@mutmutco/cli 2.53.0 → 2.54.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -3601,7 +3601,7 @@ async function sweepDeferredWorktreesWithRetry(store, deps, opts = {}) {
   }
   return last;
 }
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function removeWorktreeWithRecovery(wtPath, deps) {
   const maxAttempts = deps.maxAttempts ?? 3;
   const backoff = deps.backoffMs ?? [250, 1e3];
@@ -4609,7 +4609,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithSpineResolution(deps, sourceRef, label, resolve5, extraTolerated = []) {
+async function mergeWithSpineResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -4623,7 +4623,7 @@ async function mergeWithSpineResolution(deps, sourceRef, label, resolve5, extraT
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on non-spine path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve5}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -4740,7 +4740,7 @@ function requireProjectMetaForTrain(load, repo) {
 var CORRELATE_ATTEMPTS = 5;
 var CORRELATE_DELAY_MS = 1500;
 var CORRELATE_SKEW_SLACK_MS = 1e4;
-var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
@@ -4959,6 +4959,23 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
     `timed out waiting for required train checks on ${sha}: ${lastError ? `last error: ${lastError}` : lastStatus}`
   );
 }
+function partialTrainRecoveryError(cause, input) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  const branch = input.stage;
+  const releaseState = input.stage === "rc" ? "GitHub Release n/a" : "GitHub Release not created";
+  const releaseCommand = input.stage === "main" ? `
+  2. gh release create ${input.tag} --target main --generate-notes --latest --repo ${input.repo}` : "";
+  const deployStep = input.stage === "main" ? "3" : "2";
+  return new Error(
+    `${causeMessage}
+
+partial train state: tag ${input.tag} is already pushed; origin/${branch} has not been pushed; ${releaseState}; deploy not dispatched.
+Recovery sequence:
+  1. git push origin ${branch}` + releaseCommand + `
+  ${deployStep}. mmi-cli tenant redeploy ${input.repo} ${input.stage} --watch
+Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
+  );
+}
 async function ensureTagPushed(deps, tag, sha) {
   const remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]);
   const remoteSha = clean(remoteOut).split(/\s+/)[0] || "";
@@ -5167,7 +5184,12 @@ async function mergeSourceToMain(deps, deployModel, args) {
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
   await ensureTagPushed(deps, tag, releaseSha);
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
-  const checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+  let checks;
+  try {
+    checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+  } catch (e) {
+    throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
+  }
   await deps.run("git", ["push", "origin", "main"]);
   const releaseUrl = clean(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
@@ -5218,7 +5240,12 @@ async function runTrainApplyPipeline(mode, input) {
     const resumeNote = resume.tag ? resume.note : void 0;
     await ensureTagPushed(deps, tag2, rcSha);
     const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
-    const checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+    let checks2;
+    try {
+      checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+    } catch (e) {
+      throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
+    }
     const autoRunSince = (deps.now ?? Date.now)();
     await deps.run("git", ["push", "origin", "rc"]);
     const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
@@ -5654,7 +5681,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -5713,7 +5740,7 @@ function hardExit(code) {
 async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
-  await new Promise((resolve5) => setImmediate(resolve5));
+  await new Promise((resolve6) => setImmediate(resolve6));
   process.exit(code);
 }
 async function failGraceful(msg) {
@@ -6140,12 +6167,12 @@ function parseHeadUpdate(raw) {
 }
 async function runHeadEngine(prompt, timeoutMs = HEAD_ENGINE_TIMEOUT_MS) {
   const { cmd, args, shell: shell2 } = resolveEngine(process.platform, process.env.SAGA_HEAD_ENGINE);
-  return await new Promise((resolve5) => {
+  return await new Promise((resolve6) => {
     let child;
     try {
       child = (0, import_node_child_process3.spawn)(cmd, args, { shell: shell2, windowsHide: true });
     } catch {
-      return resolve5("");
+      return resolve6("");
     }
     let out = "";
     let done = false;
@@ -6153,7 +6180,7 @@ async function runHeadEngine(prompt, timeoutMs = HEAD_ENGINE_TIMEOUT_MS) {
       if (done) return;
       done = true;
       clearTimeout(timer);
-      resolve5(v);
+      resolve6(v);
     };
     const timer = setTimeout(() => {
       try {
@@ -6301,8 +6328,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve5) => {
-    timer = setTimeout(resolve5, timeoutMs);
+  const timeout = new Promise((resolve6) => {
+    timer = setTimeout(resolve6, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -6975,7 +7002,7 @@ var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process5.exe
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
 function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -6985,7 +7012,7 @@ function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
       child.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve5), graceMs);
+    const timer = setTimeout(() => finish(resolve6), graceMs);
     child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -7195,10 +7222,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve5(false));
-    srv.once("listening", () => srv.close(() => resolve5(true)));
+    srv.once("error", () => resolve6(false));
+    srv.once("listening", () => srv.close(() => resolve6(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -7409,7 +7436,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve5) => setTimeout(resolve5, 500));
+  await new Promise((resolve6) => setTimeout(resolve6, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -7430,7 +7457,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+    await new Promise((resolve6) => setTimeout(resolve6, 1e3));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -11400,7 +11427,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -12464,7 +12491,7 @@ var PR_LAND_STATE_READ_DELAY_MS = 2e3;
 async function readGhPrStateWithRetry(fetchState2, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -14207,7 +14234,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -16881,8 +16908,8 @@ function vaultPointer(slug) {
     slug,
     root,
     tiers: {
-      project: `${root}/${PROJECT_TIER_SEGMENT}/*  (project-admin self-serve)`,
-      org: [`${root}/rc/*`, `${root}/main/*`].map((p) => `${p}  (master-gated)`)
+      project: `${root}/{dev,rc,main}/*  (project-admin self-serve for this repo)`,
+      org: [`/mmi-future/{shared,cloudflare,mmi-hub,...}/*  (org-infra, master-gated)`]
     },
     stages: ["dev", "rc", "main"],
     // Google OAuth is one client per repo; creds live at every stage under the standard key names
@@ -16895,15 +16922,16 @@ function vaultPointer(slug) {
 function formatVaultPointer(p) {
   const lines = [
     `vault root: ${p.root}`,
-    `  project tier (self-serve): ${p.tiers.project}`,
-    `  org tier (master-gated):   ${p.tiers.org.join("  \xB7  ")}`,
+    `  project repo tree: ${p.tiers.project}`,
+    `  org-infra tree:    ${p.tiers.org.join("  \xB7  ")}`,
     `stages: ${p.stages.join(", ")}  (local is port-agnostic, reuses dev)`,
     `well-known keys:`,
     ...Object.entries(p.wellKnown).map(([k, keys]) => `  ${k}: ${keys.join(", ")}`),
     ``,
     `enumerate actual keys:  mmi-cli secrets list`,
     `read one:               mmi-cli secrets get <stage>/<KEY>   (e.g. main/GOOGLE_CLIENT_ID)`,
-    `set a project-tier key: mmi-cli secrets set <KEY>           (value via stdin; org tier needs a master grant)`,
+    `set a key:              mmi-cli secrets set <stage>/<KEY>   (value via stdin; project-admin self-serves own repo)`,
+    `import Rails creds:     mmi-cli secrets import-rails-credentials --stage main --map secret_key_base=SECRET_KEY_BASE`,
     `copy provider keys:     mmi-cli secrets copy --from rc --to dev --keys RECALL_API_KEY,GEMINI_API_KEY`
   ];
   return lines.join("\n");
@@ -17256,6 +17284,89 @@ async function secretsSet(deps, key, opts) {
   }
   return putSecret(deps, key, value, opts);
 }
+function parseRailsCredentialMapping(raw, stage2) {
+  const eq = raw.indexOf("=");
+  if (eq <= 0 || eq === raw.length - 1) return null;
+  const credentialPath = raw.slice(0, eq).trim();
+  const envKey = raw.slice(eq + 1).trim();
+  const vaultKey = stageKey2(stage2, envKey);
+  if (!credentialPath || !envKey || !isValidSecretKey(vaultKey)) return null;
+  return { credentialPath, envKey, vaultKey };
+}
+function credentialValueAt(root, path2) {
+  let cur = root;
+  for (const part of path2.split(".").filter(Boolean)) {
+    if (!cur || typeof cur !== "object" || !(part in cur)) return void 0;
+    cur = cur[part];
+  }
+  return cur;
+}
+function credentialValueToSecret(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value === "string") return value || null;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return JSON.stringify(value);
+}
+async function secretsImportRailsCredentials(deps, opts) {
+  const mappings = opts.mappings.map((m) => parseRailsCredentialMapping(m, opts.stage));
+  const bad = mappings.findIndex((m) => !m);
+  if (bad !== -1) {
+    deps.err(`invalid Rails credential mapping ${JSON.stringify(opts.mappings[bad])}; use credential.path=ENV_KEY`);
+    return false;
+  }
+  const parsed = mappings;
+  if (!parsed.length) {
+    deps.err("secrets import-rails-credentials: at least one --map credential.path=ENV_KEY is required");
+    return false;
+  }
+  if (opts.removeFiles && !deps.removeFile) {
+    deps.err("secrets import-rails-credentials: --remove-files is unavailable in this execution context");
+    return false;
+  }
+  let credentials;
+  try {
+    credentials = await deps.decryptRailsCredentials({
+      appDir: opts.appDir,
+      credentialsFile: opts.credentialsFile,
+      masterKeyFile: opts.masterKeyFile
+    });
+  } catch (e) {
+    deps.err(`secrets import-rails-credentials: could not decrypt Rails credentials: ${e.message}`);
+    return false;
+  }
+  const imports = [];
+  for (const mapping of parsed) {
+    const value = credentialValueToSecret(credentialValueAt(credentials, mapping.credentialPath));
+    if (!value) {
+      deps.err(`credential path ${mapping.credentialPath} not found or empty; nothing written`);
+      return false;
+    }
+    imports.push({ ...mapping, value });
+  }
+  if (opts.dryRun) {
+    for (const item of imports) deps.log(`would import ${item.credentialPath} -> ${item.vaultKey}`);
+    deps.log(`${imports.length} Rails credential mapping(s) checked; no values printed and nothing written`);
+    return true;
+  }
+  let written = 0;
+  for (const item of imports) {
+    const ok = await putSecret(deps, item.vaultKey, item.value, opts);
+    if (!ok) {
+      deps.err(
+        `Rails credentials import stopped after a partial write (${written}/${imports.length}); local encrypted files left untouched`
+      );
+      return false;
+    }
+    written += 1;
+    deps.log(`imported ${item.credentialPath} -> ${item.vaultKey}`);
+  }
+  if (opts.removeFiles) {
+    const files = [...new Set([opts.credentialsFile, opts.masterKeyFile].filter((p) => Boolean(p)))];
+    for (const file of files) await deps.removeFile(file);
+    if (files.length) deps.log(`removed ${files.length} local Rails encrypted credential file(s) after successful import`);
+  }
+  return true;
+}
 async function secretsEdit(deps, key, opts) {
   return secretsSet(deps, key, opts);
 }
@@ -17366,12 +17477,52 @@ async function secretsUse(deps, key, opts) {
       `  \u2022 Runtime / agents: read it keylessly at runtime via the box's OIDC role (it can read its own ${tier} tier). Never bake it into an image or commit it.`,
       `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
       "  \u2022 Local dev: pull it into a gitignored .env from the vault. To confirm access without printing in PowerShell: `$null = mmi-cli secrets get " + key + "`; in POSIX shells: `mmi-cli secrets get " + key + " >/dev/null`. Never paste it into tracked files or chat.",
-      tier === "project" ? "  \u2022 If this dev secret graduates to a real prod credential, ask the master to promote it to the org tier (rc/ or main/)." : "  \u2022 This is an ORG-tier secret \u2014 master-gated. If you need standing access, ask the master for a `secrets grant`."
+      tier === "project" ? "  \u2022 Bare keys default to dev/. Use an explicit rc/<KEY> or main/<KEY> when the stage needs its own value." : "  \u2022 For your own product repo, project-admins self-serve this stage key. Org-infra/cross-slug keys remain master-gated."
     ].join("\n")
   );
 }
 
 // src/secrets-commands.ts
+var import_node_fs22 = require("node:fs");
+var import_node_path20 = require("node:path");
+var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
+var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
+var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
+function collectMap(value, previous = []) {
+  return [...previous, value];
+}
+async function decryptRailsCredentials(input) {
+  const appDir = (0, import_node_path20.resolve)(input.appDir ?? process.cwd());
+  const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
+  const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
+  const credentialsPath = (0, import_node_path20.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path20.resolve)(appDir, masterKeyFile);
+  const env = {
+    ...process.env,
+    MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
+    MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
+  };
+  if ((0, import_node_fs22.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs22.readFileSync)(masterKeyPath, "utf8").trim();
+  }
+  const script = [
+    'require "json"',
+    'require "active_support/encrypted_configuration"',
+    'config_path = ENV.fetch("MMI_RAILS_CREDENTIALS_FILE")',
+    'key_path = ENV.fetch("MMI_RAILS_MASTER_KEY_FILE")',
+    'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
+    "puts JSON.generate(config.config)"
+  ].join("; ");
+  const args = ["exec", "ruby", "-e", script];
+  const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
+  const cmdArgs = process.platform === "win32" ? ["/c", "bundle", ...args] : args;
+  const { stdout } = await execFileP2(cmd, cmdArgs, {
+    cwd: appDir,
+    env,
+    timeout: RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS
+  });
+  return JSON.parse(stdout);
+}
 async function readSecretStdin() {
   if (process.stdin.isTTY) {
     process.stderr.write(
@@ -17466,6 +17617,32 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("import-rails-credentials").description("decrypt Rails credentials and import explicit mappings into the vault (values never printed)").requiredOption("--stage <dev|rc|main>", "target vault stage").option("--map <credential.path=ENV_KEY>", "explicit credential-to-env mapping; repeat for each key", collectMap, []).option("--app-dir <path>", "Rails app directory (defaults to cwd)").option("--credentials-file <path>", `encrypted credentials path relative to --app-dir (default: ${DEFAULT_RAILS_CREDENTIALS_FILE})`).option("--master-key-file <path>", `master key path relative to --app-dir (default: ${DEFAULT_RAILS_MASTER_KEY_FILE})`).option("--dry-run", "decrypt and show mapped key names without writing values").option("--remove-files", "delete credentials/master key files after every mapped value imports successfully").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
+    const stages = ["dev", "rc", "main"];
+    if (!stages.includes(o.stage)) {
+      return fail("secrets import-rails-credentials: --stage must be dev, rc, or main");
+    }
+    const credentialsFile = o.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
+    const masterKeyFile = o.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
+    const ok = await secretsImportRailsCredentials(
+      {
+        ...d,
+        decryptRailsCredentials,
+        removeFile: (path2) => (0, import_node_fs22.unlinkSync)((0, import_node_path20.resolve)(o.appDir ?? process.cwd(), path2))
+      },
+      {
+        repo: o.repo,
+        stage: o.stage,
+        mappings: o.map,
+        appDir: o.appDir,
+        credentialsFile,
+        masterKeyFile,
+        dryRun: o.dryRun,
+        removeFiles: o.removeFiles
+      }
+    );
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("rm <key>").description("remove a secret (project tier self-serve; org tier needs a grant)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
   secrets.command("use <key>").description("print guidance on consuming a secret without committing it (no value)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsUse(d, key, o)));
   secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to a specific org-tier secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
@@ -17627,9 +17804,9 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/doctor-run.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var import_node_os5 = require("node:os");
 
 // src/plugin-guard.ts
@@ -17651,9 +17828,9 @@ function buildGuardSessionStartLine(state, opts = {}) {
 
 // src/cursor-plugin-seed.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var import_node_os4 = require("node:os");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 var import_node_util7 = require("node:util");
 function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
@@ -17670,17 +17847,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path20.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path20.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base = process.env.APPDATA || (0, import_node_path21.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path21.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path20.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path21.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path20.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path21.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs22.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs23.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -17694,57 +17871,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs22.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs22.readdirSync)(dest)) {
-    (0, import_node_fs22.rmSync)((0, import_node_path20.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs23.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs23.readdirSync)(dest)) {
+    (0, import_node_fs23.rmSync)((0, import_node_path21.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs22.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs23.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path20.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path21.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path20.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs22.existsSync)((0, import_node_path20.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path21.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs23.existsSync)((0, import_node_path21.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path20.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path21.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs22.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs23.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs22.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs23.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs22.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs23.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path20.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs22.existsSync)((0, import_node_path20.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path21.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs23.existsSync)((0, import_node_path21.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs22.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs23.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path20.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path21.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -17765,7 +17942,7 @@ async function applyCursorPluginCacheSeed(input) {
   for (const pin of pinsToSeed) {
     syncDirContents(source, pin.path);
   }
-  (0, import_node_fs22.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs23.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
 
@@ -18874,16 +19051,16 @@ function buildPluginResolvabilityCheck(input) {
 }
 
 // src/kb-drift-report.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
 function yesterdayIso() {
   const d = /* @__PURE__ */ new Date();
   d.setUTCDate(d.getUTCDate() - 1);
   return d.toISOString().slice(0, 10);
 }
 async function fetchLatestKbDriftReport(execFileP5, repoRoot) {
-  const sagaIo = (0, import_node_path21.join)(repoRoot, "infra", "saga-io.mjs");
-  if (!(0, import_node_fs23.existsSync)(sagaIo)) return null;
+  const sagaIo = (0, import_node_path22.join)(repoRoot, "infra", "saga-io.mjs");
+  if (!(0, import_node_fs24.existsSync)(sagaIo)) return null;
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   for (const date of [today, yesterdayIso()]) {
     try {
@@ -18899,9 +19076,9 @@ async function fetchLatestKbDriftReport(execFileP5, repoRoot) {
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
 var import_node_fs25 = require("node:fs");
+var import_node_path23 = require("node:path");
+var import_node_fs26 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -18947,7 +19124,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path22.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path23.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -18967,18 +19144,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path22.isAbsolute)(raw) ? raw : (0, import_node_path22.resolve)(worktreePath, raw);
+  return (0, import_node_path23.isAbsolute)(raw) ? raw : (0, import_node_path23.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs25.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs26.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs24.readFileSync)((0, import_node_path22.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path22.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path22.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path22.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs25.readFileSync)((0, import_node_path23.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path23.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path23.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path23.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -18988,7 +19165,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs25.statSync)(path2);
+    (0, import_node_fs26.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -18997,10 +19174,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path22.join)(path2, ".git");
+  const gitPath = (0, import_node_path23.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs25.lstatSync)(gitPath);
+    st = (0, import_node_fs26.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -19017,7 +19194,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs24.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs25.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -19034,7 +19211,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs25.readdirSync)(path2) };
+    return { entries: (0, import_node_fs26.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -19053,8 +19230,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs25.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path22.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs26.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path23.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -19104,7 +19281,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path23.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -19240,11 +19417,11 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -19255,15 +19432,15 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: (0, import_node_fs26.existsSync)((0, import_node_path23.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
-    pluginCachePresent: (0, import_node_fs26.existsSync)((0, import_node_path23.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
+    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path23.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path24.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs26.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs27.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -19271,7 +19448,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs26.readFileSync)((0, import_node_path23.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -19293,7 +19470,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs26.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs27.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19306,9 +19483,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs26.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs26.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19316,22 +19493,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".config", "opencode");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path23.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path24.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path23.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path24.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path23.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path24.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs26.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs27.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs26.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs27.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -19354,9 +19531,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan2 = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan2.action === "already") return true;
     if (!plan2.text || plan2.action === "unsafe") return false;
-    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs26.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs26.writeFileSync)(path2, plan2.text, "utf8");
+    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs27.writeFileSync)(path2, plan2.text, "utf8");
     return true;
   } catch {
     return false;
@@ -19371,9 +19548,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs26.existsSync)(snapshot.path)) (0, import_node_fs26.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs26.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs27.existsSync)(snapshot.path)) (0, import_node_fs27.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs27.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19382,7 +19559,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs26.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs27.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -19390,9 +19567,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs27.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs26.writeFileSync)((0, import_node_path23.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs27.writeFileSync)((0, import_node_path24.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -19401,12 +19578,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path23.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path24.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -19422,7 +19599,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs26.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs27.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -19437,30 +19614,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path23.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path23.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path24.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path24.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path23.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path24.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path23.join)(root, entry.name)).sort((a, b) => (0, import_node_fs26.statSync)(b).mtimeMs - (0, import_node_fs26.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path24.join)(root, entry.name)).sort((a, b) => (0, import_node_fs27.statSync)(b).mtimeMs - (0, import_node_fs27.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path23.join)(newest, "renderer.log");
-    const text = (0, import_node_fs26.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs26.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path24.join)(newest, "renderer.log");
+    const text = (0, import_node_fs27.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs27.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs26.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs27.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -19472,43 +19649,43 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs26.existsSync)(backupPath)) return false;
-    (0, import_node_fs26.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs27.existsSync)(backupPath)) return false;
+    (0, import_node_fs27.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path23.join)(root, entry.name);
-      const pluginJson = (0, import_node_path23.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path23.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path23.join)(path2, "cli", "dist", "index.cjs");
+    return (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path24.join)(root, entry.name);
+      const pluginJson = (0, import_node_path24.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path24.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path24.join)(path2, "cli", "dist", "index.cjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs26.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs27.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs26.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs27.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs26.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs26.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs26.existsSync)(cliBundle),
+        hasPluginJson: (0, import_node_fs27.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs27.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs27.existsSync)(cliBundle),
         isEmpty,
         version
       };
@@ -19518,19 +19695,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path23.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs26.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path24.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs27.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path23.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs26.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path23.join)(root, entry.name),
+        path: (0, import_node_path24.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -19541,7 +19718,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs26.statSync)((0, import_node_path23.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs27.statSync)((0, import_node_path24.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -19552,10 +19729,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs26.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs27.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs26.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs27.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -19564,10 +19741,10 @@ function quarantinePluginCacheDirs(plan2) {
   const failed = [];
   for (const move of plan2) {
     try {
-      if (!(0, import_node_fs26.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs27.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(target), { recursive: true });
-      (0, import_node_fs26.renameSync)(move.from, target);
+      (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(target), { recursive: true });
+      (0, import_node_fs27.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -19586,23 +19763,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs26.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs27.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path23.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs26.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path24.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs27.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs26.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs27.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs26.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs27.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs26.existsSync)(targetPath);
+      return !(0, import_node_fs27.existsSync)(targetPath);
     }
-    (0, import_node_fs26.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs26.existsSync)(targetPath);
+    (0, import_node_fs27.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs27.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -19615,11 +19792,11 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path23.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path24.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs26.existsSync)(path2)) return null;
-    return (0, import_node_fs26.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs27.existsSync)(path2)) return null;
+    return (0, import_node_fs27.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -19628,10 +19805,10 @@ function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
   const home = (0, import_node_os5.homedir)();
   const candidates = [
-    (0, import_node_path23.join)(cwd, ".mcp.json"),
-    (0, import_node_path23.join)(cwd, ".cursor", "mcp.json"),
-    (0, import_node_path23.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path23.join)(home, ".codex", "config.toml")
+    (0, import_node_path24.join)(cwd, ".mcp.json"),
+    (0, import_node_path24.join)(cwd, ".cursor", "mcp.json"),
+    (0, import_node_path24.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path24.join)(home, ".codex", "config.toml")
   ];
   const out = [];
   for (const path2 of candidates) {
@@ -19644,7 +19821,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs26.existsSync)((0, import_node_path23.join)(cwd, rel));
+      return (0, import_node_fs27.existsSync)((0, import_node_path24.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -19663,8 +19840,8 @@ function latestIso(values) {
   return best;
 }
 function latestNorthstarContinuityAt() {
-  const meta = parseMeta(readTextFile((0, import_node_path23.join)(process.cwd(), META_FILE)));
-  const queue = parseQueue(readTextFile((0, import_node_path23.join)(process.cwd(), QUEUE_FILE)));
+  const meta = parseMeta(readTextFile((0, import_node_path24.join)(process.cwd(), META_FILE)));
+  const queue = parseQueue(readTextFile((0, import_node_path24.join)(process.cwd(), QUEUE_FILE)));
   return latestIso([
     ...Object.values(meta).map((entry) => entry.syncedAt),
     ...queue.map((entry) => entry.queuedAt)
@@ -19678,14 +19855,14 @@ async function latestBranchWorkAt() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs26.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs27.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs26.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs27.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -19724,7 +19901,7 @@ async function runDoctor(opts, io = consoleIo) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs26.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs27.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
@@ -19759,7 +19936,7 @@ async function runDoctor(opts, io = consoleIo) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs26.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs27.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -20097,7 +20274,7 @@ async function runDoctor(opts, io = consoleIo) {
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
     cacheRoot: cursorCacheRoot,
-    cacheRootExists: (0, import_node_fs26.existsSync)(cursorCacheRoot),
+    cacheRootExists: (0, import_node_fs27.existsSync)(cursorCacheRoot),
     pins: cursorPins,
     hubCheckout: hubCheckoutForCursorSeed(),
     releasedVersion
@@ -20108,7 +20285,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path23.join)((0, import_node_os5.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path24.join)((0, import_node_os5.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -20117,7 +20294,7 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         surface,
         cacheRoot: cursorCacheRoot,
-        cacheRootExists: (0, import_node_fs26.existsSync)(cursorCacheRoot),
+        cacheRootExists: (0, import_node_fs27.existsSync)(cursorCacheRoot),
         pins: cursorPins,
         hubCheckout: hubCheckoutForCursorSeed(),
         releasedVersion
@@ -20306,23 +20483,23 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path23.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path24.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs26.existsSync)(path2)) {
+    if ((0, import_node_fs27.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs26.existsSync)(path2)) (0, import_node_fs26.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs26.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs27.existsSync)(path2)) (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
@@ -20452,7 +20629,7 @@ async function applyGcPlan(plan2, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs27.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20475,7 +20652,7 @@ async function applyGcPlan(plan2, remote) {
   for (const wt of plan2.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs27.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs28.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -20555,10 +20732,10 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs27.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs28.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs27.mkdirSync)(file.slice(0, slash), { recursive: true });
+      if (slash > 0) (0, import_node_fs28.mkdirSync)(file.slice(0, slash), { recursive: true });
       await (0, import_promises8.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
@@ -20572,13 +20749,13 @@ rules.command("sync").option("--quiet", "stay silent unless something changed or
   if (!await runRulesSync(opts)) process.exitCode = 1;
 });
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path24.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path25.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
   const plan2 = planManagedGitignore(current);
   const drift = [...plan2.added.map((l) => `+${l}`), ...plan2.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan2.changed) {
-      (0, import_node_fs27.writeFileSync)(path2, plan2.content, "utf8");
+      (0, import_node_fs28.writeFileSync)(path2, plan2.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -20605,7 +20782,7 @@ async function runDocsSync(opts, io = consoleIo) {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs27.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs28.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
       await (0, import_promises8.writeFile)(f, c, "utf8");
     }
@@ -20756,7 +20933,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const [bin, ...args] = command.split(" ");
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = (0, import_node_child_process13.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
@@ -20771,7 +20948,7 @@ function runWorktreeInstall(command, cwd, quiet) {
     });
     child.on("exit", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve5();
+      if (code === 0) resolve6();
       else reject(new Error(`${command} exited ${code} in ${cwd}`));
     });
   });
@@ -20779,7 +20956,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path24.dirname)(out) : void 0;
+    return out ? (0, import_node_path25.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -20792,28 +20969,28 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
   };
 }
 function acquireWorktreeSetupLock(worktreeRoot) {
-  const lockPath = (0, import_node_path24.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
+  const lockPath = (0, import_node_path25.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs27.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs28.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs27.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs28.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs27.closeSync)(fd);
+      (0, import_node_fs28.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs27.rmSync)(lockPath, { force: true });
+        (0, import_node_fs28.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs27.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs27.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs28.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs28.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -21061,8 +21238,8 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
 async function resolveDnsBounded(host, timeoutMs = 3e3) {
   const { lookup } = await import("node:dns/promises");
   const probe = lookup(host).then(() => true).catch((e) => dnsErrorToResolution(e?.code));
-  const timeout = new Promise((resolve5) => {
-    setTimeout(() => resolve5(void 0), timeoutMs).unref?.();
+  const timeout = new Promise((resolve6) => {
+    setTimeout(() => resolve6(void 0), timeoutMs).unref?.();
   });
   return Promise.race([probe, timeout]);
 }
@@ -21817,9 +21994,9 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   console.log(JSON.stringify(created));
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path24.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs27.existsSync)(wfDir)) return [];
-  return (0, import_node_fs27.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path25.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs28.existsSync)(wfDir)) return [];
+  return (0, import_node_fs28.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -21838,7 +22015,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -21868,7 +22045,7 @@ pr.command("checks-wait <number>").description("bounded wait for PR checks; skip
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
   });
   if (o.json) printLine(JSON.stringify(result));
   else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
@@ -21895,7 +22072,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
-      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
     }),
     mergeAuto: async (prNumber, repo) => {
       const args = repo ? ["--repo", repo] : [];
@@ -21931,7 +22108,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       while (Date.now() < deadlineMs) {
         const stateRead = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 })).stdout, { retries: 2, delayMs: 1e3 });
         if (stateRead.ok && stateRead.state === "MERGED") return true;
-        await new Promise((resolve5) => setTimeout(resolve5, PR_LAND_POLL_MS));
+        await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
       }
       return false;
     }
@@ -21991,7 +22168,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises8.mkdir)((0, import_node_path24.dirname)(registryPath), { recursive: true });
+          await (0, import_promises8.mkdir)((0, import_node_path25.dirname)(registryPath), { recursive: true });
           await (0, import_promises8.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -22005,13 +22182,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs27.lstatSync)(p);
+      st = (0, import_node_fs28.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs27.readlinkSync)(p);
+      (0, import_node_fs28.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -22019,7 +22196,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs27.readdirSync)(p);
+      return (0, import_node_fs28.readdirSync)(p);
     } catch {
       return [];
     }
@@ -22028,9 +22205,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs27.rmdirSync)(p);
+      (0, import_node_fs28.rmdirSync)(p);
     } catch {
-      (0, import_node_fs27.unlinkSync)(p);
+      (0, import_node_fs28.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -22045,7 +22222,7 @@ async function resolvePrimaryCheckout(execGit) {
 function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover)
   };
 }
@@ -22060,9 +22237,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs27.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs28.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs27.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs28.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -22135,7 +22312,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     } : await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs27.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -22332,7 +22509,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs27.writeSync)(1, `${value}
+  (0, import_node_fs28.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -22349,8 +22526,8 @@ async function resolveStage() {
     local,
     shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs27.existsSync)((0, import_node_path24.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs27.existsSync)((0, import_node_path24.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -22812,7 +22989,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -22856,12 +23033,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs27.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs27.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile7 = (p) => (0, import_node_fs27.existsSync)(p) ? (0, import_node_fs27.readFileSync)(p, "utf8") : null;
+  const readFile7 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -23112,16 +23289,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
     targets = [{ repo: o.repo, class: o.class }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs27.existsSync)("projects.json") ? (0, import_node_fs27.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs28.existsSync)("projects.json") ? (0, import_node_fs28.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs27.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs27.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs28.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs28.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs27.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs27.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs28.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs27.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs27.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs28.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs28.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));