@mutmutco/cli 2.54.1 → 2.55.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -5594,7 +5594,7 @@ async function restoreDirtyOrgSpineToHead(deps, options = {}) {
 }
 
 // src/index.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_promises = require("node:fs/promises");
@@ -9955,14 +9955,564 @@ function registerCoopCommands(program3) {
   });
 }
 
-// src/throttle-commands.ts
+// src/overlord.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
+var import_node_fs15 = require("node:fs");
+var import_node_os3 = require("node:os");
 var import_node_path13 = require("node:path");
-var THROTTLE_TRACE_REL = (0, import_node_path13.join)(".mmi", "throttle", "trace.jsonl");
+
+// src/atomic-write.ts
+var import_node_fs14 = require("node:fs");
+function atomicWriteFileSync(path2, content) {
+  const tmp = `${path2}.${process.pid}.tmp`;
+  (0, import_node_fs14.writeFileSync)(tmp, content, "utf8");
+  (0, import_node_fs14.renameSync)(tmp, path2);
+}
+
+// src/overlord.ts
+var OVERLORD_DEFAULT_COUNT = 3;
+var OVERLORD_MIN_COUNT = 3;
+var OVERLORD_MAX_COUNT = 6;
+var GENERIC_STOP_NAMES = /* @__PURE__ */ new Set([
+  "windowsterminal",
+  "windows terminal",
+  "pwsh",
+  "powershell",
+  "opencode",
+  "codex",
+  "codex-fugu"
+]);
+function numericCountArg(arg) {
+  const match = /^--([0-9]+)$/.exec(arg);
+  return match ? Number(match[1]) : void 0;
+}
+function isoNow(now = () => /* @__PURE__ */ new Date()) {
+  return now().toISOString();
+}
+function defaultRunId() {
+  return `overlord-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+function defaultRunToken() {
+  return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+}
+function defaultMessageId() {
+  return `msg-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+function servantSlotId(slot) {
+  return slot.name.replace(/\s+/g, "-").toLowerCase();
+}
+function parseOverlordCount(args) {
+  const counts = args.map(numericCountArg).filter((n) => n !== void 0);
+  if (counts.length === 0) return OVERLORD_DEFAULT_COUNT;
+  if (counts.length > 1) throw new Error("provide only one overlord servant count");
+  const count = counts[0];
+  if (count < OVERLORD_MIN_COUNT || count > OVERLORD_MAX_COUNT) {
+    throw new Error(`overlord servant count must be between ${OVERLORD_MIN_COUNT} and ${OVERLORD_MAX_COUNT}`);
+  }
+  return count;
+}
+function buildServantLayout(count) {
+  if (count < OVERLORD_MIN_COUNT || count > OVERLORD_MAX_COUNT) {
+    throw new Error(`overlord servant count must be between ${OVERLORD_MIN_COUNT} and ${OVERLORD_MAX_COUNT}`);
+  }
+  const slots = [{
+    name: "fugu ultra 1",
+    role: "ultra",
+    model: "fugu-ultra",
+    index: 1
+  }];
+  for (let i = 1; i < count; i++) {
+    slots.push({
+      name: `fugu normal ${i}`,
+      role: "normal",
+      model: "fugu",
+      index: i
+    });
+  }
+  return slots;
+}
+function validateCodexFuguHelp(helpText) {
+  const problems = [];
+  if (!/(?:^|\s)-a(?:,|\s)|--ask-for-approval/.test(helpText)) problems.push("missing approval flag");
+  if (!/(?:^|\s)-s(?:,|\s)|--sandbox/.test(helpText)) problems.push("missing sandbox flag");
+  if (!/(?:^|\s)-c(?:,|\s)|--config/.test(helpText)) problems.push("missing config override flag");
+  if (!/--no-alt-screen/.test(helpText)) problems.push("missing no-alt-screen flag");
+  if (!/(?:^|\s)-C(?:,|\s)|--cwd|--cd|--workdir/.test(helpText)) problems.push("missing cwd flag");
+  return problems;
+}
+function evaluateCodexFuguPreflight(input) {
+  const problems = [];
+  if (!input.codexFound) problems.push("codex is not installed or not on PATH");
+  if (!input.fuguFound) problems.push("codex-fugu is not installed or not on PATH");
+  if (!input.authConfigured && !input.envNames.includes("OPENAI_API_KEY") && !input.envNames.includes("CODEX_API_KEY")) {
+    problems.push("missing API key environment: OPENAI_API_KEY or CODEX_API_KEY");
+  }
+  problems.push(...validateCodexFuguHelp(input.helpText ?? ""));
+  const status = input.statusText ?? "";
+  const modelCatalog = input.modelCatalogText ?? "";
+  if (!/\bfugu-ultra\b/i.test(`${status}
+${modelCatalog}`)) problems.push("fugu-ultra is not available");
+  if (/native windows codex[^\n]*\/c\/users|\/c\/users[^\n]*native windows codex/i.test(status)) {
+    problems.push("native Windows Codex is configured with a Git Bash /c/Users path");
+  }
+  return { ok: problems.length === 0, problems };
+}
+function defaultOverlordStatePath(cwd) {
+  return (0, import_node_path13.join)(cwd, "tmp", "overlord", "runs.json");
+}
+function readOverlordRegistry(statePath) {
+  if (!(0, import_node_fs15.existsSync)(statePath)) return { runs: {} };
+  try {
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(statePath, "utf8"));
+    return { activeRunId: parsed.activeRunId, runs: parsed.runs ?? {} };
+  } catch {
+    return { runs: {} };
+  }
+}
+function writeOverlordRegistry(statePath, registry2) {
+  (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(statePath), { recursive: true });
+  atomicWriteFileSync(statePath, `${JSON.stringify(registry2, null, 2)}
+`);
+}
+function buildOverlordRun(options) {
+  const runId = options.runId?.() ?? defaultRunId();
+  const runToken = options.runToken?.() ?? defaultRunToken();
+  const statePath = defaultOverlordStatePath(options.cwd);
+  const journalDir = (0, import_node_path13.join)(options.cwd, "tmp", "overlord", runId);
+  const timestamp = isoNow(options.now);
+  return {
+    runId,
+    runToken,
+    task: options.task,
+    state: "starting",
+    createdAt: timestamp,
+    updatedAt: timestamp,
+    worktree: options.cwd,
+    statePath,
+    journalDir,
+    servants: buildServantLayout(options.count).map((slot) => ({
+      ...slot,
+      slotId: servantSlotId(slot),
+      profile: "consultation",
+      state: "planned",
+      journalPath: (0, import_node_path13.join)(journalDir, `${servantSlotId(slot)}.log`),
+      composerSubmitMode: "unknown"
+    })),
+    ownedResources: []
+  };
+}
+function recordOverlordHeartbeat(run, options) {
+  const timestamp = isoNow(options.now);
+  const controllerResource = {
+    kind: "process",
+    pid: options.controllerPid,
+    commandName: "mmi-cli overlord controller",
+    runId: run.runId,
+    runToken: run.runToken,
+    fingerprint: options.fingerprint
+  };
+  const others = run.ownedResources.filter((resource) => resource.commandName !== "mmi-cli overlord controller");
+  return {
+    ...run,
+    state: run.state === "starting" ? "active" : run.state,
+    updatedAt: timestamp,
+    controllerPid: options.controllerPid,
+    controllerFingerprint: options.fingerprint,
+    lastControllerHeartbeatAt: timestamp,
+    ownedResources: [controllerResource, ...others]
+  };
+}
+function buildOverlordStartupPlan(args, cwd) {
+  const count = parseOverlordCount(args);
+  const task = args.filter((arg) => numericCountArg(arg) === void 0).join(" ").trim();
+  return {
+    count,
+    servants: buildServantLayout(count),
+    task,
+    statePath: defaultOverlordStatePath(cwd),
+    nextPhase: "preflight"
+  };
+}
+function normalizedCommandName(resource) {
+  return (resource.commandName ?? resource.title ?? "").trim().toLowerCase();
+}
+function planStopResource(resource, context) {
+  const exactOwner = resource.runId === context.runId && resource.runToken === context.runToken && Boolean(resource.fingerprint);
+  if (exactOwner) return { action: "stop", reason: "owned" };
+  const name = normalizedCommandName(resource);
+  if (!name || GENERIC_STOP_NAMES.has(name)) return { action: "refuse", reason: "ownership not proven" };
+  return { action: "refuse", reason: "ownership not proven" };
+}
+function summarizeOverlordRun(run, probe) {
+  const controller = run.controllerPid == null ? "not-started" : probe.isPidAlive(run.controllerPid) ? "alive" : "lost";
+  return {
+    active: run.state !== "stopped" && run.state !== "failed",
+    runId: run.runId,
+    state: run.state,
+    controller,
+    servants: run.servants.map((servant) => {
+      if (servant.pid == null) return { name: servant.name, state: "not-started" };
+      if (!probe.isPidAlive(servant.pid)) return { name: servant.name, state: "lost" };
+      if (servant.state === "ready" && servant.lastAckAt && servant.composerSubmitMode !== "unknown") {
+        return { name: servant.name, state: "ready" };
+      }
+      return { name: servant.name, state: servant.state };
+    })
+  };
+}
+function planOverlordRunStop(run) {
+  const killPids = [];
+  const uncertain = [];
+  for (const resource of run.ownedResources) {
+    const plan2 = planStopResource(resource, { runId: run.runId, runToken: run.runToken });
+    if (plan2.action === "stop" && resource.pid != null) killPids.push(resource.pid);
+    else uncertain.push(resource);
+  }
+  return { killPids, uncertain };
+}
+function controllerFingerprint(run) {
+  return `mmi-overlord-controller:${run.runId}:${run.worktree}`;
+}
+function defaultStartController(run) {
+  const scriptPath = (0, import_node_path13.join)(__dirname, "overlord-controller.cjs");
+  const fingerprint = controllerFingerprint(run);
+  const child = (0, import_node_child_process8.spawn)(process.execPath, [scriptPath, run.runId, run.statePath, fingerprint], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true,
+    cwd: run.worktree
+  });
+  child.unref();
+  return { pid: child.pid, fingerprint };
+}
+function defaultIsPidAlive(pid) {
+  if (!Number.isFinite(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function defaultKillPid(pid) {
+  process.kill(pid);
+}
+function shellQuote2(arg) {
+  return /^[A-Za-z0-9_./:-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '\\"')}"`;
+}
+function boundedCommandText(command, args) {
+  const shell2 = process.platform === "win32";
+  const file = shell2 ? [command, ...args].map(shellQuote2).join(" ") : command;
+  const result = (0, import_node_child_process8.spawnSync)(file, shell2 ? [] : args, {
+    encoding: "utf8",
+    shell: shell2,
+    timeout: 5e3,
+    windowsHide: true,
+    env: {
+      ...process.env,
+      CODEX_FUGU_NO_NOTICE: "1",
+      CODEX_FUGU_NO_UPDATE: "1"
+    }
+  });
+  const text = `${result.stdout ?? ""}
+${result.stderr ?? ""}`.trim();
+  if (result.error && result.error.code === "ENOENT") return { found: false, text };
+  return { found: !result.error, text };
+}
+function readFuguModelCatalogText() {
+  const codexHome = process.env.CODEX_HOME ?? (0, import_node_path13.join)((0, import_node_os3.homedir)(), ".codex");
+  const catalogPath = (0, import_node_path13.join)(codexHome, "fugu.json");
+  try {
+    return (0, import_node_fs15.existsSync)(catalogPath) ? (0, import_node_fs15.readFileSync)(catalogPath, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+function hasCodexAuthEvidence() {
+  const codexHome = process.env.CODEX_HOME ?? (0, import_node_path13.join)((0, import_node_os3.homedir)(), ".codex");
+  return (0, import_node_fs15.existsSync)((0, import_node_path13.join)(codexHome, "auth.json"));
+}
+function collectCodexFuguPreflight() {
+  const codexHelp = boundedCommandText("codex", ["--help"]);
+  const fuguHelp = boundedCommandText("codex-fugu", ["--help"]);
+  const fuguStatus = boundedCommandText("codex-fugu", ["--status"]);
+  return evaluateCodexFuguPreflight({
+    codexFound: codexHelp.found,
+    fuguFound: fuguHelp.found,
+    helpText: fuguHelp.text || codexHelp.text,
+    statusText: fuguStatus.text,
+    modelCatalogText: readFuguModelCatalogText(),
+    authConfigured: hasCodexAuthEvidence(),
+    envNames: Object.keys(process.env)
+  });
+}
+function renderCodexFuguPreflightFailure(report) {
+  const lines = [
+    "Overlord setup needed",
+    "The servant pool was not started because Codex/Fugu preflight failed.",
+    "",
+    "Problems:",
+    ...report.problems.map((problem) => `- ${problem}`),
+    "",
+    "Fixes:"
+  ];
+  if (report.problems.some((problem) => problem.includes("codex is not installed"))) {
+    lines.push("- Install or update Codex, then confirm with `codex --version`.");
+  }
+  if (report.problems.some((problem) => problem.includes("codex-fugu is not installed"))) {
+    lines.push("- Install or repair codex-fugu, then confirm with `codex-fugu --status`.");
+  }
+  if (report.problems.some((problem) => problem.includes("missing API key"))) {
+    lines.push("- Set OPENAI_API_KEY or CODEX_API_KEY in the launching shell; do not paste key values into chat.");
+  }
+  if (report.problems.some((problem) => problem.includes("fugu-ultra"))) {
+    lines.push("- Recheck or update Fugu configs so `fugu-ultra` appears in the Fugu model catalog.");
+  }
+  if (report.problems.some((problem) => problem.includes("missing ") && problem.includes("flag"))) {
+    lines.push("- Update Codex/Fugu until `codex-fugu --help` exposes approval, sandbox, config, cwd, and no-alt-screen flags.");
+  }
+  if (report.problems.some((problem) => problem.includes("/c/Users"))) {
+    lines.push("- Launch from a native shell adapter or repair Fugu path configuration so Windows paths stay native.");
+  }
+  return lines.join("\n");
+}
+function findActiveRun(registry2) {
+  const runId = registry2.activeRunId;
+  if (!runId) return void 0;
+  return registry2.runs[runId];
+}
+function normalizeServantTarget(target) {
+  return target.trim().toLowerCase().replace(/\s+/g, "-");
+}
+function hasServantTarget(run, target) {
+  const normalized = normalizeServantTarget(target);
+  return normalized === "all" || run.servants.some(
+    (servant) => servant.slotId === normalized || normalizeServantTarget(servant.name) === normalized
+  );
+}
+function renderOverlordStatus(summary, run) {
+  const servants = summary.servants.map((servant) => `- ${servant.name}: ${servant.state}`).join("\n");
+  return [
+    `Overlord run ${summary.runId}`,
+    `State: ${summary.state}`,
+    `Task: ${run.task || "not provided yet"}`,
+    `Controller: ${summary.controller}`,
+    "Servants:",
+    servants
+  ].join("\n");
+}
+function runJson(run, extra = {}) {
+  return {
+    ok: true,
+    runId: run.runId,
+    state: run.state,
+    task: run.task,
+    count: run.servants.length,
+    controllerPid: run.controllerPid,
+    statePath: run.statePath,
+    servants: run.servants.map((servant) => ({
+      name: servant.name,
+      role: servant.role,
+      model: servant.model,
+      state: servant.state,
+      pid: servant.pid,
+      journalPath: servant.journalPath
+    })),
+    ...extra
+  };
+}
+function wantsJson(options, command) {
+  return Boolean(options.json || command?.parent?.opts?.().json);
+}
+function countArgsFromOptions(options) {
+  return ["3", "4", "5", "6"].filter((key) => options[key]).map((key) => `--${key}`);
+}
+function registerOverlordCommands(program3, deps = {}) {
+  const out = deps.out ?? ((text) => process.stdout.write(text));
+  const err = deps.err ?? ((text) => process.stderr.write(text));
+  const cwd = deps.cwd ?? (() => process.cwd());
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const preflight2 = deps.preflight ?? collectCodexFuguPreflight;
+  const startController = deps.startController ?? defaultStartController;
+  const isPidAlive = deps.isPidAlive ?? defaultIsPidAlive;
+  const killPid = deps.killPid ?? defaultKillPid;
+  const overlord = program3.command("overlord").description("coordinate one Ultra and normal Fugu servants for hard org work").allowUnknownOption(true).argument("[task...]", "task for the Overlord system").option("--3", "run one Ultra and two normal Fugus").option("--4", "run one Ultra and three normal Fugus").option("--5", "run one Ultra and four normal Fugus").option("--6", "run one Ultra and five normal Fugus").option("--json", "print machine-readable output").action((task = [], options) => {
+    try {
+      const args = [...countArgsFromOptions(options), ...task];
+      const root = cwd();
+      const plan2 = buildOverlordStartupPlan(args, root);
+      const preflightReport = preflight2();
+      if (!preflightReport.ok) {
+        err(`${renderCodexFuguPreflightFailure(preflightReport)}
+`);
+        process.exitCode = 1;
+        return;
+      }
+      const registry2 = readOverlordRegistry(plan2.statePath);
+      const active = findActiveRun(registry2);
+      if (active && active.state !== "stopped" && active.state !== "failed") {
+        throw new Error(`active Overlord run already exists: ${active.runId}`);
+      }
+      let run = buildOverlordRun({
+        task: plan2.task,
+        cwd: root,
+        count: plan2.count,
+        now,
+        runId: deps.runId,
+        runToken: deps.runToken
+      });
+      writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
+      const controller = startController(run);
+      if (controller.pid != null) {
+        run = recordOverlordHeartbeat(run, {
+          controllerPid: controller.pid,
+          fingerprint: controller.fingerprint,
+          now
+        });
+        writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
+      }
+      if (options.json) out(`${JSON.stringify(runJson(run, { nextPhase: "consult-servants" }), null, 2)}
+`);
+      else {
+        out(`${[
+          "Overlord startup",
+          `Task: ${run.task || "not provided yet"}`,
+          `Run: ${run.runId}`,
+          `Servants: ${run.servants.length} total`,
+          `Controller: ${run.controllerPid ? `started (pid ${run.controllerPid})` : "launch requested"}`,
+          "Next: consult servants, interview the human, then print an approved todo list."
+        ].join("\n")}
+`);
+      }
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      if (options.json) out(`${JSON.stringify({ ok: false, error: message }, null, 2)}
+`);
+      else err(`overlord: ${message}
+`);
+      process.exitCode = 1;
+    }
+  });
+  overlord.command("send").description("queue an assignment or redirect for the active Overlord servant controller").argument("<target>", "servant slot id/name, or all").argument("[message...]", "message to deliver to the servant PTY").option("--json", "print machine-readable output").action((target, message = [], options, command) => {
+    const json = wantsJson(options, command);
+    try {
+      const statePath = defaultOverlordStatePath(cwd());
+      const registry2 = readOverlordRegistry(statePath);
+      const run = findActiveRun(registry2);
+      if (!run) throw new Error("no active Overlord run found");
+      const normalized = normalizeServantTarget(target);
+      if (!hasServantTarget(run, normalized)) throw new Error(`unknown Overlord servant target: ${target}`);
+      const text = message.join(" ").trim();
+      if (!text) throw new Error("message is required");
+      const queued = {
+        id: deps.runId?.() ?? defaultMessageId(),
+        target: normalized,
+        text,
+        createdAt: isoNow(now)
+      };
+      const next = {
+        ...run,
+        updatedAt: isoNow(now),
+        messages: [...run.messages ?? [], queued]
+      };
+      writeOverlordRegistry(statePath, {
+        ...registry2,
+        runs: { ...registry2.runs, [run.runId]: next }
+      });
+      const payload = { queued: 1, runId: run.runId, target: normalized, messageId: queued.id, statePath };
+      if (json) out(`${JSON.stringify(payload, null, 2)}
+`);
+      else out(`Queued message ${queued.id} for ${normalized}.
+State: ${statePath}
+`);
+    } catch (e) {
+      const messageText = e instanceof Error ? e.message : String(e);
+      if (json) out(`${JSON.stringify({ ok: false, error: messageText }, null, 2)}
+`);
+      else err(`overlord send: ${messageText}
+`);
+      process.exitCode = 1;
+    }
+  });
+  overlord.command("status").description("show the active Overlord run and servant liveness").option("--json", "print machine-readable output").action((options, command) => {
+    const json = wantsJson(options, command);
+    const statePath = defaultOverlordStatePath(cwd());
+    const registry2 = readOverlordRegistry(statePath);
+    const run = findActiveRun(registry2);
+    if (!run) {
+      const payload2 = { active: false, statePath, message: "no active Overlord run found" };
+      if (json) out(`${JSON.stringify(payload2, null, 2)}
+`);
+      else out(`No active Overlord run found.
+State: ${payload2.statePath}
+`);
+      return;
+    }
+    const summary = summarizeOverlordRun(run, { isPidAlive });
+    const payload = { ...summary, statePath, task: run.task };
+    if (json) out(`${JSON.stringify(payload, null, 2)}
+`);
+    else out(`${renderOverlordStatus(summary, run)}
+State: ${statePath}
+`);
+  });
+  overlord.command("stop").description("stop only exact run-owned Overlord resources").option("--json", "print machine-readable output").action((options, command) => {
+    const json = wantsJson(options, command);
+    const statePath = defaultOverlordStatePath(cwd());
+    const registry2 = readOverlordRegistry(statePath);
+    const run = findActiveRun(registry2);
+    if (!run) {
+      const payload2 = { stopped: 0, uncertain: 0, statePath, message: "no active Overlord run found" };
+      if (json) out(`${JSON.stringify(payload2, null, 2)}
+`);
+      else out(`No active Overlord run found. Nothing stopped.
+State: ${payload2.statePath}
+`);
+      return;
+    }
+    const stopPlan = planOverlordRunStop(run);
+    for (const pid of stopPlan.killPids) {
+      try {
+        killPid(pid);
+      } catch {
+      }
+    }
+    const stoppedRun = {
+      ...run,
+      state: "stopped",
+      updatedAt: isoNow(now)
+    };
+    writeOverlordRegistry(statePath, {
+      runs: { ...registry2.runs, [run.runId]: stoppedRun }
+    });
+    const payload = {
+      runId: run.runId,
+      stopped: stopPlan.killPids.length,
+      uncertain: stopPlan.uncertain.length,
+      statePath
+    };
+    if (json) out(`${JSON.stringify(payload, null, 2)}
+`);
+    else {
+      out(`${[
+        `Stopped ${payload.stopped} Overlord-owned process(es).`,
+        payload.uncertain ? `Left ${payload.uncertain} uncertain resource(s) untouched.` : "No uncertain resources.",
+        `State: ${statePath}`
+      ].join("\n")}
+`);
+    }
+  });
+  return overlord;
+}
+
+// src/throttle-commands.ts
+var import_node_child_process9 = require("node:child_process");
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
+var THROTTLE_TRACE_REL = (0, import_node_path14.join)(".mmi", "throttle", "trace.jsonl");
 function resolveRepoGitRoot(cwd = process.cwd()) {
   try {
-    const root = (0, import_node_child_process8.execFileSync)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+    const root = (0, import_node_child_process9.execFileSync)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
@@ -9972,7 +10522,7 @@ function resolveRepoGitRoot(cwd = process.cwd()) {
   }
 }
 function resolveThrottleTracePath(cwd = process.cwd()) {
-  return (0, import_node_path13.join)(resolveRepoGitRoot(cwd), THROTTLE_TRACE_REL);
+  return (0, import_node_path14.join)(resolveRepoGitRoot(cwd), THROTTLE_TRACE_REL);
 }
 function resolveModeFromEnv() {
   const v = String(process.env.MMI_THROTTLE_MODE ?? "block").trim().toLowerCase();
@@ -9992,6 +10542,12 @@ function parseTraceLines(raw) {
   }
   return out;
 }
+function commandSafetyClass(reasonId) {
+  if (reasonId === "shell_dialect_redirect") return "dialect/redirect mismatch";
+  if (reasonId === "shell_log_dump") return "unbounded log/text dump";
+  if (reasonId.startsWith("shell_")) return "shell command safety";
+  return void 0;
+}
 function summarizeTrace(entries) {
   let denials = 0;
   let readBytesWouldBlock = 0;
@@ -9999,6 +10555,7 @@ function summarizeTrace(entries) {
   const byReason = {};
   const bySurface = {};
   const byMode = {};
+  const commandSafetyBySurface = {};
   for (const e of entries) {
     denials += 1;
     const tool = e.tool ?? "unknown";
@@ -10009,22 +10566,27 @@ function summarizeTrace(entries) {
     bySurface[surface] = (bySurface[surface] ?? 0) + 1;
     const mode = e.mode ?? "unknown";
     byMode[mode] = (byMode[mode] ?? 0) + 1;
+    const safetyClass = commandSafetyClass(reason);
+    if (safetyClass) {
+      commandSafetyBySurface[surface] = commandSafetyBySurface[surface] ?? {};
+      commandSafetyBySurface[surface][safetyClass] = (commandSafetyBySurface[surface][safetyClass] ?? 0) + 1;
+    }
     if (reason === "read_unbounded_large") {
       readBytesWouldBlock += Number(e.fileBytes) || 0;
     }
   }
-  return { denials, readBytesWouldBlock, byTool, byReason, bySurface, byMode };
+  return { denials, readBytesWouldBlock, byTool, byReason, bySurface, byMode, commandSafetyBySurface };
 }
 function runThrottleReport(io, tracePath = resolveThrottleTracePath()) {
   const mode = resolveModeFromEnv();
-  if (!(0, import_node_fs14.existsSync)(tracePath)) {
+  if (!(0, import_node_fs16.existsSync)(tracePath)) {
     io.log(`Throttle: no trace at ${tracePath} (gates have not denied anything yet).`);
     io.log(`Active mode: ${mode} (MMI_THROTTLE_MODE env; default block).`);
     return 0;
   }
   let raw = "";
   try {
-    raw = (0, import_node_fs14.readFileSync)(tracePath, "utf8");
+    raw = (0, import_node_fs16.readFileSync)(tracePath, "utf8");
   } catch (e) {
     io.err(`Throttle: could not read trace: ${e.message}`);
     return 1;
@@ -10059,6 +10621,14 @@ function runThrottleReport(io, tracePath = resolveThrottleTracePath()) {
     io.log("  by surface:");
     for (const [name, count] of surfaces) io.log(`    ${name}: ${count}`);
   }
+  const safetySurfaces = Object.entries(s.commandSafetyBySurface).sort((a, b) => a[0].localeCompare(b[0]));
+  if (safetySurfaces.length) {
+    io.log("  command safety (quoting/dialect/shell) by surface:");
+    for (const [surface, classes] of safetySurfaces) {
+      const detail = Object.entries(classes).sort((a, b) => b[1] - a[1]).map(([cls, count]) => `${cls}: ${count}`).join(", ");
+      io.log(`    ${surface}: ${detail}`);
+    }
+  }
   return 0;
 }
 function registerThrottleCommands(program3) {
@@ -10091,7 +10661,7 @@ async function syncDocs(deps, docs2 = SYNCED_DOCS) {
 }
 
 // src/board.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var import_node_util6 = require("node:util");
 
 // src/board-priority.ts
@@ -10199,7 +10769,7 @@ async function filterDependencyBlockedClaimables(items, client, opts = {}) {
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process9.execFile);
+var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
 var CLAIM_CONCURRENCY = 5;
@@ -11028,16 +11598,16 @@ function ghError(e) {
 }
 
 // src/board-slice-cache.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path14 = require("node:path");
-var BOARD_SLICE_CACHE_FILE = (0, import_node_path14.join)(".mmi", "board-slice.json");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
+var BOARD_SLICE_CACHE_FILE = (0, import_node_path15.join)(".mmi", "board-slice.json");
 var BOARD_SLICE_CACHE_TTL_MS = 10 * 60 * 1e3;
 function boardSliceCachePath(cwd) {
-  return (0, import_node_path14.join)(cwd, BOARD_SLICE_CACHE_FILE);
+  return (0, import_node_path15.join)(cwd, BOARD_SLICE_CACHE_FILE);
 }
 function readCachedBoardSlice(cwd) {
   try {
-    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(boardSliceCachePath(cwd), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(boardSliceCachePath(cwd), "utf8"));
     if (typeof parsed.ts !== "number") return null;
     return { block: typeof parsed.block === "string" ? parsed.block : null, ts: parsed.ts };
   } catch {
@@ -11048,12 +11618,12 @@ function writeCachedBoardSlice(cwd, slice) {
   const path2 = boardSliceCachePath(cwd);
   const tmp = `${path2}.${process.pid}.tmp`;
   try {
-    (0, import_node_fs15.mkdirSync)((0, import_node_path14.dirname)(path2), { recursive: true });
-    (0, import_node_fs15.writeFileSync)(tmp, JSON.stringify(slice));
-    (0, import_node_fs15.renameSync)(tmp, path2);
+    (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(path2), { recursive: true });
+    (0, import_node_fs17.writeFileSync)(tmp, JSON.stringify(slice));
+    (0, import_node_fs17.renameSync)(tmp, path2);
   } catch {
     try {
-      (0, import_node_fs15.rmSync)(tmp, { force: true });
+      (0, import_node_fs17.rmSync)(tmp, { force: true });
     } catch {
     }
   }
@@ -11181,8 +11751,8 @@ async function refreshBoardSliceCache(deps) {
 }
 
 // src/worktree.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
 var LOCAL_ONLY_FILES = [".claude/settings.local.json"];
 var PKG = "package.json";
 var LOCKFILE = "package-lock.json";
@@ -11190,21 +11760,21 @@ var NODE_MODULES = "node_modules";
 var realFsProbe = {
   isDir: (p) => {
     try {
-      return (0, import_node_fs16.statSync)(p).isDirectory();
+      return (0, import_node_fs18.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   },
   isFile: (p) => {
     try {
-      return (0, import_node_fs16.statSync)(p).isFile();
+      return (0, import_node_fs18.statSync)(p).isFile();
     } catch {
       return false;
     }
   },
   listDirs: (p) => {
     try {
-      return (0, import_node_fs16.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+      return (0, import_node_fs18.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch {
       return [];
     }
@@ -11212,12 +11782,12 @@ var realFsProbe = {
 };
 function scanInstallDirs(root, fs2 = realFsProbe) {
   const factsFor = (dir) => {
-    const abs = dir ? (0, import_node_path15.join)(root, dir) : root;
+    const abs = dir ? (0, import_node_path16.join)(root, dir) : root;
     return {
       dir,
-      hasPackageJson: fs2.isFile((0, import_node_path15.join)(abs, PKG)),
-      hasLockfile: fs2.isFile((0, import_node_path15.join)(abs, LOCKFILE)),
-      hasNodeModules: fs2.isDir((0, import_node_path15.join)(abs, NODE_MODULES))
+      hasPackageJson: fs2.isFile((0, import_node_path16.join)(abs, PKG)),
+      hasLockfile: fs2.isFile((0, import_node_path16.join)(abs, LOCKFILE)),
+      hasNodeModules: fs2.isDir((0, import_node_path16.join)(abs, NODE_MODULES))
     };
   };
   const children = fs2.listDirs(root).filter((name) => name !== NODE_MODULES && name !== ".git");
@@ -11227,7 +11797,7 @@ function npmInstallTargets(dirs) {
   return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
-  return fs2.isFile((0, import_node_path15.join)(root, ".git"));
+  return fs2.isFile((0, import_node_path16.join)(root, ".git"));
 }
 function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   if (!isLinkedWorktree(root, fs2)) return null;
@@ -11237,8 +11807,8 @@ function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   return `[worktree] provisioning tooling in the background (deps in ${where} + local config) \u2014 \`mmi-cli worktree setup\` to redo`;
 }
 function defaultCopyFile(from, to) {
-  (0, import_node_fs16.mkdirSync)((0, import_node_path15.dirname)(to), { recursive: true });
-  (0, import_node_fs16.copyFileSync)(from, to);
+  (0, import_node_fs18.mkdirSync)((0, import_node_path16.dirname)(to), { recursive: true });
+  (0, import_node_fs18.copyFileSync)(from, to);
 }
 async function provisionWorktree(worktreeRoot, deps) {
   const fs2 = deps.fs ?? realFsProbe;
@@ -11250,7 +11820,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const skippedInstall = allDirs.filter((d) => d.hasPackageJson && d.hasNodeModules).map((d) => d.dir);
   const installed = [];
   for (const target of targets) {
-    const cwd = target.dir ? (0, import_node_path15.join)(worktreeRoot, target.dir) : worktreeRoot;
+    const cwd = target.dir ? (0, import_node_path16.join)(worktreeRoot, target.dir) : worktreeRoot;
     log(`installing deps: ${target.command} in ${target.dir || "."}`);
     await deps.runInstall(target.command, cwd);
     installed.push(target);
@@ -11259,7 +11829,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const copySkipped = [];
   const primary = await deps.primaryCheckout();
   for (const rel of LOCAL_ONLY_FILES) {
-    const dest = (0, import_node_path15.join)(worktreeRoot, rel);
+    const dest = (0, import_node_path16.join)(worktreeRoot, rel);
     if (fs2.isFile(dest)) {
       copySkipped.push({ file: rel, reason: "already-present" });
       continue;
@@ -11268,11 +11838,11 @@ async function provisionWorktree(worktreeRoot, deps) {
       copySkipped.push({ file: rel, reason: "no-primary" });
       continue;
     }
-    if (!fs2.isFile((0, import_node_path15.join)(primary, rel))) {
+    if (!fs2.isFile((0, import_node_path16.join)(primary, rel))) {
       copySkipped.push({ file: rel, reason: "absent-in-primary" });
       continue;
     }
-    copyFile((0, import_node_path15.join)(primary, rel), dest);
+    copyFile((0, import_node_path16.join)(primary, rel), dest);
     copied.push(rel);
     log(`copied local config: ${rel}`);
   }
@@ -11280,7 +11850,7 @@ async function provisionWorktree(worktreeRoot, deps) {
 }
 function defaultWorktreePath(repoRoot, branch) {
   const safe = branch.replace(/[/\\]+/g, "-");
-  return (0, import_node_path15.join)((0, import_node_path15.dirname)(repoRoot), "mmi-worktrees", safe);
+  return (0, import_node_path16.join)((0, import_node_path16.dirname)(repoRoot), "mmi-worktrees", safe);
 }
 function resolveWorktreeBase(from, remote) {
   const remotePrefix = `${remote}/`;
@@ -11427,7 +11997,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -12609,8 +13179,8 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 
 // src/gh-create.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_os3 = require("node:os");
-var import_node_path16 = require("node:path");
+var import_node_os4 = require("node:os");
+var import_node_path17 = require("node:path");
 var import_node_crypto5 = require("node:crypto");
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
@@ -12651,7 +13221,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   } };
   const write = deps.write ?? import_promises5.writeFile;
   const remove = deps.remove ?? import_promises5.unlink;
-  const file = (0, import_node_path16.join)(deps.dir ?? (0, import_node_os3.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
+  const file = (0, import_node_path17.join)(deps.dir ?? (0, import_node_os4.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
   await write(file, args[i + 1], "utf8");
   return {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
@@ -12696,6 +13266,92 @@ function buildPrArgs({ title, body, base, head, repo }) {
   return args;
 }
 
+// src/sub-issue.ts
+function parseIssueRef(ref) {
+  const trimmed = ref.trim();
+  const url = trimmed.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)$/i);
+  if (url) return { repo: url[1], number: Number(url[2]) };
+  const qualified = trimmed.match(/^([^/\s#]+\/[^/\s#]+)#(\d+)$/);
+  if (qualified) return { repo: qualified[1], number: Number(qualified[2]) };
+  const bare = trimmed.match(/^#?(\d+)$/);
+  if (bare) return { number: Number(bare[1]) };
+  throw new Error(`invalid issue reference "${ref}" \u2014 expected #123, 123, owner/repo#123, or an issue URL`);
+}
+function buildResolveIdArgs(ref) {
+  const args = ["issue", "view", String(ref.number), "--json", "id", "--jq", ".id"];
+  if (ref.repo) args.push("--repo", ref.repo);
+  return args;
+}
+function buildAddSubIssueArgs(parentId, subIssueId) {
+  if (!parentId) throw new Error("addSubIssue: parentId is required");
+  if (!subIssueId) throw new Error("addSubIssue: subIssueId is required");
+  return [
+    "api",
+    "graphql",
+    "-f",
+    "query=mutation($p:ID!,$c:ID!){addSubIssue(input:{issueId:$p,subIssueId:$c}){issue{number subIssues{totalCount}} subIssue{number}}}",
+    "-f",
+    `p=${parentId}`,
+    "-f",
+    `c=${subIssueId}`
+  ];
+}
+function parseAddSubIssueResult(stdout) {
+  try {
+    const issue2 = JSON.parse(stdout)?.data?.addSubIssue;
+    const parentNumber = issue2?.issue?.number;
+    const subIssueNumber = issue2?.subIssue?.number;
+    const totalCount = issue2?.issue?.subIssues?.totalCount;
+    if (typeof parentNumber !== "number" || typeof subIssueNumber !== "number") return void 0;
+    return { parentNumber, subIssueNumber, totalCount: typeof totalCount === "number" ? totalCount : 0 };
+  } catch {
+    return void 0;
+  }
+}
+var RESOLVE_ID_TIMEOUT_MS = 1e4;
+async function resolveIssueNodeId(runGh, ref, fallbackRepo) {
+  const resolved = ref.repo ? ref : { ...ref, repo: fallbackRepo };
+  const id = (await runGh(buildResolveIdArgs(resolved), RESOLVE_ID_TIMEOUT_MS)).trim();
+  if (!id) throw new Error(`could not resolve node id for issue #${ref.number}${resolved.repo ? ` in ${resolved.repo}` : ""}`);
+  return id;
+}
+async function linkSubIssue(runGh, parentRef, childRef, defaultRepo) {
+  const parent = parseIssueRef(parentRef);
+  const child = parseIssueRef(childRef);
+  const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
+  const subIssueId = await resolveIssueNodeId(runGh, child, defaultRepo);
+  const stdout = await runGh(buildAddSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
+  const result = parseAddSubIssueResult(stdout);
+  if (!result) throw new Error(`addSubIssue returned an unexpected response:
+${stdout.trim() || "(empty)"}`);
+  return result;
+}
+function parentLinkFields(result, error) {
+  if (result) return { parent: result };
+  if (error) return { parentLinkError: error };
+  return {};
+}
+
+// src/issue-comment.ts
+async function postIssueComment(client, input) {
+  const parsed = parseIssueRef(input.ref);
+  const repo = parsed.repo ?? input.defaultRepo;
+  if (!repo) throw new Error("could not resolve repo \u2014 pass --repo owner/repo");
+  if (input.body.trim().length === 0) throw new Error("comment body is empty");
+  const comment = await client.rest(
+    "POST",
+    `repos/${repo}/issues/${parsed.number}/comments`,
+    { body: { body: input.body } }
+  );
+  if (!comment?.html_url) throw new Error("GitHub did not return a comment URL");
+  return {
+    number: parsed.number,
+    repo,
+    url: `https://github.com/${repo}/issues/${parsed.number}`,
+    commentUrl: comment.html_url
+  };
+}
+
 // src/issue-check.ts
 var CHECKLIST_RE = /^([ \t]*[-*+] \[)([ xX])(\] )(.*)$/gm;
 function findChecklistItems(body) {
@@ -12978,72 +13634,6 @@ Related work discovered by mmi-cli:
 ${lines.join("\n")}`;
 }
 
-// src/sub-issue.ts
-function parseIssueRef(ref) {
-  const trimmed = ref.trim();
-  const url = trimmed.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)$/i);
-  if (url) return { repo: url[1], number: Number(url[2]) };
-  const qualified = trimmed.match(/^([^/\s#]+\/[^/\s#]+)#(\d+)$/);
-  if (qualified) return { repo: qualified[1], number: Number(qualified[2]) };
-  const bare = trimmed.match(/^#?(\d+)$/);
-  if (bare) return { number: Number(bare[1]) };
-  throw new Error(`invalid issue reference "${ref}" \u2014 expected #123, 123, owner/repo#123, or an issue URL`);
-}
-function buildResolveIdArgs(ref) {
-  const args = ["issue", "view", String(ref.number), "--json", "id", "--jq", ".id"];
-  if (ref.repo) args.push("--repo", ref.repo);
-  return args;
-}
-function buildAddSubIssueArgs(parentId, subIssueId) {
-  if (!parentId) throw new Error("addSubIssue: parentId is required");
-  if (!subIssueId) throw new Error("addSubIssue: subIssueId is required");
-  return [
-    "api",
-    "graphql",
-    "-f",
-    "query=mutation($p:ID!,$c:ID!){addSubIssue(input:{issueId:$p,subIssueId:$c}){issue{number subIssues{totalCount}} subIssue{number}}}",
-    "-f",
-    `p=${parentId}`,
-    "-f",
-    `c=${subIssueId}`
-  ];
-}
-function parseAddSubIssueResult(stdout) {
-  try {
-    const issue2 = JSON.parse(stdout)?.data?.addSubIssue;
-    const parentNumber = issue2?.issue?.number;
-    const subIssueNumber = issue2?.subIssue?.number;
-    const totalCount = issue2?.issue?.subIssues?.totalCount;
-    if (typeof parentNumber !== "number" || typeof subIssueNumber !== "number") return void 0;
-    return { parentNumber, subIssueNumber, totalCount: typeof totalCount === "number" ? totalCount : 0 };
-  } catch {
-    return void 0;
-  }
-}
-var RESOLVE_ID_TIMEOUT_MS = 1e4;
-async function resolveIssueNodeId(runGh, ref, fallbackRepo) {
-  const resolved = ref.repo ? ref : { ...ref, repo: fallbackRepo };
-  const id = (await runGh(buildResolveIdArgs(resolved), RESOLVE_ID_TIMEOUT_MS)).trim();
-  if (!id) throw new Error(`could not resolve node id for issue #${ref.number}${resolved.repo ? ` in ${resolved.repo}` : ""}`);
-  return id;
-}
-async function linkSubIssue(runGh, parentRef, childRef, defaultRepo) {
-  const parent = parseIssueRef(parentRef);
-  const child = parseIssueRef(childRef);
-  const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-  const subIssueId = await resolveIssueNodeId(runGh, child, defaultRepo);
-  const stdout = await runGh(buildAddSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
-  const result = parseAddSubIssueResult(stdout);
-  if (!result) throw new Error(`addSubIssue returned an unexpected response:
-${stdout.trim() || "(empty)"}`);
-  return result;
-}
-function parentLinkFields(result, error) {
-  if (result) return { parent: result };
-  if (error) return { parentLinkError: error };
-  return {};
-}
-
 // src/report.ts
 var HUB_REPO3 = "mutmutco/MMI-Hub";
 var REPORT_LABEL = "report";
@@ -13080,7 +13670,7 @@ ${buildReportBody(body, sourceRepo)}`;
 
 // src/skill-lesson.ts
 var SKILL_LESSON_LABEL = "skill-lesson";
-var SKILL_NAMES = ["bootstrap", "browser-automation", "build", "coop", "grind", "handoff", "hotfix", "mmi", "rcand", "release", "secrets", "stage"];
+var SKILL_NAMES = ["bootstrap", "browser-automation", "build", "coop", "grind", "handoff", "hotfix", "mmi", "overlord", "rcand", "release", "secrets", "stage"];
 function assertSkillName(name) {
   const match = SKILL_NAMES.find((skill) => skill === name);
   if (!match) throw new Error(`unknown skill "${name}" \u2014 expected one of: ${SKILL_NAMES.join(", ")}`);
@@ -13745,8 +14335,8 @@ async function runStageLiveDown(deps, t) {
 }
 
 // src/design-system.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path18 = require("node:path");
 var UI_PACKAGE_CANDIDATES = ["@mutmutco/ui-dashboard", "@mutmutco/ui", "@mutmutco/theme"];
 var DESIGN_SYSTEM_VERSION_LABEL = "@mutmutco design-system npm package (vs @latest)";
 function dashboardConsumerRegistryFix(error) {
@@ -13795,17 +14385,17 @@ function buildDesignSystemVersionCheck(input) {
 }
 function readJsonFile(path2) {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
 }
 function isUiFactoryCheckout(root) {
-  const pkg = readJsonFile((0, import_node_path17.join)(root, "package.json"));
+  const pkg = readJsonFile((0, import_node_path18.join)(root, "package.json"));
   return pkg?.name === "mmd-ui" && pkg?.private === true;
 }
 function resolveDeclaredUiPackage(root) {
-  const pkg = readJsonFile((0, import_node_path17.join)(root, "package.json"));
+  const pkg = readJsonFile((0, import_node_path18.join)(root, "package.json"));
   if (!pkg) return void 0;
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   for (const name of UI_PACKAGE_CANDIDATES) {
@@ -13815,8 +14405,8 @@ function resolveDeclaredUiPackage(root) {
   return void 0;
 }
 function readLockfileInstalledVersion(root, packageName) {
-  const lockPath = (0, import_node_path17.join)(root, "package-lock.json");
-  if (!(0, import_node_fs17.existsSync)(lockPath)) return void 0;
+  const lockPath = (0, import_node_path18.join)(root, "package-lock.json");
+  if (!(0, import_node_fs19.existsSync)(lockPath)) return void 0;
   const lock = readJsonFile(lockPath);
   const node = lock?.packages?.[`node_modules/${packageName}`];
   const version = node?.version?.trim();
@@ -13845,18 +14435,8 @@ function designSystemSnapshot(root) {
 
 // src/design-system-registry.ts
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs19 = require("node:fs");
-var import_node_path18 = require("node:path");
-
-// src/atomic-write.ts
-var import_node_fs18 = require("node:fs");
-function atomicWriteFileSync(path2, content) {
-  const tmp = `${path2}.${process.pid}.tmp`;
-  (0, import_node_fs18.writeFileSync)(tmp, content, "utf8");
-  (0, import_node_fs18.renameSync)(tmp, path2);
-}
-
-// src/design-system-registry.ts
+var import_node_fs20 = require("node:fs");
+var import_node_path19 = require("node:path");
 var DESIGN_SYSTEM_CACHE_DIR = ".mmi/design-system/components";
 var DESIGN_SYSTEM_MANIFEST_PATH = ".mmi/design-system/manifest.json";
 var REGISTRY_COMPONENTS_LABEL = "@mutmutco registry components (.mmi cache vs live registry)";
@@ -13864,13 +14444,13 @@ var REGISTRY_FIX = "run `mmi-cli doctor --apply` to pull registry components int
 var REGISTRY_UNREACHABLE_FIX = "live @mutmutco registry unreachable \u2014 verify `components.json` `@mutmutco` registry URL and network, then retry `mmi-cli doctor`";
 function readJsonFile2(path2) {
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
 }
 function readComponentsJson(root) {
-  return readJsonFile2((0, import_node_path18.join)(root, "components.json"));
+  return readJsonFile2((0, import_node_path19.join)(root, "components.json"));
 }
 function hasMutmutcoRegistry(root) {
   const url = readComponentsJson(root)?.registries?.["@mutmutco"];
@@ -13878,7 +14458,7 @@ function hasMutmutcoRegistry(root) {
 }
 function resolveCacheDir(root) {
   const custom = readComponentsJson(root)?.mmi?.cacheDir;
-  return (0, import_node_path18.join)(root, custom ?? DESIGN_SYSTEM_CACHE_DIR);
+  return (0, import_node_path19.join)(root, custom ?? DESIGN_SYSTEM_CACHE_DIR);
 }
 function resolveRegistryUrlTemplate(root) {
   return readComponentsJson(root)?.registries?.["@mutmutco"];
@@ -13887,7 +14467,7 @@ function registryItemUrl(template, name) {
   return template.replace("{name}", name);
 }
 function readDesignSystemManifest(root) {
-  const raw = readJsonFile2((0, import_node_path18.join)(root, DESIGN_SYSTEM_MANIFEST_PATH));
+  const raw = readJsonFile2((0, import_node_path19.join)(root, DESIGN_SYSTEM_MANIFEST_PATH));
   if (!raw || !Array.isArray(raw.components)) return void 0;
   return raw;
 }
@@ -13899,11 +14479,11 @@ function listInstalledRegistryComponents(root) {
   return scanCachedComponentNames(resolveCacheDir(root));
 }
 function scanCachedComponentNames(cacheDir) {
-  if (!(0, import_node_fs19.existsSync)(cacheDir)) return [];
+  if (!(0, import_node_fs20.existsSync)(cacheDir)) return [];
   const names = /* @__PURE__ */ new Set();
   const walk = (dir) => {
-    for (const ent of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
-      const p = (0, import_node_path18.join)(dir, ent.name);
+    for (const ent of (0, import_node_fs20.readdirSync)(dir, { withFileTypes: true })) {
+      const p = (0, import_node_path19.join)(dir, ent.name);
       if (ent.isDirectory()) walk(p);
       else if (ent.isFile() && /\.(tsx?|jsx?)$/.test(ent.name)) {
         names.add(ent.name.replace(/\.(tsx|ts|jsx|js)$/, ""));
@@ -13992,13 +14572,13 @@ async function gatherRegistryComponentsState(root, targetVersion, deps) {
     let componentStale = false;
     for (const file of item.files) {
       if (!file.target || file.content == null) continue;
-      const cachePath = (0, import_node_path18.join)(cacheDir, cacheRelativePath(file.target));
-      if (!(0, import_node_fs19.existsSync)(cachePath)) {
+      const cachePath = (0, import_node_path19.join)(cacheDir, cacheRelativePath(file.target));
+      if (!(0, import_node_fs20.existsSync)(cachePath)) {
         componentStale = true;
         break;
       }
       try {
-        if (contentHash((0, import_node_fs19.readFileSync)(cachePath, "utf8")) !== contentHash(file.content)) {
+        if (contentHash((0, import_node_fs20.readFileSync)(cachePath, "utf8")) !== contentHash(file.content)) {
           componentStale = true;
           break;
         }
@@ -14008,7 +14588,7 @@ async function gatherRegistryComponentsState(root, targetVersion, deps) {
       }
     }
     if (componentStale) {
-      if ((0, import_node_fs19.existsSync)((0, import_node_path18.join)(cacheDir, "ui", `${name}.tsx`)) || (0, import_node_fs19.existsSync)((0, import_node_path18.join)(cacheDir, `${name}.tsx`))) {
+      if ((0, import_node_fs20.existsSync)((0, import_node_path19.join)(cacheDir, "ui", `${name}.tsx`)) || (0, import_node_fs20.existsSync)((0, import_node_path19.join)(cacheDir, `${name}.tsx`))) {
         stale.push(name);
       } else {
         missing.push(name);
@@ -14036,15 +14616,15 @@ async function applyRegistryComponentsSync(root, components, targetVersion, log,
     if (!item) return { ok: false };
     for (const file of item.files) {
       if (!file.target || file.content == null) continue;
-      const outPath = (0, import_node_path18.join)(cacheDir, cacheRelativePath(file.target));
-      deps.mkdir((0, import_node_path18.dirname)(outPath));
+      const outPath = (0, import_node_path19.join)(cacheDir, cacheRelativePath(file.target));
+      deps.mkdir((0, import_node_path19.dirname)(outPath));
       const body = file.content.endsWith("\n") ? file.content : `${file.content}
 `;
       deps.writeFile(outPath, body);
     }
   }
-  const manifestPath = (0, import_node_path18.join)(root, DESIGN_SYSTEM_MANIFEST_PATH);
-  deps.mkdir((0, import_node_path18.dirname)(manifestPath));
+  const manifestPath = (0, import_node_path19.join)(root, DESIGN_SYSTEM_MANIFEST_PATH);
+  deps.mkdir((0, import_node_path19.dirname)(manifestPath));
   const manifest = {
     version: targetVersion,
     syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -14059,7 +14639,7 @@ function defaultRegistrySyncDeps() {
   return {
     fetch,
     writeFile: (path2, content) => atomicWriteFileSync(path2, content),
-    mkdir: (path2) => (0, import_node_fs19.mkdirSync)(path2, { recursive: true })
+    mkdir: (path2) => (0, import_node_fs20.mkdirSync)(path2, { recursive: true })
   };
 }
 
@@ -14085,12 +14665,12 @@ function renderVerifySecrets(body) {
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git = options.git ?? ((args, opts) => (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -14813,8 +15393,8 @@ async function announceRelease(deps, args) {
 }
 
 // src/port-registry.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_path20 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -14828,8 +15408,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs20.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs21.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs21.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -14843,9 +15423,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs20.existsSync)(path2) ? JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs21.existsSync)(path2) ? JSON.parse((0, import_node_fs21.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs20.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs21.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -14867,18 +15447,18 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path19.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path19.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs20.existsSync)(registryPath) || !(0, import_node_fs20.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path20.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path20.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs21.existsSync)(registryPath) || !(0, import_node_fs21.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path19.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path19.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path20.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path20.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path19.dirname)(dir);
+    const parent = (0, import_node_path20.dirname)(dir);
     if (parent === dir) return null;
   }
 }
@@ -16592,8 +17172,12 @@ function resolveKbSource(rawBase) {
   if (!m) return DEFAULT_KB;
   return { owner: m[1], repo: m[2], ref: m[3] };
 }
-function buildKbGetArgs(src, path2) {
+function normalizeKbPath(path2) {
   const clean4 = path2.replace(/^\/+/, "");
+  return clean4 === "kb" || clean4.startsWith("kb/") ? clean4 : `kb/${clean4}`;
+}
+function buildKbGetArgs(src, path2) {
+  const clean4 = normalizeKbPath(path2);
   return ["api", `repos/${src.owner}/${src.repo}/contents/${clean4}?ref=${src.ref}`, "-H", "Accept: application/vnd.github.raw"];
 }
 function buildKbTreeArgs(src) {
@@ -16606,20 +17190,20 @@ function parseKbTree(stdout, prefix) {
   } catch {
     return [];
   }
-  const pre = prefix ? prefix.replace(/^\/+/, "") : void 0;
-  return tree.filter((t) => t.type === "blob" && typeof t.path === "string" && t.path.startsWith("kb/")).map((t) => t.path).filter((p) => pre ? p.startsWith(pre) : true).sort();
+  const pre = prefix ? normalizeKbPath(prefix) : void 0;
+  return tree.filter((t) => t.type === "blob" && typeof t.path === "string" && t.path.startsWith("kb/") && !t.path.split("/").some((s) => s.startsWith("."))).map((t) => t.path).filter((p) => pre ? p.startsWith(pre) : true).sort();
 }
 
 // src/northstar-commands.ts
-var import_node_fs21 = require("node:fs");
-var import_node_child_process11 = require("node:child_process");
+var import_node_fs22 = require("node:fs");
+var import_node_child_process12 = require("node:child_process");
 var import_promises6 = require("node:fs/promises");
 var planSyncDetached = false;
 function detachPlanSync() {
   if (planSyncDetached) return;
   planSyncDetached = true;
   try {
-    (0, import_node_child_process11.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
+    (0, import_node_child_process12.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -16629,7 +17213,7 @@ function detachPlanSync() {
   }
 }
 function makePlanDeps(cfg, io = consoleIo) {
-  const ensureDir = () => (0, import_node_fs21.mkdirSync)(PLANS_DIR, { recursive: true });
+  const ensureDir = () => (0, import_node_fs22.mkdirSync)(PLANS_DIR, { recursive: true });
   return {
     apiUrl: cfg.sagaApiUrl,
     fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
@@ -16637,31 +17221,31 @@ function makePlanDeps(cfg, io = consoleIo) {
     project: async () => (await sagaKey(cfg)).project,
     readLocal: (slug) => {
       try {
-        return (0, import_node_fs21.readFileSync)(planPath(slug), "utf8");
+        return (0, import_node_fs22.readFileSync)(planPath(slug), "utf8");
       } catch {
         return null;
       }
     },
     listLocalSlugs: () => {
       try {
-        return (0, import_node_fs21.readdirSync)(PLANS_DIR, { withFileTypes: true }).filter((entry) => entry.isFile() && /^[A-Za-z0-9][A-Za-z0-9_-]*\.md$/.test(entry.name)).map((entry) => entry.name.replace(/\.md$/, ""));
+        return (0, import_node_fs22.readdirSync)(PLANS_DIR, { withFileTypes: true }).filter((entry) => entry.isFile() && /^[A-Za-z0-9][A-Za-z0-9_-]*\.md$/.test(entry.name)).map((entry) => entry.name.replace(/\.md$/, ""));
       } catch {
         return [];
       }
     },
     writeLocal: (slug, content) => {
       ensureDir();
-      (0, import_node_fs21.writeFileSync)(planPath(slug), content, "utf8");
+      (0, import_node_fs22.writeFileSync)(planPath(slug), content, "utf8");
     },
     removeLocal: (slug) => {
       try {
-        (0, import_node_fs21.rmSync)(planPath(slug));
+        (0, import_node_fs22.rmSync)(planPath(slug));
       } catch {
       }
     },
     readMetaRaw: () => {
       try {
-        return (0, import_node_fs21.readFileSync)(META_FILE, "utf8");
+        return (0, import_node_fs22.readFileSync)(META_FILE, "utf8");
       } catch {
         return null;
       }
@@ -16672,7 +17256,7 @@ function makePlanDeps(cfg, io = consoleIo) {
     },
     readIndexRaw: () => {
       try {
-        return (0, import_node_fs21.readFileSync)(INDEX_FILE, "utf8");
+        return (0, import_node_fs22.readFileSync)(INDEX_FILE, "utf8");
       } catch {
         return null;
       }
@@ -16683,7 +17267,7 @@ function makePlanDeps(cfg, io = consoleIo) {
     },
     readQueueRaw: () => {
       try {
-        return (0, import_node_fs21.readFileSync)(QUEUE_FILE, "utf8");
+        return (0, import_node_fs22.readFileSync)(QUEUE_FILE, "utf8");
       } catch {
         return null;
       }
@@ -16705,7 +17289,7 @@ function openInEditor(path2) {
     return;
   }
   try {
-    (0, import_node_child_process11.spawn)(editor, [path2], { stdio: "inherit" });
+    (0, import_node_child_process12.spawn)(editor, [path2], { stdio: "inherit" });
   } catch {
     console.log(`open ${path2} manually`);
   }
@@ -16743,7 +17327,7 @@ function repoInfoFromRemote(remote) {
 }
 function readStageUrl() {
   try {
-    const state = JSON.parse((0, import_node_fs21.readFileSync)("tmp/stage/state.json", "utf8"));
+    const state = JSON.parse((0, import_node_fs22.readFileSync)("tmp/stage/state.json", "utf8"));
     if (typeof state.url === "string" && state.url.trim()) return state.url.trim();
     if (typeof state.port === "number" && Number.isFinite(state.port)) return `http://127.0.0.1:${state.port}/`;
     if (typeof state.healthUrl === "string" && state.healthUrl.trim()) {
@@ -17483,8 +18067,8 @@ async function secretsUse(deps, key, opts) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path21 = require("node:path");
 var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
 var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
@@ -17492,18 +18076,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path20.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path21.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path20.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path20.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path21.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path21.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs22.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs22.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs23.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs23.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -17628,7 +18212,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs22.unlinkSync)((0, import_node_path20.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs23.unlinkSync)((0, import_node_path21.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -17804,10 +18388,11 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/doctor-run.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
+var import_node_child_process14 = require("node:child_process");
 var import_promises7 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
-var import_node_os5 = require("node:os");
+var import_node_path25 = require("node:path");
+var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
@@ -17827,10 +18412,10 @@ function buildGuardSessionStartLine(state, opts = {}) {
 }
 
 // src/cursor-plugin-seed.ts
-var import_node_child_process12 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path21 = require("node:path");
+var import_node_child_process13 = require("node:child_process");
+var import_node_fs24 = require("node:fs");
+var import_node_os5 = require("node:os");
+var import_node_path22 = require("node:path");
 var import_node_util7 = require("node:util");
 function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
@@ -17838,7 +18423,7 @@ function isSemverVersion(v) {
 var MMI_HUB_REPO = "mutmutco/MMI-Hub";
 var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
 var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
-var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process12.execFile);
+var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process13.execFile);
 function gitFetchReleaseTagArgs(hubCheckout, tag) {
   return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
 }
@@ -17847,17 +18432,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path21.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path21.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base = process.env.APPDATA || (0, import_node_path22.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path22.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path21.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path22.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path21.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs23.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs24.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -17871,57 +18456,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs23.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs23.readdirSync)(dest)) {
-    (0, import_node_fs23.rmSync)((0, import_node_path21.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs24.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs24.readdirSync)(dest)) {
+    (0, import_node_fs24.rmSync)((0, import_node_path22.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs23.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs24.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path21.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path22.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path21.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs23.existsSync)((0, import_node_path21.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path22.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs24.existsSync)((0, import_node_path22.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path21.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path22.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs23.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs24.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs23.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs24.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs23.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs24.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path21.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs23.existsSync)((0, import_node_path21.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path22.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs24.existsSync)((0, import_node_path22.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs23.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs24.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path21.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path22.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -17942,7 +18527,7 @@ async function applyCursorPluginCacheSeed(input) {
   for (const pin of pinsToSeed) {
     syncDirContents(source, pin.path);
   }
-  (0, import_node_fs23.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs24.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
 
@@ -18269,6 +18854,30 @@ function buildNestedPluginTreeCheck(input) {
     fix: `${nested.length} self-nested MMI plugin cache tree(s) (#1126) exceed MAX_PATH and can't self-clean \u2014 run: ${nestedPluginTreeCleanupCommand(nested.map((n) => n.path), input.isWindows)}`
   };
 }
+var CODEX_ACTIVE_CACHE_LABEL = "Codex active plugin cache (vs latest release)";
+function buildCodexActiveCacheCheck(input) {
+  const base = {
+    ok: true,
+    label: CODEX_ACTIVE_CACHE_LABEL,
+    fix: CODEX_PLUGIN_RECOVERY
+  };
+  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
+  if (isSemverVersion2(input.codexRecordVersion) && compareVersions(input.codexRecordVersion, input.releasedVersion) < 0) {
+    return base;
+  }
+  const activeCacheVersion = highestSemver(input.codexCacheVersions ?? []);
+  const cacheCurrent = isSemverVersion2(activeCacheVersion) && compareVersions(activeCacheVersion, input.releasedVersion) >= 0;
+  if (cacheCurrent) {
+    return { ...base, activeCacheVersion, releasedVersion: input.releasedVersion };
+  }
+  return {
+    ...base,
+    ok: false,
+    activeCacheVersion,
+    releasedVersion: input.releasedVersion,
+    fix: `Codex active plugin cache is ${activeCacheVersion ?? "missing the released version"} < ${input.releasedVersion} while the installed record is current \u2014 run \`mmi-cli doctor --apply\` (forces the Codex reinstall when \`codex\` is on PATH; restart Codex after), or manually: ${CODEX_PLUGIN_RECOVERY}`
+  };
+}
 function detectSurface(env) {
   const has = (k) => Boolean(env[k]?.trim());
   if (env.MMI_AGENT_SURFACE === "codex" || has("CODEX_HOME") || (env.CLAUDE_PLUGIN_ROOT ?? "").includes(".codex")) {
@@ -18397,6 +19006,25 @@ var CODEX_PLUGIN_HEAL_STEPS = PLUGIN_SURFACE_HEAL.codex.healSteps;
 function healStepAborts(step, ok) {
   return !ok && step.gated;
 }
+function marketplaceAddSupportsRef(helpText) {
+  if (!helpText) return false;
+  return /(^|\s)--ref(\b|=)/.test(helpText);
+}
+function adaptHealStepsForRefSupport(steps, refSupported) {
+  if (refSupported) return { steps: [...steps], strippedRef: false };
+  let strippedRef = false;
+  const adapted = steps.map((step) => {
+    const refIdx = step.args.indexOf("--ref");
+    const isAdd = step.args.includes("marketplace") && step.args.includes("add");
+    if (!isAdd || refIdx === -1) return step;
+    strippedRef = true;
+    return { ...step, args: [...step.args.slice(0, refIdx), ...step.args.slice(refIdx + 2)] };
+  });
+  return { steps: adapted, strippedRef };
+}
+function recoveryWithoutRef(recovery) {
+  return recovery.replace(/ --ref \S+/g, "");
+}
 function pluginRecoveryFix(surface) {
   const token = surfaceToken(surface);
   if (token) return PLUGIN_SURFACE_HEAL[token].fix(surface);
@@ -18737,7 +19365,7 @@ function cursorPluginInstallFix(input) {
   const cacheDir = joinCachePath(input.cacheRoot, pin);
   const autoSeed = "run `mmi-cli doctor --apply` to seed plugins/mmi from the latest release into the active pin";
   const localSeed = input.hubCheckout ? `temporary fallback: copy ${joinCachePath(input.hubCheckout, "plugins", "mmi")} to ${cacheDir}, then restart Cursor` : `temporary fallback: copy plugins/mmi from a local MMI-Hub checkout to ${cacheDir}, then restart Cursor`;
-  return `Cursor plugin cache at ${cacheDir} is empty or missing ${CURSOR_PLUGIN_JSON_REL} or ${CURSOR_HOOKS_JSON_REL} \u2014 ${autoSeed}; ${marketplaceRefresh}; ${authSteps}; ${localSeed}; ${logHint}; ${guide}`;
+  return `Cursor plugin cache at ${cacheDir} is empty or missing ${CURSOR_PLUGIN_JSON_REL}, ${CURSOR_HOOKS_JSON_REL}, or the shell-dialect guard scripts \u2014 ${autoSeed}; ${marketplaceRefresh}; ${authSteps}; ${localSeed}; ${logHint}; ${guide}`;
 }
 function buildCursorPluginInstallCheck(input) {
   const base = {
@@ -18759,7 +19387,7 @@ function buildCursorPluginInstallCheck(input) {
     };
   }
   for (const pin of input.pins) {
-    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty) {
+    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.hasShellDialectGuard === false || pin.isEmpty) {
       return {
         ...base,
         ok: false,
@@ -18976,6 +19604,22 @@ function buildSelfUpdateHaltPayload(input) {
     checks: input.checks
   };
 }
+var DOCTOR_POST_SELF_UPDATE_ENV = "MMI_DOCTOR_POST_SELF_UPDATE";
+function buildSelfUpdateReexecArgs(opts) {
+  const args = ["doctor"];
+  if (opts.banner) args.push("--banner");
+  if (opts.preflight) args.push("--preflight");
+  if (opts.verbose) args.push("--verbose");
+  if (opts.guide) args.push("--guide");
+  if (opts.json) args.push("--json");
+  if (opts.apply) args.push("--apply");
+  if (opts.noRepoWrites) args.push("--no-repo-writes");
+  return args;
+}
+function selfUpdateReexecLine(report) {
+  const to = report.releasedVersion ?? "latest";
+  return `\u21BB mmi-cli updated \u2192 ${to}. Re-running \`mmi-cli doctor\` under the new CLI\u2026`;
+}
 function preflightOutcome(input) {
   if (input.gaps.length) {
     return { healed: false, line: `\u26A0 MMI preflight: ${input.gaps.length} item(s) still need attention \u2014 ${input.gaps.map((g) => g.fix).join(" \xB7 ")}` };
@@ -19051,16 +19695,16 @@ function buildPluginResolvabilityCheck(input) {
 }
 
 // src/kb-drift-report.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path23 = require("node:path");
 function yesterdayIso() {
   const d = /* @__PURE__ */ new Date();
   d.setUTCDate(d.getUTCDate() - 1);
   return d.toISOString().slice(0, 10);
 }
 async function fetchLatestKbDriftReport(execFileP5, repoRoot) {
-  const sagaIo = (0, import_node_path22.join)(repoRoot, "infra", "saga-io.mjs");
-  if (!(0, import_node_fs24.existsSync)(sagaIo)) return null;
+  const sagaIo = (0, import_node_path23.join)(repoRoot, "infra", "saga-io.mjs");
+  if (!(0, import_node_fs25.existsSync)(sagaIo)) return null;
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   for (const date of [today, yesterdayIso()]) {
     try {
@@ -19076,9 +19720,9 @@ async function fetchLatestKbDriftReport(execFileP5, repoRoot) {
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
 var import_node_fs26 = require("node:fs");
+var import_node_path24 = require("node:path");
+var import_node_fs27 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -19124,7 +19768,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path23.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path24.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -19144,18 +19788,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path23.isAbsolute)(raw) ? raw : (0, import_node_path23.resolve)(worktreePath, raw);
+  return (0, import_node_path24.isAbsolute)(raw) ? raw : (0, import_node_path24.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs26.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs27.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs25.readFileSync)((0, import_node_path23.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path23.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path23.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path23.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs26.readFileSync)((0, import_node_path24.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path24.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path24.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path24.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -19165,7 +19809,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs26.statSync)(path2);
+    (0, import_node_fs27.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -19174,10 +19818,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path23.join)(path2, ".git");
+  const gitPath = (0, import_node_path24.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs26.lstatSync)(gitPath);
+    st = (0, import_node_fs27.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -19194,7 +19838,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs25.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs26.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -19211,7 +19855,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs26.readdirSync)(path2) };
+    return { entries: (0, import_node_fs27.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -19230,8 +19874,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs26.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path23.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs27.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path24.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -19281,7 +19925,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -19382,6 +20026,21 @@ var CLAUDE_PLUGIN_TIMEOUT_MS = 12e4;
 function runHostBin(bin, args, opts) {
   return isWin ? execFileP2("cmd.exe", ["/c", bin, ...args], opts) : execFileP2(bin, args, opts);
 }
+function reexecMmiCli(args) {
+  return new Promise((resolve6) => {
+    let settled = false;
+    const done = (code) => {
+      if (!settled) {
+        settled = true;
+        resolve6(code);
+      }
+    };
+    const env = { ...process.env, [DOCTOR_POST_SELF_UPDATE_ENV]: "1" };
+    const child = isWin ? (0, import_node_child_process14.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", env }) : (0, import_node_child_process14.spawn)("mmi-cli", args, { stdio: "inherit", env });
+    child.on("error", () => done(-1));
+    child.on("exit", (code) => done(code ?? 0));
+  });
+}
 function hostBinAvailable(bin) {
   return execFileP2(isWin ? "where" : "which", [bin]).then(() => true).catch(() => false);
 }
@@ -19401,15 +20060,32 @@ async function runCodexPlugin(args) {
     return false;
   }
 }
+async function marketplaceAddRefSupported(bin) {
+  try {
+    const { stdout, stderr } = await runHostBin(bin, ["plugin", "marketplace", "add", "--help"], {
+      timeout: CLAUDE_PLUGIN_TIMEOUT_MS
+    });
+    return marketplaceAddSupportsRef(`${stdout}
+${stderr}`);
+  } catch {
+    return false;
+  }
+}
 async function applyPluginHeal(token, surface, log, opts) {
   if (!opts?.force && surfaceToken(surface) !== token) return false;
   const descriptor = PLUGIN_SURFACE_HEAL[token];
-  const steps = descriptor.healSteps;
-  if (!steps) return false;
+  const tableSteps = descriptor.healSteps;
+  if (!tableSteps) return false;
+  const bin = descriptor.pluginRunner === "codex" ? "codex" : "claude";
   const runner = descriptor.pluginRunner === "codex" ? runCodexPlugin : runClaudePlugin;
+  const refSupported = await marketplaceAddRefSupported(bin);
+  const { steps, strippedRef } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   log(
-    token === "codex" ? "  \u21BB reinstalling the MMI plugin via `codex plugin` (marketplace remove \u2192 add --ref main \u2192 add)\u2026" : "  \u21BB reinstalling the MMI plugin via `claude plugin` (marketplace remove \u2192 add \u2192 install)\u2026"
+    refSupported ? `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add --ref main \u2192 ${token === "codex" ? "add" : "install"})\u2026` : `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add \u2192 ${token === "codex" ? "add" : "install"})\u2026`
   );
+  if (strippedRef) {
+    log(`  \u26A0 \`${bin}\` has no \`--ref\` option \u2014 cloning the default branch; update \`${bin}\` to pin the released \`main\` branch (#2080)`);
+  }
   for (const step of steps) {
     if (healStepAborts(step, await runner([...step.args]))) return false;
   }
@@ -19417,11 +20093,11 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs28.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -19432,15 +20108,15 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
-    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
+    pluginCachePresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path24.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path25.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs27.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs28.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -19448,7 +20124,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -19470,7 +20146,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs27.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs28.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19483,9 +20159,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs28.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs28.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19493,22 +20169,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".config", "opencode");
+  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path24.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path25.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path24.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path25.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path24.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path25.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs27.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs28.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs27.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs28.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -19531,9 +20207,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan2 = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan2.action === "already") return true;
     if (!plan2.text || plan2.action === "unsafe") return false;
-    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs27.writeFileSync)(path2, plan2.text, "utf8");
+    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs28.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs28.writeFileSync)(path2, plan2.text, "utf8");
     return true;
   } catch {
     return false;
@@ -19548,9 +20224,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs27.existsSync)(snapshot.path)) (0, import_node_fs27.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs27.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs28.existsSync)(snapshot.path)) (0, import_node_fs28.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs28.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -19559,7 +20235,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs27.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs28.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -19567,9 +20243,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs27.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs28.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs27.writeFileSync)((0, import_node_path24.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs28.writeFileSync)((0, import_node_path25.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -19578,12 +20254,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path24.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path25.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs28.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -19599,7 +20275,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs27.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs28.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -19614,30 +20290,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path24.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path24.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path25.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path25.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path24.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path25.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path24.join)(root, entry.name)).sort((a, b) => (0, import_node_fs27.statSync)(b).mtimeMs - (0, import_node_fs27.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path25.join)(root, entry.name)).sort((a, b) => (0, import_node_fs28.statSync)(b).mtimeMs - (0, import_node_fs28.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path24.join)(newest, "renderer.log");
-    const text = (0, import_node_fs27.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs27.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path25.join)(newest, "renderer.log");
+    const text = (0, import_node_fs28.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs28.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs27.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs28.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -19649,43 +20325,46 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs27.existsSync)(backupPath)) return false;
-    (0, import_node_fs27.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs28.existsSync)(backupPath)) return false;
+    (0, import_node_fs28.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path24.join)(root, entry.name);
-      const pluginJson = (0, import_node_path24.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path24.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path24.join)(path2, "cli", "dist", "index.cjs");
+    return (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path25.join)(root, entry.name);
+      const pluginJson = (0, import_node_path25.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path25.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path25.join)(path2, "cli", "dist", "index.cjs");
+      const throttleGateCursor = (0, import_node_path25.join)(path2, "scripts", "throttle-gate-cursor.mjs");
+      const throttleCore = (0, import_node_path25.join)(path2, "scripts", "throttle-core.mjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs27.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs28.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs27.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs28.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs27.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs27.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs27.existsSync)(cliBundle),
+        hasPluginJson: (0, import_node_fs28.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs28.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs28.existsSync)(cliBundle),
+        hasShellDialectGuard: (0, import_node_fs28.existsSync)(throttleGateCursor) && (0, import_node_fs28.existsSync)(throttleCore),
         isEmpty,
         version
       };
@@ -19695,19 +20374,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path24.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs27.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path25.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs28.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path24.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path24.join)(root, entry.name),
+        path: (0, import_node_path25.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -19718,7 +20397,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs27.statSync)((0, import_node_path24.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs28.statSync)((0, import_node_path25.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -19729,10 +20408,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs27.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs28.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs27.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs28.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -19741,10 +20420,10 @@ function quarantinePluginCacheDirs(plan2) {
   const failed = [];
   for (const move of plan2) {
     try {
-      if (!(0, import_node_fs27.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs28.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(target), { recursive: true });
-      (0, import_node_fs27.renameSync)(move.from, target);
+      (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(target), { recursive: true });
+      (0, import_node_fs28.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -19763,23 +20442,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs27.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs28.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path24.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs27.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path25.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs28.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs27.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs28.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs27.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs28.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs27.existsSync)(targetPath);
+      return !(0, import_node_fs28.existsSync)(targetPath);
     }
-    (0, import_node_fs27.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs27.existsSync)(targetPath);
+    (0, import_node_fs28.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs28.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -19792,23 +20471,23 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path24.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path25.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs27.existsSync)(path2)) return null;
-    return (0, import_node_fs27.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs28.existsSync)(path2)) return null;
+    return (0, import_node_fs28.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
-  const home = (0, import_node_os5.homedir)();
+  const home = (0, import_node_os6.homedir)();
   const candidates = [
-    (0, import_node_path24.join)(cwd, ".mcp.json"),
-    (0, import_node_path24.join)(cwd, ".cursor", "mcp.json"),
-    (0, import_node_path24.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path24.join)(home, ".codex", "config.toml")
+    (0, import_node_path25.join)(cwd, ".mcp.json"),
+    (0, import_node_path25.join)(cwd, ".cursor", "mcp.json"),
+    (0, import_node_path25.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path25.join)(home, ".codex", "config.toml")
   ];
   const out = [];
   for (const path2 of candidates) {
@@ -19821,7 +20500,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs27.existsSync)((0, import_node_path24.join)(cwd, rel));
+      return (0, import_node_fs28.existsSync)((0, import_node_path25.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -19840,8 +20519,8 @@ function latestIso(values) {
   return best;
 }
 function latestNorthstarContinuityAt() {
-  const meta = parseMeta(readTextFile((0, import_node_path24.join)(process.cwd(), META_FILE)));
-  const queue = parseQueue(readTextFile((0, import_node_path24.join)(process.cwd(), QUEUE_FILE)));
+  const meta = parseMeta(readTextFile((0, import_node_path25.join)(process.cwd(), META_FILE)));
+  const queue = parseQueue(readTextFile((0, import_node_path25.join)(process.cwd(), QUEUE_FILE)));
   return latestIso([
     ...Object.values(meta).map((entry) => entry.syncedAt),
     ...queue.map((entry) => entry.queuedAt)
@@ -19855,14 +20534,14 @@ async function latestBranchWorkAt() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs27.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs28.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs27.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs28.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -19901,7 +20580,7 @@ async function runDoctor(opts, io = consoleIo) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs27.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs28.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
@@ -19936,7 +20615,7 @@ async function runDoctor(opts, io = consoleIo) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs27.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs28.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -19950,7 +20629,7 @@ async function runDoctor(opts, io = consoleIo) {
     releasedVersion
   });
   let selfUpdatedCli = false;
-  if (repairFull) {
+  if (repairFull && !process.env[DOCTOR_POST_SELF_UPDATE_ENV]) {
     const updated = await applyVersionAutoUpdate(versionReport, (m) => io.err(m));
     versionReport = updated.report;
     selfUpdatedCli = updated.applied === "npm";
@@ -19958,6 +20637,12 @@ async function runDoctor(opts, io = consoleIo) {
   if (!versionReport.ok) versionReport = { ...versionReport, fix: pluginRecoveryFix(surface) };
   checks.push(versionReport);
   if (selfUpdatedCli) {
+    if (!opts.json) io.err(selfUpdateReexecLine(versionReport));
+    const code = await reexecMmiCli(buildSelfUpdateReexecArgs(opts));
+    if (code >= 0) {
+      if (code > 0) process.exitCode = code;
+      return;
+    }
     if (opts.json) io.log(JSON.stringify(buildSelfUpdateHaltPayload({ checks, updatedTo: versionReport.releasedVersion }), null, 2));
     else io.err(selfUpdateHaltLine(versionReport));
     return;
@@ -20209,6 +20894,11 @@ async function runDoctor(opts, io = consoleIo) {
     }
     checks.push(legacyOpenCodeCheck);
   }
+  const codexRecordVersion = () => {
+    const versions = installedPluginVersions(installedPluginSources().find((src) => src.surface === "codex")?.installed ?? null).filter((v) => /^v?\d+\.\d+\.\d+/.test(v));
+    return versions.sort((a, b) => compareVersions(b, a))[0];
+  };
+  const codexCacheVersions = () => mmiPluginCacheRootSnapshots().filter((r) => r.surface === "codex").flatMap((r) => r.entries.filter((e) => e.isDirectory).map((e) => e.name));
   let cacheCleanupCheck = buildMmiPluginCacheCleanupCheck({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     roots: mmiPluginCacheRootSnapshots(),
@@ -20240,6 +20930,26 @@ async function runDoctor(opts, io = consoleIo) {
     };
   }
   checks.push(cacheCleanupCheck);
+  let codexActiveCacheCheck = buildCodexActiveCacheCheck({
+    isOrgRepo: Boolean(cfg.sagaApiUrl),
+    releasedVersion,
+    codexCacheVersions: codexCacheVersions(),
+    codexRecordVersion: codexRecordVersion()
+  });
+  if (!codexActiveCacheCheck.ok && repairFull) {
+    const canDriveCodex = surfaceToken(surface) === "codex" || await hostBinAvailable("codex");
+    if (canDriveCodex && await applyPluginHeal("codex", surface, (m) => io.err(m), { force: true })) {
+      markPluginReloadRequired();
+      io.err(`  \u21BB restored Codex MMI plugin cache \u2192 ${releasedVersion ?? "latest"} via codex plugin \u2014 ${reloadAction("codex")} to load the new commands`);
+      codexActiveCacheCheck = buildCodexActiveCacheCheck({
+        isOrgRepo: Boolean(cfg.sagaApiUrl),
+        releasedVersion,
+        codexCacheVersions: codexCacheVersions(),
+        codexRecordVersion: codexRecordVersion()
+      });
+    }
+  }
+  checks.push(codexActiveCacheCheck);
   let nestedPluginTreeCheck = buildNestedPluginTreeCheck({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     isWindows: isWin,
@@ -20274,7 +20984,7 @@ async function runDoctor(opts, io = consoleIo) {
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
     cacheRoot: cursorCacheRoot,
-    cacheRootExists: (0, import_node_fs27.existsSync)(cursorCacheRoot),
+    cacheRootExists: (0, import_node_fs28.existsSync)(cursorCacheRoot),
     pins: cursorPins,
     hubCheckout: hubCheckoutForCursorSeed(),
     releasedVersion
@@ -20285,7 +20995,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path24.join)((0, import_node_os5.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path25.join)((0, import_node_os6.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -20294,7 +21004,7 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         surface,
         cacheRoot: cursorCacheRoot,
-        cacheRootExists: (0, import_node_fs27.existsSync)(cursorCacheRoot),
+        cacheRootExists: (0, import_node_fs28.existsSync)(cursorCacheRoot),
         pins: cursorPins,
         hubCheckout: hubCheckoutForCursorSeed(),
         releasedVersion
@@ -20483,23 +21193,23 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path24.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path25.join)((0, import_node_os6.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs27.existsSync)(path2)) {
+    if ((0, import_node_fs28.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs28.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs27.existsSync)(path2)) (0, import_node_fs27.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs28.existsSync)(path2)) (0, import_node_fs28.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs28.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
@@ -20533,8 +21243,13 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
   if (healed) {
     console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI commands`);
   } else {
+    const bin = descriptor.pluginRunner === "codex" ? "codex" : "claude";
+    const refSupported = await marketplaceAddRefSupported(bin);
+    const recovery = refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
+    const note = refSupported ? "" : `
+  Note: \`${bin}\` has no \`--ref\` option here; update \`${bin}\` to pin the released \`main\` branch.`;
     console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
-  ${descriptor.recovery}`);
+  ${recovery}${note}`);
   }
 }
 
@@ -20629,7 +21344,7 @@ async function applyGcPlan(plan2, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs29.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20652,7 +21367,7 @@ async function applyGcPlan(plan2, remote) {
   for (const wt of plan2.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs28.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs29.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -20732,10 +21447,10 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs28.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs29.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs28.mkdirSync)(file.slice(0, slash), { recursive: true });
+      if (slash > 0) (0, import_node_fs29.mkdirSync)(file.slice(0, slash), { recursive: true });
       await (0, import_promises8.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
@@ -20749,13 +21464,13 @@ rules.command("sync").option("--quiet", "stay silent unless something changed or
   if (!await runRulesSync(opts)) process.exitCode = 1;
 });
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path25.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path26.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null;
   const plan2 = planManagedGitignore(current);
   const drift = [...plan2.added.map((l) => `+${l}`), ...plan2.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan2.changed) {
-      (0, import_node_fs28.writeFileSync)(path2, plan2.content, "utf8");
+      (0, import_node_fs29.writeFileSync)(path2, plan2.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -20782,7 +21497,7 @@ async function runDocsSync(opts, io = consoleIo) {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs28.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs29.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
       await (0, import_promises8.writeFile)(f, c, "utf8");
     }
@@ -20796,6 +21511,7 @@ docs.command("sync").option("--quiet", "stay silent unless something changed or
 registerSagaCommands(program2);
 registerHandoffCommands(program2);
 registerCoopCommands(program2);
+registerOverlordCommands(program2);
 registerThrottleCommands(program2);
 program2.command("commands").description("print the command manifest \u2014 every subcommand + its flags (ground against this instead of guessing)").option("--json", "machine-readable JSON: { name, version, tree, index } \u2014 index is a flat list of every leaf command path").action((o) => {
   const manifest = buildCommandManifest(program2);
@@ -20934,7 +21650,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve6, reject) => {
-    const child = (0, import_node_child_process13.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child = (0, import_node_child_process15.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -20956,7 +21672,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path25.dirname)(out) : void 0;
+    return out ? (0, import_node_path26.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -20969,28 +21685,28 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
   };
 }
 function acquireWorktreeSetupLock(worktreeRoot) {
-  const lockPath = (0, import_node_path25.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
+  const lockPath = (0, import_node_path26.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs28.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs29.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs28.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs29.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs28.closeSync)(fd);
+      (0, import_node_fs29.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs28.rmSync)(lockPath, { force: true });
+        (0, import_node_fs29.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs28.mkdirSync)((0, import_node_path25.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs29.mkdirSync)((0, import_node_path26.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs28.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs28.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs29.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs29.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -21152,7 +21868,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process13.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process15.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -21680,6 +22396,29 @@ issue.command("link-child <parent> <child>").description("link an existing issue
     return fail(`issue link-child: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
   }
 });
+issue.command("comment <ref>").description("post a Markdown comment to an issue and print {number,repo,url,commentUrl} JSON").option("--body <body>", "comment body (markdown; prefer --body-file for multiline Markdown)").option("--body-file <path|->", "read comment body from a UTF-8 file, or from stdin with -").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)").action(async (ref, o) => {
+  let parsed;
+  try {
+    parsed = parseIssueRef(ref);
+  } catch (e) {
+    return fail(`issue comment: ${e.message}`);
+  }
+  let body;
+  try {
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+  } catch (e) {
+    return fail(`issue comment: ${e.message}`);
+  }
+  const repo = await resolveRepo(parsed.repo ?? o.repo);
+  if (!repo) return fail("issue comment: could not resolve repo \u2014 pass --repo owner/repo");
+  try {
+    const result = await postIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, body });
+    console.log(JSON.stringify(result));
+  } catch (e) {
+    const err = e;
+    return fail(`issue comment: ${(err.stderr || err.message || String(e)).trim()}`);
+  }
+});
 issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match \u2014 exact item text, else a unique substring").option("--off", "untick the item ([x] \u2192 [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)").action(async (ref, o) => {
   let parsed;
   try {
@@ -21994,9 +22733,9 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   console.log(JSON.stringify(created));
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path25.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs28.existsSync)(wfDir)) return [];
-  return (0, import_node_fs28.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path26.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs29.existsSync)(wfDir)) return [];
+  return (0, import_node_fs29.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -22015,7 +22754,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -22152,7 +22891,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -22168,7 +22907,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises8.mkdir)((0, import_node_path25.dirname)(registryPath), { recursive: true });
+          await (0, import_promises8.mkdir)((0, import_node_path26.dirname)(registryPath), { recursive: true });
           await (0, import_promises8.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -22182,13 +22921,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs28.lstatSync)(p);
+      st = (0, import_node_fs29.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs28.readlinkSync)(p);
+      (0, import_node_fs29.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -22196,7 +22935,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs28.readdirSync)(p);
+      return (0, import_node_fs29.readdirSync)(p);
     } catch {
       return [];
     }
@@ -22205,9 +22944,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs28.rmdirSync)(p);
+      (0, import_node_fs29.rmdirSync)(p);
     } catch {
-      (0, import_node_fs28.unlinkSync)(p);
+      (0, import_node_fs29.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -22237,9 +22976,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs28.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs29.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs28.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs29.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -22312,7 +23051,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     } : await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs28.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs29.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -22509,7 +23248,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs28.writeSync)(1, `${value}
+  (0, import_node_fs29.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -22526,8 +23265,8 @@ async function resolveStage() {
     local,
     shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs29.existsSync)((0, import_node_path26.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs29.existsSync)((0, import_node_path26.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -22989,7 +23728,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -23033,12 +23772,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile7 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
+  const readFile7 = (p) => (0, import_node_fs29.existsSync)(p) ? (0, import_node_fs29.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -23289,16 +24028,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     if (o.class !== "deployable" && o.class !== "content") return failGraceful("access audit: --class must be deployable or content");
     targets = [{ repo: o.repo, class: o.class }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs28.existsSync)("projects.json") ? (0, import_node_fs28.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs29.existsSync)("projects.json") ? (0, import_node_fs29.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs28.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs28.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs29.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs29.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs28.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs29.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs29.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs28.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs28.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs29.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs29.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -23399,7 +24138,7 @@ program2.command("session-start").description("run the SessionStart verbs (rules
   } catch (e) {
     console.error(`[mmi-hook] saga session failed: ${e.message}`);
   }
-  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
   spawnDeferredGcSweep();
   let northstarInjected = false;
   const { parallel, sequential } = buildSessionStartPlan({
@@ -23441,7 +24180,7 @@ program2.command("session-start").description("run the SessionStart verbs (rules
       readBoard,
       // #1813: warm the slice cache out-of-band (detached, like docs sync) so the ~20s live read
       // never costs banner time and next session's glance renders instantly within budget.
-      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
+      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),
     spineReconcile: async (io) => {
       const cfg = await loadConfig();
@@ -23465,7 +24204,7 @@ program2.command("session-start").description("run the SessionStart verbs (rules
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
 });