -17432,6 +17617,32 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("import-rails-credentials").description("decrypt Rails credentials and import explicit mappings into the vault (values never printed)").requiredOption("--stage <dev|rc|main>", "target vault stage").option("--map <credential.path=ENV_KEY>", "explicit credential-to-env mapping; repeat for each key", collectMap, []).option("--app-dir <path>", "Rails app directory (defaults to cwd)").option("--credentials-file <path>", `encrypted credentials path relative to --app-dir (default: ${DEFAULT_RAILS_CREDENTIALS_FILE})`).option("--master-key-file <path>", `master key path relative to --app-dir (default: ${DEFAULT_RAILS_MASTER_KEY_FILE})`).option("--dry-run", "decrypt and show mapped key names without writing values").option("--remove-files", "delete credentials/master key files after every mapped value imports successfully").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
+    const stages = ["dev", "rc", "main"];
+    if (!stages.includes(o.stage)) {
+      return fail("secrets import-rails-credentials: --stage must be dev, rc, or main");
+    }
+    const credentialsFile = o.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
+    const masterKeyFile = o.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
+    const ok = await secretsImportRailsCredentials(
+      {
+        ...d,
+        decryptRailsCredentials,
+        removeFile: (path2) => (0, import_node_fs22.unlinkSync)((0, import_node_path20.resolve)(o.appDir ?? process.cwd(), path2))
+      },
+      {
+        repo: o.repo,
+        stage: o.stage,
+        mappings: o.map,
+        appDir: o.appDir,
+        credentialsFile,
+        masterKeyFile,
+        dryRun: o.dryRun,
+        removeFiles: o.removeFiles
+      }
+    );
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("rm <key>").description("remove a secret (project tier self-serve; org tier needs a grant)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
   secrets.command("use <key>").description("print guidance on consuming a secret without committing it (no value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsUse(d, key, o)));
   secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to a specific org-tier secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
@@ -17593,16 +17804,33 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/doctor-run.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var import_node_os5 = require("node:os");
 
+// src/plugin-guard.ts
+function buildPluginGuardDecision(i) {
+  if (!i.isOrgRepo) return { state: "not-org" };
+  if (!i.installRecordPresent) return { state: "no-install" };
+  if (!i.marketplaceClonePresent || !i.pluginCachePresent) return { state: "unresolved" };
+  return { state: "healthy" };
+}
+function buildGuardSessionStartLine(state, opts = {}) {
+  if (state === "healthy" || state === "not-org") return { exitCode: 0 };
+  const recovery = opts.recovery ?? "mmi-cli plugin-heal";
+  const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its marketplace/cache is unresolved";
+  return {
+    line: `[mmi-guard] ${reason}; run ${recovery} and restart Claude Code / reload plugins.`,
+    exitCode: 1
+  };
+}
+
 // src/cursor-plugin-seed.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var import_node_os4 = require("node:os");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 var import_node_util7 = require("node:util");
 function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
@@ -17619,17 +17847,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path20.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path20.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base = process.env.APPDATA || (0, import_node_path21.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path21.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path20.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path21.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path20.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path21.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs22.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs23.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -17643,57 +17871,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs22.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs22.readdirSync)(dest)) {
-    (0, import_node_fs22.rmSync)((0, import_node_path20.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs23.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs23.readdirSync)(dest)) {
+    (0, import_node_fs23.rmSync)((0, import_node_path21.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs22.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs23.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path20.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path21.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path20.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs22.existsSync)((0, import_node_path20.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path21.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs23.existsSync)((0, import_node_path21.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path20.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path21.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs22.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs23.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs22.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs23.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs22.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs23.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path20.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs22.existsSync)((0, import_node_path20.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path21.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs23.existsSync)((0, import_node_path21.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs22.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs23.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path20.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path21.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -17714,7 +17942,7 @@ async function applyCursorPluginCacheSeed(input) {
   for (const pin of pinsToSeed) {
     syncDirContents(source, pin.path);
   }
-  (0, import_node_fs22.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs23.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
 
@@ -17789,20 +18017,6 @@ function pluginInstallManualFix(projectPath, surface = "claude-cli") {
   const register = surface === "codex" ? `\`codex plugin add ${MMI_PLUGIN_ID}\`` : surface === "cursor" ? `import the MMI Team Marketplace in Cursor Dashboard \u2192 Settings \u2192 Plugins (or enable the MMI plugin from the marketplace panel)` : surface === "shell" ? `enable the MMI plugin in your client` : surface === "claude-vscode" ? `\`claude plugin enable ${MMI_PLUGIN_ID}\`` : `\`/plugin install ${MMI_PLUGIN_ID}\``;
   return `run ${register} then ${reloadAction(surface)} to register the install record for ${projectPath}`;
 }
-function isMmiPluginEnabled(settings) {
-  return Boolean(settings?.enabledPlugins?.[MMI_PLUGIN_ID]);
-}
-function buildSettingsPluginDriftCheck(input) {
-  const base = {
-    ok: true,
-    label: "org plugin wiring in .claude/settings.json (mmi@mutmutco)",
-    fix: "the Claude Code app pruned mmi@mutmutco from the tracked .claude/settings.json (it does this at session start when the mutmutco marketplace source does not resolve, #1805); restore it with `git checkout -- .claude/settings.json` before committing, or the whole org skill set is disabled for the branch"
-  };
-  const enabled = input.settings?.enabledPlugins;
-  if (!input.isOrgRepo || !enabled || Object.keys(enabled).length === 0) return base;
-  if (!enabled[MMI_PLUGIN_ID]) return { ...base, ok: false };
-  return base;
-}
 function hasProjectInstallRecord(file, pluginId, projectPath) {
   const records = file?.plugins?.[pluginId];
   if (!Array.isArray(records)) return false;
@@ -17825,7 +18039,7 @@ function buildPluginInstallRecordCheck(input) {
     fix: pluginInstallManualFix(input.projectPath, input.surface),
     pluginId
   };
-  if (!input.isOrgRepo || !isMmiPluginEnabled(input.settings)) return base;
+  if (!input.isOrgRepo) return base;
   if (hasAnyPluginRecords(input.installed, LEGACY_MMI_PLUGIN_ID) && !hasAnyPluginRecords(input.installed, pluginId)) {
     return {
       ...base,
@@ -18086,8 +18300,9 @@ function reloadAction(surface) {
       return "restart Claude Code (or run /reload-plugins)";
   }
 }
-var CLAUDE_RECOVERY = `claude plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && claude plugin marketplace remove mutmutco && claude plugin marketplace add mutmutco/MMI-Hub && claude plugin install mmi@mutmutco`;
+var CLAUDE_RECOVERY = `claude plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && claude plugin marketplace remove mutmutco && claude plugin marketplace add mutmutco/MMI-Hub --ref main && claude plugin install mmi@mutmutco`;
 var CODEX_RECOVERY = `codex plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && codex plugin marketplace remove mutmutco && codex plugin marketplace add mutmutco/MMI-Hub --ref main && codex plugin add mmi@mutmutco`;
+var CURSOR_RECOVERY = "in Cursor Dashboard \u2192 Settings \u2192 Plugins, click Update next to the MMI Team Marketplace";
 var OPENCODE_PLUGIN_PACKAGE = "@mutmutco/opencode-mmi";
 var OPENCODE_PLUGIN_SPEC = `${OPENCODE_PLUGIN_PACKAGE}@latest`;
 var OPENCODE_PLUGIN_INSTALL_COMMAND = `mmi-cli doctor --apply`;
@@ -18136,7 +18351,10 @@ var PLUGIN_SURFACE_HEAL = {
     healSteps: [
       { args: ["plugin", "marketplace", "remove", LEGACY_MMI_MARKETPLACE], gated: false },
       { args: ["plugin", "marketplace", "remove", "mutmutco"], gated: false },
-      { args: ["plugin", "marketplace", "add", "mutmutco/MMI-Hub"], gated: true },
+      // Pin --ref main: the marketplace clone must track `main` (the released branch the plugin pins in
+      // .claude-plugin/marketplace.json source.ref), removing the dev-vs-main skew that triggers the prune
+      // and doubles fetch exposure. Mirrors the existing codex entry (#2038).
+      { args: ["plugin", "marketplace", "add", "mutmutco/MMI-Hub", "--ref", "main"], gated: true },
       { args: ["plugin", "install", "mmi@mutmutco"], gated: true },
       { args: ["plugin", "enable", "mmi@mutmutco"], gated: false }
     ],
@@ -18159,10 +18377,10 @@ var PLUGIN_SURFACE_HEAL = {
   },
   cursor: {
     delivery: "cursor-cache",
-    recovery: "in Cursor Dashboard \u2192 Settings \u2192 Plugins, click Update next to the MMI Team Marketplace",
+    recovery: CURSOR_RECOVERY,
     healSteps: null,
-    fix: (surface) => `in Cursor Dashboard \u2192 Settings \u2192 Plugins, click Update next to the MMI Team Marketplace; then ${reloadAction(surface)} to reload MMI skills + hooks`,
-    updateRecipe: []
+    fix: (surface) => `${CURSOR_RECOVERY}; then ${reloadAction(surface)} to reload MMI skills + hooks`,
+    updateRecipe: [CURSOR_RECOVERY]
   },
   opencode: {
     delivery: "npm",
@@ -18203,9 +18421,21 @@ function surfaceToken(surface) {
 var PLUGIN_UPDATE_RECIPES = {
   claude: PLUGIN_SURFACE_HEAL.claude.updateRecipe,
   codex: PLUGIN_SURFACE_HEAL.codex.updateRecipe,
+  cursor: PLUGIN_SURFACE_HEAL.cursor.updateRecipe,
   opencode: PLUGIN_SURFACE_HEAL.opencode.updateRecipe,
   cli: ["npm install -g @mutmutco/cli@latest"]
 };
+var PLUGIN_GUIDE_SURFACES = [
+  { key: "cli", label: "npm CLI", versionKeys: ["cli"] },
+  { key: "claude", label: "Claude Code", versionKeys: ["claudePlugin"] },
+  { key: "codex", label: "Codex", versionKeys: ["codexMarketplace", "codexActiveCache"] },
+  { key: "cursor", label: "Cursor", versionKeys: [] },
+  { key: "opencode", label: "OpenCode", versionKeys: ["opencodePlugin"] }
+];
+function renderSurfaceGuide(label, steps) {
+  if (!steps.length) return [];
+  return [`  ${label}`, ...steps.map((step) => `    ${step}`)];
+}
 function highestSemver(versions) {
   return versions.reduce((best, v) => {
     if (!isSemverVersion2(v)) return best;
@@ -18233,20 +18463,24 @@ function buildPluginUpdateReport(input) {
 function renderPluginUpdateReport(report) {
   const v = report.versions;
   const show = (x) => x ?? "unknown";
-  return [
-    "MMI versions:",
-    `  CLI:                  ${show(v.cli)}`,
-    `  Claude plugin:        ${show(v.claudePlugin)}`,
-    `  Codex marketplace:    ${show(v.codexMarketplace)}`,
-    `  Codex active cache:   ${show(v.codexActiveCache)}`,
-    `  OpenCode plugin:      ${show(v.opencodePlugin)}`,
-    `  latest release:       ${show(v.released)}`,
-    "Update recipes (per surface):",
-    `  Claude:   ${report.recipes.claude.join(" ; ")}`,
-    `  Codex:    ${report.recipes.codex.join(" ; ")}`,
-    `  OpenCode: ${report.recipes.opencode.join(" ; ")}`,
-    `  npm CLI:  ${report.recipes.cli.join(" ; ")}`
+  const versionRows = [
+    ["mmi-cli", show(v.cli)],
+    ["Claude plugin", show(v.claudePlugin)],
+    ["Codex marketplace", show(v.codexMarketplace)],
+    ["Codex active cache", show(v.codexActiveCache)],
+    ["OpenCode plugin", show(v.opencodePlugin)]
   ];
+  const pad = Math.max(...versionRows.map(([label]) => label.length));
+  const lines = [
+    `MMI versions  (target release: ${show(v.released)})`,
+    ...versionRows.map(([label, value]) => `  ${label.padEnd(pad)}  ${value}`),
+    "",
+    "Update commands by surface"
+  ];
+  for (const surface of PLUGIN_GUIDE_SURFACES) {
+    lines.push(...renderSurfaceGuide(surface.label, report.recipes[surface.key]));
+  }
+  return lines;
 }
 function buildDoctorJsonPayload(input) {
   return {
@@ -18757,18 +18991,21 @@ function renderPluginUpdateReportStaleOnly(report) {
   const released = v.released;
   if (!released) return [];
   const isStale = (current) => Boolean(current && isSemverVersion2(current) && compareVersions(current, released) < 0);
-  const recipeLines = [];
-  if (isStale(v.cli)) recipeLines.push(`  npm CLI:  ${report.recipes.cli.join(" ; ")}`);
-  if (isStale(v.claudePlugin)) recipeLines.push(`  Claude:   ${report.recipes.claude.join(" ; ")}`);
-  if (isStale(v.codexMarketplace) || isStale(v.codexActiveCache)) {
-    recipeLines.push(`  Codex:    ${report.recipes.codex.join(" ; ")}`);
+  const blocks = [];
+  for (const surface of PLUGIN_GUIDE_SURFACES) {
+    if (!surface.versionKeys.some((k) => isStale(v[k]))) continue;
+    blocks.push(...renderSurfaceGuide(surface.label, report.recipes[surface.key]));
   }
-  if (isStale(v.opencodePlugin)) recipeLines.push(`  OpenCode: ${report.recipes.opencode.join(" ; ")}`);
-  if (!recipeLines.length) return [];
-  return ["Update recipes (stale surfaces):", ...recipeLines];
+  if (!blocks.length) return [];
+  return ["Update commands (stale surfaces):", ...blocks];
 }
+var DOCTOR_VERBOSE_HINT = "Run mmi-cli doctor --verbose for the full audit checklist + version report.";
 function renderTerseDoctorReport(input) {
-  if (!input.gaps.length) return [];
+  const cliVersion = input.updateReport.versions.cli;
+  const versionSuffix = cliVersion ? ` (mmi-cli ${cliVersion})` : "";
+  if (!input.gaps.length) {
+    return [`\u2713 MMI doctor: all checks passed${versionSuffix}.`, DOCTOR_VERBOSE_HINT];
+  }
   const lines = [];
   for (const c of input.gaps) {
     lines.push(`\u2717 ${c.label}`);
@@ -18779,20 +19016,51 @@ function renderTerseDoctorReport(input) {
     lines.push("");
     lines.push(...stale);
   }
+  lines.push("");
+  lines.push(`\u26A0 ${input.gaps.length} item(s) need attention \u2014 ${DOCTOR_VERBOSE_HINT}`);
   return lines;
 }
+var PLUGIN_RESOLVABILITY_LABEL = "MMI plugin resolvability (marketplace + cache present)";
+function buildPluginResolvabilityCheck(input) {
+  const { state } = buildPluginGuardDecision(input);
+  const surface = input.surface ?? "shell";
+  switch (state) {
+    case "not-org":
+      return { ok: true, label: PLUGIN_RESOLVABILITY_LABEL, fix: "", state };
+    case "healthy":
+      return { ok: true, label: PLUGIN_RESOLVABILITY_LABEL, fix: "", state };
+    case "no-install":
+      return {
+        ok: false,
+        label: PLUGIN_RESOLVABILITY_LABEL,
+        fix: `run: ${PLUGIN_SURFACE_HEAL[surfaceToken(surface) ?? "claude"]?.recovery ?? PLUGIN_SURFACE_HEAL.claude.recovery}`,
+        state
+      };
+    case "unresolved":
+      return {
+        ok: false,
+        label: PLUGIN_RESOLVABILITY_LABEL,
+        fix: "run: mmi-cli plugin-heal",
+        state
+      };
+    default: {
+      const _exhaustive = state;
+      return _exhaustive;
+    }
+  }
+}
 
 // src/kb-drift-report.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
 function yesterdayIso() {
   const d = /* @__PURE__ */ new Date();
   d.setUTCDate(d.getUTCDate() - 1);
   return d.toISOString().slice(0, 10);
 }
 async function fetchLatestKbDriftReport(execFileP5, repoRoot) {
-  const sagaIo = (0, import_node_path21.join)(repoRoot, "infra", "saga-io.mjs");
-  if (!(0, import_node_fs23.existsSync)(sagaIo)) return null;
+  const sagaIo = (0, import_node_path22.join)(repoRoot, "infra", "saga-io.mjs");
+  if (!(0, import_node_fs24.existsSync)(sagaIo)) return null;
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   for (const date of [today, yesterdayIso()]) {
     try {
@@ -18808,9 +19076,9 @@ async function fetchLatestKbDriftReport(execFileP5, repoRoot) {
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
 var import_node_fs25 = require("node:fs");
+var import_node_path23 = require("node:path");
+var import_node_fs26 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -18856,7 +19124,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path22.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path23.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -18876,18 +19144,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path22.isAbsolute)(raw) ? raw : (0, import_node_path22.resolve)(worktreePath, raw);
+  return (0, import_node_path23.isAbsolute)(raw) ? raw : (0, import_node_path23.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs25.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs26.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs24.readFileSync)((0, import_node_path22.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path22.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path22.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path22.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs25.readFileSync)((0, import_node_path23.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path23.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path23.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path23.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -18897,7 +19165,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs25.statSync)(path2);
+    (0, import_node_fs26.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -18906,10 +19174,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path22.join)(path2, ".git");
+  const gitPath = (0, import_node_path23.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs25.lstatSync)(gitPath);
+    st = (0, import_node_fs26.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -18926,7 +19194,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs24.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs25.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -18943,7 +19211,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs25.readdirSync)(path2) };
+    return { entries: (0, import_node_fs26.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -18962,8 +19230,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs25.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path22.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs26.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path23.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -19013,7 +19281,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path23.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -19149,20 +19417,30 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
-function readInstalledPlugins() {
+function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)(installedPluginsPath(), "utf8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
 }
+function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
+  const homeDir = surface === "codex" ? ".codex" : ".claude";
+  const installed = readInstalledPlugins(surface);
+  return {
+    isOrgRepo,
+    installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
+    marketplaceClonePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
+    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+  };
+}
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path23.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path24.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs26.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs27.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -19170,7 +19448,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path23.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -19192,7 +19470,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs26.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs27.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19205,9 +19483,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs26.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs26.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19215,22 +19493,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".config", "opencode");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path23.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path24.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path23.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path24.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path23.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path24.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs26.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs27.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs26.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs27.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -19253,9 +19531,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan2 = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan2.action === "already") return true;
     if (!plan2.text || plan2.action === "unsafe") return false;
-    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs26.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs26.writeFileSync)(path2, plan2.text, "utf8");
+    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs27.writeFileSync)(path2, plan2.text, "utf8");
     return true;
   } catch {
     return false;
@@ -19270,9 +19548,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs26.existsSync)(snapshot.path)) (0, import_node_fs26.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs26.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs27.existsSync)(snapshot.path)) (0, import_node_fs27.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs27.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19281,7 +19559,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs26.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs27.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -19289,9 +19567,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs27.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs26.writeFileSync)((0, import_node_path23.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs27.writeFileSync)((0, import_node_path24.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -19300,12 +19578,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path23.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path24.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -19321,7 +19599,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs26.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs27.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -19336,30 +19614,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path23.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path23.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path24.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path24.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path23.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path24.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path23.join)(root, entry.name)).sort((a, b) => (0, import_node_fs26.statSync)(b).mtimeMs - (0, import_node_fs26.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path24.join)(root, entry.name)).sort((a, b) => (0, import_node_fs27.statSync)(b).mtimeMs - (0, import_node_fs27.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path23.join)(newest, "renderer.log");
-    const text = (0, import_node_fs26.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs26.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path24.join)(newest, "renderer.log");
+    const text = (0, import_node_fs27.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs27.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs26.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs27.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -19371,43 +19649,43 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs26.existsSync)(backupPath)) return false;
-    (0, import_node_fs26.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs27.existsSync)(backupPath)) return false;
+    (0, import_node_fs27.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path23.join)(root, entry.name);
-      const pluginJson = (0, import_node_path23.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path23.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path23.join)(path2, "cli", "dist", "index.cjs");
+    return (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path24.join)(root, entry.name);
+      const pluginJson = (0, import_node_path24.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path24.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path24.join)(path2, "cli", "dist", "index.cjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs26.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs27.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs26.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs27.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs26.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs26.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs26.existsSync)(cliBundle),
+        hasPluginJson: (0, import_node_fs27.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs27.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs27.existsSync)(cliBundle),
         isEmpty,
         version
       };
@@ -19417,19 +19695,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path23.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs26.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path24.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs27.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path23.join)(root, entry.name),
+        path: (0, import_node_path24.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -19440,7 +19718,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs26.statSync)((0, import_node_path23.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs27.statSync)((0, import_node_path24.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -19451,10 +19729,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs26.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs27.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs26.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs27.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -19463,10 +19741,10 @@ function quarantinePluginCacheDirs(plan2) {
   const failed = [];
   for (const move of plan2) {
     try {
-      if (!(0, import_node_fs26.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs27.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(target), { recursive: true });
-      (0, import_node_fs26.renameSync)(move.from, target);
+      (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(target), { recursive: true });
+      (0, import_node_fs27.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -19485,23 +19763,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs26.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs27.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path23.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs26.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path24.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs27.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs26.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs27.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs26.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs27.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs26.existsSync)(targetPath);
+      return !(0, import_node_fs27.existsSync)(targetPath);
     }
-    (0, import_node_fs26.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs26.existsSync)(targetPath);
+    (0, import_node_fs27.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs27.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -19514,11 +19792,11 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path23.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path24.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs26.existsSync)(path2)) return null;
-    return (0, import_node_fs26.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs27.existsSync)(path2)) return null;
+    return (0, import_node_fs27.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -19527,10 +19805,10 @@ function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
   const home = (0, import_node_os5.homedir)();
   const candidates = [
-    (0, import_node_path23.join)(cwd, ".mcp.json"),
-    (0, import_node_path23.join)(cwd, ".cursor", "mcp.json"),
-    (0, import_node_path23.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path23.join)(home, ".codex", "config.toml")
+    (0, import_node_path24.join)(cwd, ".mcp.json"),
+    (0, import_node_path24.join)(cwd, ".cursor", "mcp.json"),
+    (0, import_node_path24.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path24.join)(home, ".codex", "config.toml")
   ];
   const out = [];
   for (const path2 of candidates) {
@@ -19543,7 +19821,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs26.existsSync)((0, import_node_path23.join)(cwd, rel));
+      return (0, import_node_fs27.existsSync)((0, import_node_path24.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -19562,8 +19840,8 @@ function latestIso(values) {
   return best;
 }
 function latestNorthstarContinuityAt() {
-  const meta = parseMeta(readTextFile((0, import_node_path23.join)(process.cwd(), META_FILE)));
-  const queue = parseQueue(readTextFile((0, import_node_path23.join)(process.cwd(), QUEUE_FILE)));
+  const meta = parseMeta(readTextFile((0, import_node_path24.join)(process.cwd(), META_FILE)));
+  const queue = parseQueue(readTextFile((0, import_node_path24.join)(process.cwd(), QUEUE_FILE)));
   return latestIso([
     ...Object.values(meta).map((entry) => entry.syncedAt),
     ...queue.map((entry) => entry.queuedAt)
@@ -19577,14 +19855,14 @@ async function latestBranchWorkAt() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs26.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs27.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs26.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs27.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -19623,7 +19901,7 @@ async function runDoctor(opts, io = consoleIo) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs26.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs27.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
@@ -19658,7 +19936,7 @@ async function runDoctor(opts, io = consoleIo) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs26.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs27.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -19734,7 +20012,6 @@ async function runDoctor(opts, io = consoleIo) {
     }
   }
   checks.push(pluginCheck);
-  checks.push(buildSettingsPluginDriftCheck({ isOrgRepo: Boolean(cfg.sagaApiUrl), settings: claudeSettings }));
   let legacyPluginCheck = buildLegacyPluginInstallCheck({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     sources: installedPluginSources(),
@@ -19791,6 +20068,18 @@ async function runDoctor(opts, io = consoleIo) {
     }
   }
   checks.push(driftCheck);
+  checks.push(
+    buildPluginResolvabilityCheck({
+      ...snapshotPluginGuardInput(surface, Boolean(cfg.sagaApiUrl)),
+      surface
+    })
+  );
+  if (repairFull && Boolean(cfg.sagaApiUrl) && (surfaceToken(surface) === "claude" || surfaceToken(surface) === "codex")) {
+    const guardResult = ensureUserScopeGuardHook();
+    if (guardResult === "written") {
+      io.err(`  \u21BB installed user-scope MMI guard hook (${surface === "codex" ? "~/.codex" : "~/.claude"}/settings.json) \u2014 survives a plugin prune`);
+    }
+  }
   let installedVersionCheck = buildInstalledPluginVersionCheck({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     sources: installedPluginSources(),
@@ -19985,7 +20274,7 @@ async function runDoctor(opts, io = consoleIo) {
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
     cacheRoot: cursorCacheRoot,
-    cacheRootExists: (0, import_node_fs26.existsSync)(cursorCacheRoot),
+    cacheRootExists: (0, import_node_fs27.existsSync)(cursorCacheRoot),
     pins: cursorPins,
     hubCheckout: hubCheckoutForCursorSeed(),
     releasedVersion
@@ -19996,7 +20285,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path23.join)((0, import_node_os5.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path24.join)((0, import_node_os5.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -20005,7 +20294,7 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         surface,
         cacheRoot: cursorCacheRoot,
-        cacheRootExists: (0, import_node_fs26.existsSync)(cursorCacheRoot),
+        cacheRootExists: (0, import_node_fs27.existsSync)(cursorCacheRoot),
         pins: cursorPins,
         hubCheckout: hubCheckoutForCursorSeed(),
         releasedVersion
@@ -20175,6 +20464,79 @@ async function runDoctor(opts, io = consoleIo) {
   io.log(gaps.length ? `
 ${gaps.length} item(s) need attention.` : "\nAll set \u2014 you are ready.");
 }
+var USER_SCOPE_GUARD_MARKER = "mmi-guard:v1";
+var USER_SCOPE_GUARD_COMMAND = `mmi-cli guard --session-start || true # ${USER_SCOPE_GUARD_MARKER}`;
+function settingsHasGuardHook(settings) {
+  const groups = settings?.hooks?.SessionStart;
+  if (!Array.isArray(groups)) return false;
+  return groups.some(
+    (g) => Array.isArray(g?.hooks) && g.hooks.some((h) => typeof h?.command === "string" && h.command.includes(USER_SCOPE_GUARD_MARKER))
+  );
+}
+function mergeGuardHook(settings) {
+  const next = settings && typeof settings === "object" ? { ...settings } : {};
+  if (settingsHasGuardHook(next)) return next;
+  const hooks = { ...next.hooks ?? {} };
+  const sessionStart = Array.isArray(hooks.SessionStart) ? [...hooks.SessionStart] : [];
+  sessionStart.push({ hooks: [{ type: "command", command: USER_SCOPE_GUARD_COMMAND, timeout: 10 }] });
+  hooks.SessionStart = sessionStart;
+  next.hooks = hooks;
+  return next;
+}
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path24.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+function ensureUserScopeGuardHook(opts = {}) {
+  const path2 = opts.settingsPath ?? userScopeSettingsPath();
+  try {
+    let current = null;
+    if ((0, import_node_fs27.existsSync)(path2)) {
+      try {
+        current = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
+      } catch {
+        return "failed";
+      }
+    }
+    if (settingsHasGuardHook(current)) return "already";
+    const merged = mergeGuardHook(current);
+    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs27.existsSync)(path2)) (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+`, "utf8");
+    return "written";
+  } catch {
+    return "failed";
+  }
+}
+async function runGuard(opts = {}) {
+  void opts;
+  try {
+    const surface = detectSurface(process.env);
+    const cfg = await loadConfig();
+    const input = snapshotPluginGuardInput(surface, Boolean(cfg.sagaApiUrl));
+    const { state } = buildPluginGuardDecision(input);
+    const { line, exitCode } = buildGuardSessionStartLine(state);
+    if (line) console.error(line);
+    process.exitCode = exitCode;
+  } catch {
+    process.exitCode = 0;
+  }
+}
+async function runPluginHeal(surface = detectSurface(process.env)) {
+  const token = surface === "codex" ? "codex" : "claude";
+  const tableKey = surfaceToken(surface) ?? "claude";
+  const descriptor = PLUGIN_SURFACE_HEAL[tableKey];
+  if (!descriptor.healSteps) {
+    console.log(descriptor.recovery);
+    console.log(`Then: ${reloadAction(surface)}`);
+    return;
+  }
+  const healed = await applyPluginHeal(token, surface, console.log, { force: true });
+  if (healed) {
+    console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI commands`);
+  } else {
+    console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
+  ${descriptor.recovery}`);
+  }
+}
 
 // src/index.ts
 var GC_GH_TIMEOUT_MS2 = 2e4;
@@ -20267,7 +20629,7 @@ async function applyGcPlan(plan2, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs27.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20290,7 +20652,7 @@ async function applyGcPlan(plan2, remote) {
   for (const wt of plan2.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs27.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs28.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -20370,10 +20732,10 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs27.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs28.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs27.mkdirSync)(file.slice(0, slash), { recursive: true });
+      if (slash > 0) (0, import_node_fs28.mkdirSync)(file.slice(0, slash), { recursive: true });
       await (0, import_promises8.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
@@ -20387,13 +20749,13 @@ rules.command("sync").option("--quiet", "stay silent unless something changed or
   if (!await runRulesSync(opts)) process.exitCode = 1;
 });
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path24.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path25.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
   const plan2 = planManagedGitignore(current);
   const drift = [...plan2.added.map((l) => `+${l}`), ...plan2.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan2.changed) {
-      (0, import_node_fs27.writeFileSync)(path2, plan2.content, "utf8");
+      (0, import_node_fs28.writeFileSync)(path2, plan2.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -20420,7 +20782,7 @@ async function runDocsSync(opts, io = consoleIo) {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs27.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs28.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
       await (0, import_promises8.writeFile)(f, c, "utf8");
     }
@@ -20571,7 +20933,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const [bin, ...args] = command.split(" ");
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = (0, import_node_child_process13.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
@@ -20586,7 +20948,7 @@ function runWorktreeInstall(command, cwd, quiet) {
     });
     child.on("exit", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve5();
+      if (code === 0) resolve6();
       else reject(new Error(`${command} exited ${code} in ${cwd}`));
     });
   });
@@ -20594,7 +20956,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path24.dirname)(out) : void 0;
+    return out ? (0, import_node_path25.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -20607,28 +20969,28 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
   };
 }
 function acquireWorktreeSetupLock(worktreeRoot) {
-  const lockPath = (0, import_node_path24.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
+  const lockPath = (0, import_node_path25.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs27.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs28.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs27.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs28.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs27.closeSync)(fd);
+      (0, import_node_fs28.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs27.rmSync)(lockPath, { force: true });
+        (0, import_node_fs28.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs27.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs27.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs28.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs28.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -20637,18 +20999,21 @@ function acquireWorktreeSetupLock(worktreeRoot) {
   }
 }
 var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
-worktree.command("create <branch>").description("create a worktree from a base ref and provision it (install deps + copy local-only config)").option("--from <ref>", "base ref to branch from", "origin/development").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch>)").option("--remote <name>", "remote to fetch the base from", "origin").option("--json", "machine-readable output").action(async (branch, o) => {
+worktree.command("create <branch>").description("create a worktree from a base ref and provision it (install deps + copy local-only config)").option("--from <ref>", "base ref to branch from", "origin/development").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch>)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--json", "machine-readable output").action(async (branch, o) => {
   try {
     const repoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     const wtPath = o.path ?? defaultWorktreePath(repoRoot, branch);
-    const baseBranch = o.from.startsWith(`${o.remote}/`) ? o.from.slice(o.remote.length + 1) : void 0;
-    if (baseBranch) await execFileP2("git", ["fetch", o.remote, baseBranch], { timeout: GH_MUTATION_TIMEOUT_MS }).catch(() => void 0);
-    await execFileP2("git", ["worktree", "add", wtPath, "-b", branch, o.from], { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { base, fetchBranch } = resolveWorktreeBase(o.from, o.remote);
+    if (fetchBranch) {
+      const fetchErr = await execFileP2("git", ["fetch", o.remote, fetchBranch], { timeout: GH_MUTATION_TIMEOUT_MS }).then(() => void 0).catch((e) => (e instanceof Error ? e.message : String(e)).split("\n")[0]);
+      if (fetchErr) console.error(`  warning: could not fetch ${o.remote}/${fetchBranch} (${fetchErr}); base ${base} may be stale`);
+    }
+    await execFileP2("git", ["worktree", "add", wtPath, "-b", branch, base], { timeout: GH_MUTATION_TIMEOUT_MS });
     const report = await provisionWorktree(wtPath, makeProvisionDeps(wtPath, Boolean(o.json), (m) => {
       if (!o.json) console.error(`  ${m}`);
     }));
-    if (o.json) return console.log(JSON.stringify({ branch, path: wtPath, base: o.from, ...report }, null, 2));
-    console.log(`worktree ready: ${wtPath} (branch ${branch} from ${o.from})`);
+    if (o.json) return console.log(JSON.stringify({ branch, path: wtPath, base, ...report }, null, 2));
+    console.log(`worktree ready: ${wtPath} (branch ${branch} from ${base})`);
     console.log(`  installed: ${report.installed.map((i) => i.dir || ".").join(", ") || "none"}`);
     console.log(`  copied: ${report.copied.join(", ") || "none"}`);
   } catch (e) {
@@ -20873,8 +21238,8 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
 async function resolveDnsBounded(host, timeoutMs = 3e3) {
   const { lookup } = await import("node:dns/promises");
   const probe = lookup(host).then(() => true).catch((e) => dnsErrorToResolution(e?.code));
-  const timeout = new Promise((resolve5) => {
-    setTimeout(() => resolve5(void 0), timeoutMs).unref?.();
+  const timeout = new Promise((resolve6) => {
+    setTimeout(() => resolve6(void 0), timeoutMs).unref?.();
   });
   return Promise.race([probe, timeout]);
 }
@@ -21629,9 +21994,9 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   console.log(JSON.stringify(created));
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path24.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs27.existsSync)(wfDir)) return [];
-  return (0, import_node_fs27.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path25.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs28.existsSync)(wfDir)) return [];
+  return (0, import_node_fs28.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -21650,7 +22015,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -21680,7 +22045,7 @@ pr.command("checks-wait <number>").description("bounded wait for PR checks; skip
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
   });
   if (o.json) printLine(JSON.stringify(result));
   else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
@@ -21707,7 +22072,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
-      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
     }),
     mergeAuto: async (prNumber, repo) => {
       const args = repo ? ["--repo", repo] : [];
@@ -21743,7 +22108,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       while (Date.now() < deadlineMs) {
         const stateRead = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 })).stdout, { retries: 2, delayMs: 1e3 });
         if (stateRead.ok && stateRead.state === "MERGED") return true;
-        await new Promise((resolve5) => setTimeout(resolve5, PR_LAND_POLL_MS));
+        await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
       }
       return false;
     }
@@ -21803,7 +22168,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises8.mkdir)((0, import_node_path24.dirname)(registryPath), { recursive: true });
+          await (0, import_promises8.mkdir)((0, import_node_path25.dirname)(registryPath), { recursive: true });
           await (0, import_promises8.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -21817,13 +22182,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs27.lstatSync)(p);
+      st = (0, import_node_fs28.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs27.readlinkSync)(p);
+      (0, import_node_fs28.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -21831,7 +22196,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs27.readdirSync)(p);
+      return (0, import_node_fs28.readdirSync)(p);
     } catch {
       return [];
     }
@@ -21840,9 +22205,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs27.rmdirSync)(p);
+      (0, import_node_fs28.rmdirSync)(p);
     } catch {
-      (0, import_node_fs27.unlinkSync)(p);
+      (0, import_node_fs28.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -21857,7 +22222,7 @@ async function resolvePrimaryCheckout(execGit) {
 function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover)
   };
 }
@@ -21872,9 +22237,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs27.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs28.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs27.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs28.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -21947,7 +22312,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     } : await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs27.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -22144,7 +22509,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs27.writeSync)(1, `${value}
+  (0, import_node_fs28.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -22161,8 +22526,8 @@ async function resolveStage() {
     local,
     shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs27.existsSync)((0, import_node_path24.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs27.existsSync)((0, import_node_path24.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -22261,9 +22626,17 @@ async function runStageLiveCommand(o) {
     if (o.json) return console.log(JSON.stringify({ command: "stage --live", mode, slug: target.slug, repo: target.repo, ref: o.down ? void 0 : target.ref, steps }, null, 2));
     return console.log(renderSteps(`mmi-cli stage --live${o.down ? " --down" : ""}: dry-run plan`, steps));
   }
+  const rcDeps = registryClientDeps(await loadConfig());
   const deps = {
     detectIp: () => detectPublicIp(),
-    run: async (file, args) => (await execFileP2(file, args, { timeout: GH_MUTATION_TIMEOUT_MS })).stdout
+    deployDev: async ({ repo, ref }) => {
+      const res = await tenantDeploy({ repo, stage: "dev", ref }, rcDeps);
+      if (!res.ok) throw new Error(`dev deploy dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
+    },
+    control: async ({ repo, action, host, ip }) => {
+      const res = await tenantControl({ repo, stage: "dev", action, host, ip }, rcDeps);
+      if (!res.ok) throw new Error(`tenant control ${action} dispatch failed: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
+    }
   };
   try {
     const result = o.down ? await runStageLiveDown(deps, target) : await runStageLiveUp(deps, target);
@@ -22616,7 +22989,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -22660,12 +23033,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs27.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs27.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile7 = (p) => (0, import_node_fs27.existsSync)(p) ? (0, import_node_fs27.readFileSync)(p, "utf8") : null;
+  const readFile7 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -22916,16 +23289,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
     targets = [{ repo: o.repo, class: o.class }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs27.existsSync)("projects.json") ? (0, import_node_fs27.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs28.existsSync)("projects.json") ? (0, import_node_fs28.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs27.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs27.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs28.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs28.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs27.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs27.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs28.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs27.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs27.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs28.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs28.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -23012,6 +23385,8 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
   // Commander maps `--no-repo-writes` to `repoWrites: false`; translate to the explicit `noRepoWrites` flag.
   runDoctor({ ...opts, noRepoWrites: opts.repoWrites === false })
 ));
+program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk; loud one-line stderr at session start").option("--session-start", "run in user-scope SessionStart mode").action((opts) => runGuard({ sessionStart: opts.sessionStart }));
+program2.command("plugin-heal").description("reinstall + re-enable the MMI plugin (recover from a marketplace prune)").action(() => runPluginHeal());
 program2.command("session-start").description("run the SessionStart verbs (rules sync, saga session+show, saga health, whoami, doctor, plan-store check) in one process; docs sync runs detached").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
     console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");