@mutmutco/cli 2.61.1 → 2.62.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs26 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -3471,7 +3471,7 @@ function purgeSpine(deps, files = SPINE_FILES) {
 }
 
 // src/index.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_promises = require("node:fs/promises");
@@ -6919,7 +6919,6 @@ function formatHandoffLine(item) {
 
 // src/handoff-commands.ts
 var FOREGROUND_FETCH = { attempts: 2, timeoutMs: 8e3 };
-var SESSION_START_FETCH = { attempts: 1, timeoutMs: 3e3 };
 function timestampRank2(value) {
   const ms = Date.parse(value ?? "");
   return Number.isFinite(ms) ? ms : Number.NEGATIVE_INFINITY;
@@ -7082,20 +7081,6 @@ async function runHandoffList(opts, io = consoleIo) {
   }
   return handoffs;
 }
-async function runHandoffOffer(io = consoleIo, opts = {}) {
-  if (!await requireContinuityAccess("handoff", { quiet: opts.fast }, io)) return;
-  const retry = opts.fast ? SESSION_START_FETCH : FOREGROUND_FETCH;
-  let handoffs;
-  try {
-    ({ handoffs } = await collectScopedHandoffs({ retry }));
-  } catch {
-    return;
-  }
-  if (!handoffs.length) return;
-  io.log("Open handoffs:");
-  for (const h of handoffs) io.log(`- ${formatHandoffLine(h)}`);
-  io.log("Use `mmi-cli handoff accept <key>` to claim, `mmi-cli handoff cancel <key>` to close, or decline in chat to leave it open.");
-}
 async function closeSourceHandoff(key, state, opts = {}, io = consoleIo) {
   if (!await requireContinuityAccess("handoff", {}, io)) return;
   const current = await sagaKey(await loadConfig(), resolveSessionId());
@@ -8631,21 +8616,10 @@ async function runSessionStart(parallel, sequential, io) {
   for (const lines of buffered) flush(lines, io);
   for (const step of sequential) flush(await runBufferedStep(step), io);
 }
-function buildSessionStartPlan(verbs, opts = {}) {
-  const continuityEnabled = opts.continuityEnabled ?? true;
-  const continuitySteps = continuityEnabled ? [
-    { name: "saga show", run: verbs.sagaShow },
-    { name: "handoff offer", run: verbs.handoffOffer },
-    // northstar context (#1228): curated plan cards when relevance is high-confidence; silent otherwise.
-    { name: "northstar context", run: verbs.northstarContext },
-    { name: "saga health", run: verbs.sagaHealth }
-  ] : [];
+function buildSessionStartPlan(verbs) {
   return {
     parallel: [
       { name: "rules purge", run: verbs.rulesPurge },
-      ...continuitySteps.slice(0, 2),
-      { name: "coop pending", run: verbs.coopPending },
-      ...continuitySteps.slice(2),
       // whoami (#879): the resolved human lands in the banner so agents act --for them without asking.
       // Identity reads are memoized process-wide, so this adds no extra gh/Hub round-trip.
       { name: "whoami", run: verbs.whoami },
@@ -8675,31 +8649,6 @@ function isInsideRepoSubdir(cwd, exists = import_node_fs13.existsSync) {
     dir = parent;
   }
 }
-function planStoreLines(cwd) {
-  const mdFiles = (dir, minSize = 0) => {
-    const p = (0, import_node_path12.join)(cwd, dir);
-    if (!(0, import_node_fs13.existsSync)(p)) return [];
-    try {
-      return (0, import_node_fs13.readdirSync)(p).filter((f) => f.toLowerCase().endsWith(".md")).filter((f) => {
-        try {
-          return (0, import_node_fs13.statSync)((0, import_node_path12.join)(p, f)).size >= minSize;
-        } catch {
-          return false;
-        }
-      }).map((f) => `${dir}/${f}`);
-    } catch {
-      return [];
-    }
-  };
-  const tmpPlans = mdFiles("tmp", 1024);
-  const localPlans = mdFiles("plans");
-  const out = [];
-  if (tmpPlans.length)
-    out.push(`[plan-store] WARNING: SSOT-shaped file(s) in tmp/ \u2014 move to plans/<slug>.md (auto-saves to the store; never commit): ${tmpPlans.join(", ")}`);
-  if (localPlans.length)
-    out.push(`[plan-store] plans/ is gitignored on purpose \u2014 ${localPlans.length} local plan(s) auto-save to the North Star store on write; never git add or commit plans/ (use northstar push --wait only when you need immediate server confirmation).`);
-  return out;
-}
 function scratchGcLines(cwd, env = process.env, now = Date.now()) {
   if (env.MMI_NO_AUTO_GC) return [];
   try {
@@ -8713,20 +8662,10 @@ function scratchGcLines(cwd, env = process.env, now = Date.now()) {
     return [];
   }
 }
-function northstarPointer(injected = false) {
-  if (injected) {
-    return "North Stars: `mmi-cli northstar relevant` for more matches; `northstar pull <slug>` for the full SSOT.";
-  }
-  return "North Stars: run `mmi-cli northstar relevant` to load plans relevant to your task (`northstar list` for all).";
-}
-function sessionStartContinuityLines(opts) {
-  if (!opts.continuityEnabled) return [];
-  return [northstarPointer(opts.northstarInjected), ...planStoreLines(opts.cwd)];
-}
 
 // src/coop-commands.ts
 var FOREGROUND_FETCH2 = { attempts: 2, timeoutMs: 15e3 };
-var SESSION_START_FETCH2 = { attempts: 1, timeoutMs: 3e3 };
+var SESSION_START_FETCH = { attempts: 1, timeoutMs: 3e3 };
 var COOP_WAIT_DELAYS_MS = [6e4, 12e4, 18e4, 3e5, 6e5, 18e5];
 async function hubBase() {
   const cfg = await loadConfig();
@@ -8880,7 +8819,7 @@ async function runCoopWait(coopId, io, opts = {}) {
     console.log(JSON.stringify({ coopId, status: "timeout-open" }));
   }
 }
-async function fetchCoopPending(retry = SESSION_START_FETCH2) {
+async function fetchCoopPending(retry = SESSION_START_FETCH) {
   const body = await getJson("/coop/pending", retry);
   return body.pending ?? [];
 }
@@ -10438,140 +10377,6 @@ State: ${payload2.statePath}
   return overlord;
 }
 
-// src/throttle-commands.ts
-var import_node_child_process8 = require("node:child_process");
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
-var THROTTLE_TRACE_REL = (0, import_node_path14.join)(".mmi", "throttle", "trace.jsonl");
-function resolveRepoGitRoot(cwd = process.cwd()) {
-  try {
-    const root = (0, import_node_child_process8.execFileSync)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
-      encoding: "utf8",
-      timeout: 5e3
-    }).trim();
-    return root || cwd;
-  } catch {
-    return cwd;
-  }
-}
-function resolveThrottleTracePath(cwd = process.cwd()) {
-  return (0, import_node_path14.join)(resolveRepoGitRoot(cwd), THROTTLE_TRACE_REL);
-}
-function resolveModeFromEnv() {
-  const v = String(process.env.MMI_THROTTLE_MODE ?? "block").trim().toLowerCase();
-  if (v === "observe") return "observe";
-  return "block";
-}
-function parseTraceLines(raw) {
-  const out = [];
-  for (const line of raw.split(/\r?\n/)) {
-    const t = line.trim();
-    if (!t) continue;
-    try {
-      const o = JSON.parse(t);
-      if (o && typeof o === "object") out.push(o);
-    } catch {
-    }
-  }
-  return out;
-}
-function commandSafetyClass(reasonId) {
-  if (reasonId === "shell_dialect_redirect") return "dialect/redirect mismatch";
-  if (reasonId === "shell_log_dump") return "unbounded log/text dump";
-  if (reasonId.startsWith("shell_")) return "shell command safety";
-  return void 0;
-}
-function summarizeTrace(entries) {
-  let denials = 0;
-  let readBytesWouldBlock = 0;
-  const byTool = {};
-  const byReason = {};
-  const bySurface = {};
-  const byMode = {};
-  const commandSafetyBySurface = {};
-  for (const e of entries) {
-    denials += 1;
-    const tool = e.tool ?? "unknown";
-    byTool[tool] = (byTool[tool] ?? 0) + 1;
-    const reason = e.reasonId ?? "unknown";
-    byReason[reason] = (byReason[reason] ?? 0) + 1;
-    const surface = e.surface ?? "unknown";
-    bySurface[surface] = (bySurface[surface] ?? 0) + 1;
-    const mode = e.mode ?? "unknown";
-    byMode[mode] = (byMode[mode] ?? 0) + 1;
-    const safetyClass = commandSafetyClass(reason);
-    if (safetyClass) {
-      commandSafetyBySurface[surface] = commandSafetyBySurface[surface] ?? {};
-      commandSafetyBySurface[surface][safetyClass] = (commandSafetyBySurface[surface][safetyClass] ?? 0) + 1;
-    }
-    if (reason === "read_unbounded_large") {
-      readBytesWouldBlock += Number(e.fileBytes) || 0;
-    }
-  }
-  return { denials, readBytesWouldBlock, byTool, byReason, bySurface, byMode, commandSafetyBySurface };
-}
-function runThrottleReport(io, tracePath = resolveThrottleTracePath()) {
-  const mode = resolveModeFromEnv();
-  if (!(0, import_node_fs16.existsSync)(tracePath)) {
-    io.log(`Throttle: no trace at ${tracePath} (gates have not denied anything yet).`);
-    io.log(`Active mode: ${mode} (MMI_THROTTLE_MODE env; default block).`);
-    return 0;
-  }
-  let raw = "";
-  try {
-    raw = (0, import_node_fs16.readFileSync)(tracePath, "utf8");
-  } catch (e) {
-    io.err(`Throttle: could not read trace: ${e.message}`);
-    return 1;
-  }
-  const entries = parseTraceLines(raw);
-  const s = summarizeTrace(entries);
-  io.log("Throttle gate summary");
-  io.log(`  mode (current env): ${mode}`);
-  io.log(`  trace entries: ${s.denials}`);
-  io.log(`  read bytes would-have-read (fs.stat only): ${s.readBytesWouldBlock}`);
-  io.log("  (Shell denials are not converted to a tokens-saved figure \u2014 counterfactual.)");
-  const modes = Object.entries(s.byMode).sort((a, b) => b[1] - a[1]);
-  if (modes.length) {
-    io.log("  by trace mode (at denial time):");
-    for (const [name, count] of modes) {
-      const label = name === "observe" ? "would-block (observe)" : name === "block" ? "denied (block)" : name;
-      io.log(`    ${label}: ${count}`);
-    }
-  }
-  const tools = Object.entries(s.byTool).sort((a, b) => b[1] - a[1]);
-  if (tools.length) {
-    io.log("  by tool:");
-    for (const [name, count] of tools) io.log(`    ${name}: ${count}`);
-  }
-  const reasons = Object.entries(s.byReason).sort((a, b) => b[1] - a[1]);
-  if (reasons.length) {
-    io.log("  by reason:");
-    for (const [name, count] of reasons) io.log(`    ${name}: ${count}`);
-  }
-  const surfaces = Object.entries(s.bySurface).sort((a, b) => b[1] - a[1]);
-  if (surfaces.length) {
-    io.log("  by surface:");
-    for (const [name, count] of surfaces) io.log(`    ${name}: ${count}`);
-  }
-  const safetySurfaces = Object.entries(s.commandSafetyBySurface).sort((a, b) => a[0].localeCompare(b[0]));
-  if (safetySurfaces.length) {
-    io.log("  command safety (quoting/dialect/shell) by surface:");
-    for (const [surface, classes] of safetySurfaces) {
-      const detail = Object.entries(classes).sort((a, b) => b[1] - a[1]).map(([cls, count]) => `${cls}: ${count}`).join(", ");
-      io.log(`    ${surface}: ${detail}`);
-    }
-  }
-  return 0;
-}
-function registerThrottleCommands(program3) {
-  const throttle = program3.command("throttle").description("Scrooge v2 \u2014 tool-economy gate trace + report");
-  throttle.command("report").description("print gate denial stats from .mmi/throttle/trace.jsonl").action(() => {
-    const code = runThrottleReport({ log: (s) => console.log(s), err: (s) => console.error(s) });
-    process.exit(code);
-  });
-}
-
 // src/docs-sync.ts
 var SYNCED_DOCS = ["README.md", "architecture.md"];
 async function syncDocs(deps, docs2 = SYNCED_DOCS) {
@@ -10594,7 +10399,7 @@ async function syncDocs(deps, docs2 = SYNCED_DOCS) {
 }
 
 // src/board.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_node_util6 = require("node:util");
 
 // src/board-priority.ts
@@ -10702,7 +10507,7 @@ async function filterDependencyBlockedClaimables(items, client, opts = {}) {
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process9.execFile);
+var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process8.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
 var CLAIM_CONCURRENCY = 5;
@@ -11531,16 +11336,16 @@ function ghError(e) {
 }
 
 // src/board-slice-cache.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path15 = require("node:path");
-var BOARD_SLICE_CACHE_FILE = (0, import_node_path15.join)(".mmi", "board-slice.json");
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
+var BOARD_SLICE_CACHE_FILE = (0, import_node_path14.join)(".mmi", "board-slice.json");
 var BOARD_SLICE_CACHE_TTL_MS = 10 * 60 * 1e3;
 function boardSliceCachePath(cwd) {
-  return (0, import_node_path15.join)(cwd, BOARD_SLICE_CACHE_FILE);
+  return (0, import_node_path14.join)(cwd, BOARD_SLICE_CACHE_FILE);
 }
 function readCachedBoardSlice(cwd) {
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(boardSliceCachePath(cwd), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(boardSliceCachePath(cwd), "utf8"));
     if (typeof parsed.ts !== "number") return null;
     return { block: typeof parsed.block === "string" ? parsed.block : null, ts: parsed.ts };
   } catch {
@@ -11551,12 +11356,12 @@ function writeCachedBoardSlice(cwd, slice) {
   const path2 = boardSliceCachePath(cwd);
   const tmp = `${path2}.${process.pid}.tmp`;
   try {
-    (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(path2), { recursive: true });
-    (0, import_node_fs17.writeFileSync)(tmp, JSON.stringify(slice));
-    (0, import_node_fs17.renameSync)(tmp, path2);
+    (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(path2), { recursive: true });
+    (0, import_node_fs16.writeFileSync)(tmp, JSON.stringify(slice));
+    (0, import_node_fs16.renameSync)(tmp, path2);
   } catch {
     try {
-      (0, import_node_fs17.rmSync)(tmp, { force: true });
+      (0, import_node_fs16.rmSync)(tmp, { force: true });
     } catch {
     }
   }
@@ -11684,8 +11489,8 @@ async function refreshBoardSliceCache(deps) {
 }
 
 // src/worktree.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
 var LOCAL_ONLY_FILES = [".claude/settings.local.json"];
 var PKG = "package.json";
 var LOCKFILE = "package-lock.json";
@@ -11693,21 +11498,21 @@ var NODE_MODULES = "node_modules";
 var realFsProbe = {
   isDir: (p) => {
     try {
-      return (0, import_node_fs18.statSync)(p).isDirectory();
+      return (0, import_node_fs17.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   },
   isFile: (p) => {
     try {
-      return (0, import_node_fs18.statSync)(p).isFile();
+      return (0, import_node_fs17.statSync)(p).isFile();
     } catch {
       return false;
     }
   },
   listDirs: (p) => {
     try {
-      return (0, import_node_fs18.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+      return (0, import_node_fs17.readdirSync)(p, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch {
       return [];
     }
@@ -11715,12 +11520,12 @@ var realFsProbe = {
 };
 function scanInstallDirs(root, fs2 = realFsProbe) {
   const factsFor = (dir) => {
-    const abs = dir ? (0, import_node_path16.join)(root, dir) : root;
+    const abs = dir ? (0, import_node_path15.join)(root, dir) : root;
     return {
       dir,
-      hasPackageJson: fs2.isFile((0, import_node_path16.join)(abs, PKG)),
-      hasLockfile: fs2.isFile((0, import_node_path16.join)(abs, LOCKFILE)),
-      hasNodeModules: fs2.isDir((0, import_node_path16.join)(abs, NODE_MODULES))
+      hasPackageJson: fs2.isFile((0, import_node_path15.join)(abs, PKG)),
+      hasLockfile: fs2.isFile((0, import_node_path15.join)(abs, LOCKFILE)),
+      hasNodeModules: fs2.isDir((0, import_node_path15.join)(abs, NODE_MODULES))
     };
   };
   const children = fs2.listDirs(root).filter((name) => name !== NODE_MODULES && name !== ".git");
@@ -11730,7 +11535,7 @@ function npmInstallTargets(dirs) {
   return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
-  return fs2.isFile((0, import_node_path16.join)(root, ".git"));
+  return fs2.isFile((0, import_node_path15.join)(root, ".git"));
 }
 function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   if (!isLinkedWorktree(root, fs2)) return null;
@@ -11740,8 +11545,8 @@ function worktreeAutoProvisionBanner(root, fs2 = realFsProbe) {
   return `[worktree] provisioning tooling in the background (deps in ${where} + local config) \u2014 \`mmi-cli worktree setup\` to redo`;
 }
 function defaultCopyFile(from, to) {
-  (0, import_node_fs18.mkdirSync)((0, import_node_path16.dirname)(to), { recursive: true });
-  (0, import_node_fs18.copyFileSync)(from, to);
+  (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(to), { recursive: true });
+  (0, import_node_fs17.copyFileSync)(from, to);
 }
 async function provisionWorktree(worktreeRoot, deps) {
   const fs2 = deps.fs ?? realFsProbe;
@@ -11753,7 +11558,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const skippedInstall = allDirs.filter((d) => d.hasPackageJson && d.hasNodeModules).map((d) => d.dir);
   const installed = [];
   for (const target of targets) {
-    const cwd = target.dir ? (0, import_node_path16.join)(worktreeRoot, target.dir) : worktreeRoot;
+    const cwd = target.dir ? (0, import_node_path15.join)(worktreeRoot, target.dir) : worktreeRoot;
     log(`installing deps: ${target.command} in ${target.dir || "."}`);
     await deps.runInstall(target.command, cwd);
     installed.push(target);
@@ -11762,7 +11567,7 @@ async function provisionWorktree(worktreeRoot, deps) {
   const copySkipped = [];
   const primary = await deps.primaryCheckout();
   for (const rel of LOCAL_ONLY_FILES) {
-    const dest = (0, import_node_path16.join)(worktreeRoot, rel);
+    const dest = (0, import_node_path15.join)(worktreeRoot, rel);
     if (fs2.isFile(dest)) {
       copySkipped.push({ file: rel, reason: "already-present" });
       continue;
@@ -11771,11 +11576,11 @@ async function provisionWorktree(worktreeRoot, deps) {
       copySkipped.push({ file: rel, reason: "no-primary" });
       continue;
     }
-    if (!fs2.isFile((0, import_node_path16.join)(primary, rel))) {
+    if (!fs2.isFile((0, import_node_path15.join)(primary, rel))) {
       copySkipped.push({ file: rel, reason: "absent-in-primary" });
       continue;
     }
-    copyFile((0, import_node_path16.join)(primary, rel), dest);
+    copyFile((0, import_node_path15.join)(primary, rel), dest);
     copied.push(rel);
     log(`copied local config: ${rel}`);
   }
@@ -11783,7 +11588,7 @@ async function provisionWorktree(worktreeRoot, deps) {
 }
 function defaultWorktreePath(repoRoot, branch) {
   const safe = branch.replace(/[/\\]+/g, "-");
-  return (0, import_node_path16.join)((0, import_node_path16.dirname)(repoRoot), "mmi-worktrees", safe);
+  return (0, import_node_path15.join)((0, import_node_path15.dirname)(repoRoot), "mmi-worktrees", safe);
 }
 function resolveWorktreeBase(from, remote) {
   const remotePrefix = `${remote}/`;
@@ -11791,121 +11596,6 @@ function resolveWorktreeBase(from, remote) {
   return { base: from, fetchBranch };
 }
 
-// src/northstar-context.ts
-var SESSION_START_NORTHSTAR_TIMEOUT_MS = 3e3;
-var NORTHSTAR_CONTEXT_MIN_SCORE = 3;
-var NORTHSTAR_CONTEXT_MAX_CARDS = 2;
-var NORTHSTAR_CONTEXT_CHAR_BUDGET = 900;
-var NORTHSTAR_CONTEXT_FRAMING = [
-  "> NORTH STAR CONTEXT \u2014 SSOT plans likely relevant to this task/session. Use them to",
-  "  orient direction and constraints. This is a PRIOR, not an instruction: the live",
-  "  user/master instruction always wins. Do not narrate or cite this block; pull the",
-  "  full plan with `mmi-cli northstar pull <slug>` when you need detail."
-].join("\n");
-function compactText(text, max) {
-  const t = text.replace(/\s+/g, " ").trim();
-  if (t.length <= max) return t;
-  return `${t.slice(0, max - 1)}\u2026`;
-}
-function derivePlanIntent(content) {
-  const fromFm = frontmatterValue(content, "intent") ?? frontmatterValue(content, "summary");
-  if (fromFm?.trim()) return compactText(fromFm, 240);
-  const { body } = splitFrontmatter(content);
-  const lines = body.split(/\r?\n/);
-  const paragraph = [];
-  for (const raw of lines) {
-    const line = raw.trim();
-    if (!line) {
-      if (paragraph.length) break;
-      continue;
-    }
-    if (/^#+\s/.test(line)) continue;
-    if (/^[-*]\s/.test(line) || /^```/.test(line)) break;
-    paragraph.push(line.replace(/^#+\s*/, ""));
-    if (paragraph.length >= 3) break;
-  }
-  if (!paragraph.length) return void 0;
-  return compactText(paragraph.join(" "), 240);
-}
-function formatPlanContextCard(slug, title, intent) {
-  const head = title?.trim() ? `  \u2022 ${slug} \u2014 ${title.trim()}` : `  \u2022 ${slug}`;
-  if (!intent?.trim()) return head;
-  return `${head}
-    ${intent.trim()}`;
-}
-function isHighConfidenceMatch(r, signals) {
-  if (r.score >= NORTHSTAR_CONTEXT_MIN_SCORE) return true;
-  const branch = (signals.branch ?? "").toLowerCase();
-  const slug = r.plan.slug.toLowerCase();
-  return slug.length >= 5 && branch.includes(slug);
-}
-function selectHighConfidencePlans(ranked, signals, opts = {}) {
-  const max = opts.maxCards ?? NORTHSTAR_CONTEXT_MAX_CARDS;
-  const anchor = opts.anchorSlug?.trim().toLowerCase();
-  const picked = [];
-  if (anchor) {
-    const direct = ranked.find((r) => r.plan.slug.toLowerCase() === anchor);
-    if (direct) picked.push(direct);
-  }
-  for (const r of ranked) {
-    if (picked.length >= max) break;
-    if (picked.some((p) => p.plan.slug === r.plan.slug && p.plan.project === r.plan.project)) continue;
-    if (isHighConfidenceMatch(r, signals)) picked.push(r);
-  }
-  return picked.slice(0, max);
-}
-function buildNorthstarContextBlock(ranked, signals, readLocal, opts = {}) {
-  const selected = selectHighConfidencePlans(ranked, signals, opts);
-  if (!selected.length) return null;
-  const cards = [];
-  let used = 0;
-  for (const r of selected) {
-    const local = readLocal(r.plan.slug);
-    const intent = local ? derivePlanIntent(local) : void 0;
-    const card = formatPlanContextCard(r.plan.slug, r.plan.title, intent);
-    if (used + card.length > NORTHSTAR_CONTEXT_CHAR_BUDGET) break;
-    cards.push(card);
-    used += card.length;
-  }
-  if (!cards.length) return null;
-  return [NORTHSTAR_CONTEXT_FRAMING, ...cards].join("\n");
-}
-async function withTimeout2(promise, ms) {
-  let timer;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error("northstar context timeout")), ms);
-      })
-    ]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-async function runNorthstarContext(io, deps) {
-  try {
-    const injected = await withTimeout2(
-      (async () => {
-        const plans = await deps.loadPlans();
-        if (!plans.length) return false;
-        const signals = await deps.gatherSignals();
-        const ranked = rankPlansByRelevance(plans, signals);
-        const block = buildNorthstarContextBlock(ranked, signals, deps.readLocal, {
-          anchorSlug: signals.anchorSlug
-        });
-        if (!block) return false;
-        io.log(block);
-        return true;
-      })(),
-      deps.timeoutMs ?? SESSION_START_NORTHSTAR_TIMEOUT_MS
-    );
-    return injected;
-  } catch {
-    return false;
-  }
-}
-
 // src/whoami.ts
 async function resolveWhoami(deps) {
   let session;
@@ -11930,7 +11620,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path23 = require("node:path");
+var import_node_path22 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -13182,7 +12872,7 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 // src/gh-create.ts
 var import_promises5 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_path16 = require("node:path");
 var import_node_crypto6 = require("node:crypto");
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
@@ -13223,7 +12913,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   } };
   const write = deps.write ?? import_promises5.writeFile;
   const remove = deps.remove ?? import_promises5.unlink;
-  const file = (0, import_node_path17.join)(deps.dir ?? (0, import_node_os3.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.md`);
+  const file = (0, import_node_path16.join)(deps.dir ?? (0, import_node_os3.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.md`);
   await write(file, args[i + 1], "utf8");
   return {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
@@ -13672,7 +13362,7 @@ ${buildReportBody(body, sourceRepo)}`;
 
 // src/skill-lesson.ts
 var SKILL_LESSON_LABEL = "skill-lesson";
-var SKILL_NAMES = ["bootstrap", "browser-automation", "build", "coop", "grind", "handoff", "hotfix", "mmi", "overlord", "rcand", "release", "secrets", "stage"];
+var SKILL_NAMES = ["bootstrap", "browser-automation", "hotfix", "mmi", "rcand", "release", "secrets", "stage"];
 function assertSkillName(name) {
   const match = SKILL_NAMES.find((skill) => skill === name);
   if (!match) throw new Error(`unknown skill "${name}" \u2014 expected one of: ${SKILL_NAMES.join(", ")}`);
@@ -15470,12 +15160,12 @@ function renderVerifySecrets(body) {
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git = options.git ?? ((args, opts) => (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git = options.git ?? ((args, opts) => (0, import_node_child_process9.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -16196,8 +15886,8 @@ async function announceRelease(deps, args) {
 }
 
 // src/port-registry.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path17 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -16211,8 +15901,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs19.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs18.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -16226,9 +15916,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs19.existsSync)(path2) ? JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs18.existsSync)(path2) ? JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs19.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs18.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -16250,18 +15940,18 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path18.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path18.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs19.existsSync)(registryPath) || !(0, import_node_fs19.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path17.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path17.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs18.existsSync)(registryPath) || !(0, import_node_fs18.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path18.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path18.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path17.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path17.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path18.dirname)(dir);
+    const parent = (0, import_node_path17.dirname)(dir);
     if (parent === dir) return null;
   }
 }
@@ -17699,6 +17389,39 @@ function authorizeBodyHasMismatch(body) {
 var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
+var SECRET_CONSUMERS = ["runtime", "lambda", "actions", "agent", "box"];
+var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+function parseSecretsCatalogVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('project set: secrets must be JSON keyed by KEY, e.g. {"SCRAPER_API_KEY":{"key":"SCRAPER_API_KEY","purpose":"scrape provider key","group":"scraper","owner":"oguz","stages":[],"consumers":["box"]}}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("project set: secrets must be a map keyed by canonical KEY");
+  }
+  const nonEmpty = (v) => typeof v === "string" && v.trim().length > 0;
+  for (const [mapKey, value] of Object.entries(parsed)) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`project set: secrets["${mapKey}"] must be an object`);
+    const e = value;
+    if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key) || e.key !== mapKey) {
+      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key and be an env-name (UPPER_SNAKE)`);
+    }
+    if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
+    if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`project set: secrets["${mapKey}"].provider must be a non-empty string`);
+    if (!Array.isArray(e.stages) || e.stages.some((s) => !RUNTIME_SECRET_STAGES.includes(s))) {
+      throw new Error(`project set: secrets["${mapKey}"].stages must be a subset of dev/rc/main ([] = shared)`);
+    }
+    if (!Array.isArray(e.consumers) || e.consumers.some((c) => !SECRET_CONSUMERS.includes(c))) {
+      throw new Error(`project set: secrets["${mapKey}"].consumers must be a subset of ${SECRET_CONSUMERS.join("/")}`);
+    }
+    if (e.aliases !== void 0 && (!Array.isArray(e.aliases) || e.aliases.some((a) => typeof a !== "string"))) {
+      throw new Error(`project set: secrets["${mapKey}"].aliases must be a string array`);
+    }
+  }
+  return parsed;
+}
 function parseRuntimeSecretsVar(raw) {
   let parsed;
   try {
@@ -17954,7 +17677,8 @@ var SETTABLE_VAR_KEYS = [
   "portRange",
   "ci",
   "requiredChecks",
-  "gate"
+  "gate",
+  "secrets"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -17968,6 +17692,7 @@ var SETTABLE_VAR_HINTS = {
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
+  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
   priorityOptions: "JSON {Urgent,High,Medium,Low}\u2192id map",
@@ -18023,6 +17748,8 @@ function buildProjectSetPatch(input) {
       patch[key] = n;
     } else if (key === "requiredRuntimeSecrets") {
       patch[key] = parseRuntimeSecretsVar(raw);
+    } else if (key === "secrets") {
+      patch[key] = parseSecretsCatalogVar(raw);
     } else if (key === "edgeDomains") {
       patch[key] = parseEdgeDomainsVar(raw);
     } else if (key === "priorityOptions") {
@@ -18132,15 +17859,15 @@ function requireProjectTarget(commandName, explicitTarget, currentRepo) {
 }
 
 // src/northstar-commands.ts
-var import_node_fs20 = require("node:fs");
-var import_node_child_process11 = require("node:child_process");
+var import_node_fs19 = require("node:fs");
+var import_node_child_process10 = require("node:child_process");
 var import_promises6 = require("node:fs/promises");
 var planSyncDetached = false;
 function detachPlanSync() {
   if (planSyncDetached) return;
   planSyncDetached = true;
   try {
-    (0, import_node_child_process11.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
+    (0, import_node_child_process10.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -18150,7 +17877,7 @@ function detachPlanSync() {
   }
 }
 function makePlanDeps(cfg, io = consoleIo) {
-  const ensureDir = () => (0, import_node_fs20.mkdirSync)(PLANS_DIR, { recursive: true });
+  const ensureDir = () => (0, import_node_fs19.mkdirSync)(PLANS_DIR, { recursive: true });
   return {
     apiUrl: cfg.sagaApiUrl,
     fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
@@ -18158,31 +17885,31 @@ function makePlanDeps(cfg, io = consoleIo) {
     project: async () => (await sagaKey(cfg)).project,
     readLocal: (slug) => {
       try {
-        return (0, import_node_fs20.readFileSync)(planPath(slug), "utf8");
+        return (0, import_node_fs19.readFileSync)(planPath(slug), "utf8");
       } catch {
         return null;
       }
     },
     listLocalSlugs: () => {
       try {
-        return (0, import_node_fs20.readdirSync)(PLANS_DIR, { withFileTypes: true }).filter((entry) => entry.isFile() && /^[A-Za-z0-9][A-Za-z0-9_-]*\.md$/.test(entry.name)).map((entry) => entry.name.replace(/\.md$/, ""));
+        return (0, import_node_fs19.readdirSync)(PLANS_DIR, { withFileTypes: true }).filter((entry) => entry.isFile() && /^[A-Za-z0-9][A-Za-z0-9_-]*\.md$/.test(entry.name)).map((entry) => entry.name.replace(/\.md$/, ""));
       } catch {
         return [];
       }
     },
     writeLocal: (slug, content) => {
       ensureDir();
-      (0, import_node_fs20.writeFileSync)(planPath(slug), content, "utf8");
+      (0, import_node_fs19.writeFileSync)(planPath(slug), content, "utf8");
     },
     removeLocal: (slug) => {
       try {
-        (0, import_node_fs20.rmSync)(planPath(slug));
+        (0, import_node_fs19.rmSync)(planPath(slug));
       } catch {
       }
     },
     readMetaRaw: () => {
       try {
-        return (0, import_node_fs20.readFileSync)(META_FILE, "utf8");
+        return (0, import_node_fs19.readFileSync)(META_FILE, "utf8");
       } catch {
         return null;
       }
@@ -18193,7 +17920,7 @@ function makePlanDeps(cfg, io = consoleIo) {
     },
     readIndexRaw: () => {
       try {
-        return (0, import_node_fs20.readFileSync)(INDEX_FILE, "utf8");
+        return (0, import_node_fs19.readFileSync)(INDEX_FILE, "utf8");
       } catch {
         return null;
       }
@@ -18204,7 +17931,7 @@ function makePlanDeps(cfg, io = consoleIo) {
     },
     readQueueRaw: () => {
       try {
-        return (0, import_node_fs20.readFileSync)(QUEUE_FILE, "utf8");
+        return (0, import_node_fs19.readFileSync)(QUEUE_FILE, "utf8");
       } catch {
         return null;
       }
@@ -18226,7 +17953,7 @@ function openInEditor(path2) {
     return;
   }
   try {
-    (0, import_node_child_process11.spawn)(editor, [path2], { stdio: "inherit" });
+    (0, import_node_child_process10.spawn)(editor, [path2], { stdio: "inherit" });
   } catch {
     console.log(`open ${path2} manually`);
   }
@@ -18266,7 +17993,7 @@ function repoInfoFromRemote(remote) {
 }
 function readStageUrl() {
   try {
-    const state = JSON.parse((0, import_node_fs20.readFileSync)("tmp/stage/state.json", "utf8"));
+    const state = JSON.parse((0, import_node_fs19.readFileSync)("tmp/stage/state.json", "utf8"));
     if (typeof state.url === "string" && state.url.trim()) return state.url.trim();
     if (typeof state.port === "number" && Number.isFinite(state.port)) return `http://127.0.0.1:${state.port}/`;
     if (typeof state.healthUrl === "string" && state.healthUrl.trim()) {
@@ -18702,6 +18429,7 @@ function formatDrift(d) {
   section("declared but MISSING in SSM", d.declaredMissing.map((m) => m.path));
   section("ORPHAN in SSM, undeclared \u2014 declare or delete", d.orphan.map((o) => o.path));
   section("OFF-SCHEME path", d.offScheme.map((o) => `${o.path}  (${o.reason})`));
+  section("STAGE-SPLIT \u2014 collapse to one shared key", (d.stageSplit ?? []).map((s) => `${s.slug}/${s.leaf} split across ${s.stages.join("/")}`));
   section("DUPLICATE org-infra secret", d.duplicate.map((dup) => `${dup.logical}: ${dup.paths.join(" , ")}`));
   return lines.join("\n").trimEnd();
 }
@@ -18746,6 +18474,34 @@ async function secretsDoctor(deps, opts) {
   deps.log(formatDrift(data.drift));
   return data.drift.ok;
 }
+async function secretsOrgCatalogSet(deps, fileBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fileBody);
+  } catch {
+    deps.err('secrets org-catalog: file is not valid JSON ({ entries: { "<provider>/<KEY>": {...} } })');
+    return false;
+  }
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/catalog/org-infra`, {
+      method: "POST",
+      headers: await deps.headers({ "content-type": "application/json" }),
+      body: JSON.stringify(parsed),
+      signal: AbortSignal.timeout(TIMEOUT_MS2)
+    });
+  } catch (e) {
+    deps.err(`secrets org-catalog: ${e.message}`);
+    return false;
+  }
+  if (!res.ok) {
+    deps.err(await upgradeMessage(res) ?? `secrets org-catalog failed: HTTP ${res.status}${await readErr(res)}`);
+    return false;
+  }
+  const out = await res.json();
+  deps.log(`org-infra catalog updated: ${out.entries ?? "?"} entries`);
+  return true;
+}
 var DEFAULT_RUNTIME_SECRET_NAMES2 = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 function stringList(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && isValidSecretKey(x)) : [];
@@ -19117,8 +18873,8 @@ async function secretsUse(deps, key, opts) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path18 = require("node:path");
 var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
 var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
@@ -19126,18 +18882,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path19.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path18.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path19.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path19.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path18.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path18.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs21.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs21.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs20.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs20.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -19200,6 +18956,15 @@ function registerSecretsCommands(program3) {
   secrets.command("doctor").description("vault drift report \u2014 declared-missing / orphan / off-scheme / duplicate (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets(async (d) => {
     if (!await secretsDoctor(d, o)) process.exitCode = 1;
   }));
+  secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
+    let body;
+    try {
+      body = (0, import_node_fs20.readFileSync)((0, import_node_path18.resolve)(o.file), "utf8");
+    } catch (e) {
+      return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
+    }
+    if (!await secretsOrgCatalogSet(d, body)) process.exitCode = 1;
+  }));
   secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").action(async (o) => {
     if (!["dev", "rc", "main"].includes(o.stage)) {
       return fail("secrets preflight: --stage must be dev, rc, or main");
@@ -19269,7 +19034,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs21.unlinkSync)((0, import_node_path19.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs20.unlinkSync)((0, import_node_path18.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -19355,10 +19120,10 @@ function registerEdgeCommands(program3) {
 }
 
 // src/doctor-run.ts
-var import_node_fs25 = require("node:fs");
-var import_node_child_process13 = require("node:child_process");
+var import_node_fs24 = require("node:fs");
+var import_node_child_process12 = require("node:child_process");
 var import_promises7 = require("node:fs/promises");
-var import_node_path22 = require("node:path");
+var import_node_path21 = require("node:path");
 var import_node_os5 = require("node:os");
 
 // src/plugin-guard.ts
@@ -19379,10 +19144,10 @@ function buildGuardSessionStartLine(state, opts = {}) {
 }
 
 // src/cursor-plugin-seed.ts
-var import_node_child_process12 = require("node:child_process");
-var import_node_fs22 = require("node:fs");
+var import_node_child_process11 = require("node:child_process");
+var import_node_fs21 = require("node:fs");
 var import_node_os4 = require("node:os");
-var import_node_path20 = require("node:path");
+var import_node_path19 = require("node:path");
 var import_node_util7 = require("node:util");
 function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
@@ -19390,7 +19155,7 @@ function isSemverVersion(v) {
 var MMI_HUB_REPO = "mutmutco/MMI-Hub";
 var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
 var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
-var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process12.execFile);
+var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process11.execFile);
 function gitFetchReleaseTagArgs(hubCheckout, tag) {
   return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
 }
@@ -19399,17 +19164,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path20.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path20.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base = process.env.APPDATA || (0, import_node_path19.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path19.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path20.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path19.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path20.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path19.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs22.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs21.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -19423,57 +19188,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs22.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs22.readdirSync)(dest)) {
-    (0, import_node_fs22.rmSync)((0, import_node_path20.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs21.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs21.readdirSync)(dest)) {
+    (0, import_node_fs21.rmSync)((0, import_node_path19.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs22.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs21.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path20.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path19.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path20.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs22.existsSync)((0, import_node_path20.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path19.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs21.existsSync)((0, import_node_path19.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path20.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path19.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs22.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs21.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs22.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs21.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs22.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs21.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path20.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs22.existsSync)((0, import_node_path20.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path19.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs21.existsSync)((0, import_node_path19.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs22.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs21.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path20.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path19.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -19494,7 +19259,7 @@ async function applyCursorPluginCacheSeed(input) {
   for (const pin of pinsToSeed) {
     syncDirContents(source, pin.path);
   }
-  (0, import_node_fs22.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs21.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
 
@@ -20343,7 +20108,7 @@ function cursorPluginInstallFix(input) {
   const cacheDir = joinCachePath(input.cacheRoot, pin);
   const autoSeed = "run `mmi-cli doctor --apply` to seed plugins/mmi from the latest release into the active pin";
   const localSeed = input.hubCheckout ? `temporary fallback: copy ${joinCachePath(input.hubCheckout, "plugins", "mmi")} to ${cacheDir}, then restart Cursor` : `temporary fallback: copy plugins/mmi from a local MMI-Hub checkout to ${cacheDir}, then restart Cursor`;
-  return `Cursor plugin cache at ${cacheDir} is empty or missing ${CURSOR_PLUGIN_JSON_REL}, ${CURSOR_HOOKS_JSON_REL}, or the shell-dialect guard scripts \u2014 ${autoSeed}; ${marketplaceRefresh}; ${authSteps}; ${localSeed}; ${logHint}; ${guide}`;
+  return `Cursor plugin cache at ${cacheDir} is empty or missing ${CURSOR_PLUGIN_JSON_REL}, ${CURSOR_HOOKS_JSON_REL}, or the cursor-hook dispatcher script \u2014 ${autoSeed}; ${marketplaceRefresh}; ${authSteps}; ${localSeed}; ${logHint}; ${guide}`;
 }
 function buildCursorPluginInstallCheck(input) {
   const base = {
@@ -20365,7 +20130,7 @@ function buildCursorPluginInstallCheck(input) {
     };
   }
   for (const pin of input.pins) {
-    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.hasShellDialectGuard === false || pin.isEmpty) {
+    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.hasCursorHookScript === false || pin.isEmpty) {
       return {
         ...base,
         ok: false,
@@ -20647,9 +20412,9 @@ function buildPluginResolvabilityCheck(input) {
 }
 
 // src/cli-doctor-shared.ts
+var import_node_fs22 = require("node:fs");
+var import_node_path20 = require("node:path");
 var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
-var import_node_fs24 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -20695,7 +20460,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path21.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path20.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -20715,18 +20480,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path21.isAbsolute)(raw) ? raw : (0, import_node_path21.resolve)(worktreePath, raw);
+  return (0, import_node_path20.isAbsolute)(raw) ? raw : (0, import_node_path20.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs24.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs23.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs23.readFileSync)((0, import_node_path21.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path21.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path21.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path21.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs22.readFileSync)((0, import_node_path20.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path20.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path20.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path20.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -20736,7 +20501,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs24.statSync)(path2);
+    (0, import_node_fs23.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -20745,10 +20510,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path21.join)(path2, ".git");
+  const gitPath = (0, import_node_path20.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs24.lstatSync)(gitPath);
+    st = (0, import_node_fs23.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -20765,7 +20530,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs23.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs22.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -20782,7 +20547,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs24.readdirSync)(path2) };
+    return { entries: (0, import_node_fs23.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -20801,8 +20566,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs24.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path21.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs23.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path20.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -20852,7 +20617,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path22.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs24.readFileSync)((0, import_node_path21.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -20912,7 +20677,7 @@ function reexecMmiCli(args) {
       }
     };
     const env = { ...process.env, [DOCTOR_POST_SELF_UPDATE_ENV]: "1" };
-    const child = isWin ? (0, import_node_child_process13.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", env }) : (0, import_node_child_process13.spawn)("mmi-cli", args, { stdio: "inherit", env });
+    const child = isWin ? (0, import_node_child_process12.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", env }) : (0, import_node_child_process12.spawn)("mmi-cli", args, { stdio: "inherit", env });
     child.on("error", () => done(-1));
     child.on("exit", (code) => done(code ?? 0));
   });
@@ -20969,11 +20734,11 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path22.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path21.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs24.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -20984,15 +20749,15 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: (0, import_node_fs25.existsSync)((0, import_node_path22.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
-    pluginCachePresent: (0, import_node_fs25.existsSync)((0, import_node_path22.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: (0, import_node_fs24.existsSync)((0, import_node_path21.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
+    pluginCachePresent: (0, import_node_fs24.existsSync)((0, import_node_path21.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path22.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path21.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs25.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs24.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -21000,7 +20765,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)((0, import_node_path22.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs24.readFileSync)((0, import_node_path21.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -21022,7 +20787,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs25.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs24.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -21035,9 +20800,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs25.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs24.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs25.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs24.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -21045,22 +20810,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".config", "opencode");
+  return (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path22.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path21.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path22.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path21.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path22.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path21.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs25.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs24.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs25.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs24.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -21083,9 +20848,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan2 = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan2.action === "already") return true;
     if (!plan2.text || plan2.action === "unsafe") return false;
-    (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs25.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs25.writeFileSync)(path2, plan2.text, "utf8");
+    (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs24.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs24.writeFileSync)(path2, plan2.text, "utf8");
     return true;
   } catch {
     return false;
@@ -21100,9 +20865,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs25.existsSync)(snapshot.path)) (0, import_node_fs25.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs25.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs24.existsSync)(snapshot.path)) (0, import_node_fs24.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs24.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -21111,7 +20876,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs25.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs24.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -21119,9 +20884,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs25.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs24.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs25.writeFileSync)((0, import_node_path22.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs24.writeFileSync)((0, import_node_path21.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -21130,12 +20895,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path22.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path21.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs25.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs24.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -21151,7 +20916,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs25.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs24.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -21166,30 +20931,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path22.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path22.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path21.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path21.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path22.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path21.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path22.join)(root, entry.name)).sort((a, b) => (0, import_node_fs25.statSync)(b).mtimeMs - (0, import_node_fs25.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs24.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path21.join)(root, entry.name)).sort((a, b) => (0, import_node_fs24.statSync)(b).mtimeMs - (0, import_node_fs24.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path22.join)(newest, "renderer.log");
-    const text = (0, import_node_fs25.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs25.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path21.join)(newest, "renderer.log");
+    const text = (0, import_node_fs24.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs24.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs25.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs24.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -21201,46 +20966,45 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs25.existsSync)(backupPath)) return false;
-    (0, import_node_fs25.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs24.existsSync)(backupPath)) return false;
+    (0, import_node_fs24.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path22.join)(root, entry.name);
-      const pluginJson = (0, import_node_path22.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path22.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path22.join)(path2, "cli", "dist", "index.cjs");
-      const throttleGateCursor = (0, import_node_path22.join)(path2, "scripts", "throttle-gate-cursor.mjs");
-      const throttleCore = (0, import_node_path22.join)(path2, "scripts", "throttle-core.mjs");
+    return (0, import_node_fs24.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path21.join)(root, entry.name);
+      const pluginJson = (0, import_node_path21.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path21.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path21.join)(path2, "cli", "dist", "index.cjs");
+      const cursorHook = (0, import_node_path21.join)(path2, "scripts", "cursor-hook.mjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs25.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs24.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs25.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs24.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs25.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs25.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs25.existsSync)(cliBundle),
-        hasShellDialectGuard: (0, import_node_fs25.existsSync)(throttleGateCursor) && (0, import_node_fs25.existsSync)(throttleCore),
+        hasPluginJson: (0, import_node_fs24.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs24.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs24.existsSync)(cliBundle),
+        hasCursorHookScript: (0, import_node_fs24.existsSync)(cursorHook),
         isEmpty,
         version
       };
@@ -21250,19 +21014,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path22.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs25.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path21.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs24.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path21.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs24.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path22.join)(root, entry.name),
+        path: (0, import_node_path21.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -21273,7 +21037,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs25.statSync)((0, import_node_path22.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs24.statSync)((0, import_node_path21.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -21284,10 +21048,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs25.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs24.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs25.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs24.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -21296,10 +21060,10 @@ function quarantinePluginCacheDirs(plan2) {
   const failed = [];
   for (const move of plan2) {
     try {
-      if (!(0, import_node_fs25.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs24.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
-      (0, import_node_fs25.renameSync)(move.from, target);
+      (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(target), { recursive: true });
+      (0, import_node_fs24.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -21318,23 +21082,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs25.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs24.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path22.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs25.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path21.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs24.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs25.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs24.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs25.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs24.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs25.existsSync)(targetPath);
+      return !(0, import_node_fs24.existsSync)(targetPath);
     }
-    (0, import_node_fs25.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs25.existsSync)(targetPath);
+    (0, import_node_fs24.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs24.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -21347,11 +21111,11 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path22.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path21.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs25.existsSync)(path2)) return null;
-    return (0, import_node_fs25.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs24.existsSync)(path2)) return null;
+    return (0, import_node_fs24.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -21360,10 +21124,10 @@ function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
   const home = (0, import_node_os5.homedir)();
   const candidates = [
-    (0, import_node_path22.join)(cwd, ".mcp.json"),
-    (0, import_node_path22.join)(cwd, ".cursor", "mcp.json"),
-    (0, import_node_path22.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path22.join)(home, ".codex", "config.toml")
+    (0, import_node_path21.join)(cwd, ".mcp.json"),
+    (0, import_node_path21.join)(cwd, ".cursor", "mcp.json"),
+    (0, import_node_path21.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path21.join)(home, ".codex", "config.toml")
   ];
   const out = [];
   for (const path2 of candidates) {
@@ -21376,7 +21140,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs25.existsSync)((0, import_node_path22.join)(cwd, rel));
+      return (0, import_node_fs24.existsSync)((0, import_node_path21.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -21395,8 +21159,8 @@ function latestIso(values) {
   return best;
 }
 function latestNorthstarContinuityAt() {
-  const meta = parseMeta(readTextFile((0, import_node_path22.join)(process.cwd(), META_FILE)));
-  const queue = parseQueue(readTextFile((0, import_node_path22.join)(process.cwd(), QUEUE_FILE)));
+  const meta = parseMeta(readTextFile((0, import_node_path21.join)(process.cwd(), META_FILE)));
+  const queue = parseQueue(readTextFile((0, import_node_path21.join)(process.cwd(), QUEUE_FILE)));
   return latestIso([
     ...Object.values(meta).map((entry) => entry.syncedAt),
     ...queue.map((entry) => entry.queuedAt)
@@ -21410,14 +21174,14 @@ async function latestBranchWorkAt() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs25.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs24.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs25.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs24.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -21456,7 +21220,7 @@ async function runDoctor(opts, io = consoleIo) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs25.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs24.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
@@ -21491,7 +21255,7 @@ async function runDoctor(opts, io = consoleIo) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs25.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs24.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -21860,7 +21624,7 @@ async function runDoctor(opts, io = consoleIo) {
     isOrgRepo: Boolean(cfg.sagaApiUrl),
     surface,
     cacheRoot: cursorCacheRoot,
-    cacheRootExists: (0, import_node_fs25.existsSync)(cursorCacheRoot),
+    cacheRootExists: (0, import_node_fs24.existsSync)(cursorCacheRoot),
     pins: cursorPins,
     hubCheckout: hubCheckoutForCursorSeed(),
     releasedVersion
@@ -21871,7 +21635,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path22.join)((0, import_node_os5.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path21.join)((0, import_node_os5.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -21880,7 +21644,7 @@ async function runDoctor(opts, io = consoleIo) {
         isOrgRepo: Boolean(cfg.sagaApiUrl),
         surface,
         cacheRoot: cursorCacheRoot,
-        cacheRootExists: (0, import_node_fs25.existsSync)(cursorCacheRoot),
+        cacheRootExists: (0, import_node_fs24.existsSync)(cursorCacheRoot),
         pins: cursorPins,
         hubCheckout: hubCheckoutForCursorSeed(),
         releasedVersion
@@ -22034,23 +21798,23 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path22.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path21.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs25.existsSync)(path2)) {
+    if ((0, import_node_fs24.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs25.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs24.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs25.existsSync)(path2)) (0, import_node_fs25.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs25.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs24.existsSync)(path2)) (0, import_node_fs24.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs24.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
@@ -22185,7 +21949,7 @@ async function applyGcPlan(plan2, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs26.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs25.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -22208,7 +21972,7 @@ async function applyGcPlan(plan2, remote) {
   for (const wt of plan2.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs26.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs25.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -22288,10 +22052,10 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs26.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs25.existsSync)(file) ? await (0, import_promises8.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
-      if (slash > 0) (0, import_node_fs26.mkdirSync)(file.slice(0, slash), { recursive: true });
+      if (slash > 0) (0, import_node_fs25.mkdirSync)(file.slice(0, slash), { recursive: true });
       await (0, import_promises8.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
@@ -22311,8 +22075,8 @@ async function runRulesPurge(opts, io = consoleIo) {
     return true;
   }
   const report = purgeSpine({
-    readFile: (p) => (0, import_node_fs26.existsSync)(p) ? (0, import_node_fs26.readFileSync)(p, "utf8") : null,
-    remove: (p) => (0, import_node_fs26.rmSync)(p, { force: true })
+    readFile: (p) => (0, import_node_fs25.existsSync)(p) ? (0, import_node_fs25.readFileSync)(p, "utf8") : null,
+    remove: (p) => (0, import_node_fs25.rmSync)(p, { force: true })
   });
   if (!opts.quiet) {
     for (const f of report.removed) io.log(`mmi-cli rules: removed org-delivered ${f}`);
@@ -22329,13 +22093,13 @@ rules.command("purge").option("--quiet", "stay silent unless something changed o
   if (!await runRulesPurge(opts)) process.exitCode = 1;
 });
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path23.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs26.existsSync)(path2) ? (0, import_node_fs26.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path22.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs25.existsSync)(path2) ? (0, import_node_fs25.readFileSync)(path2, "utf8") : null;
   const plan2 = planManagedGitignore(current);
   const drift = [...plan2.added.map((l) => `+${l}`), ...plan2.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan2.changed) {
-      (0, import_node_fs26.writeFileSync)(path2, plan2.content, "utf8");
+      (0, import_node_fs25.writeFileSync)(path2, plan2.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -22362,7 +22126,7 @@ async function runDocsSync(opts, io = consoleIo) {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs26.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs25.existsSync)(f) ? await (0, import_promises8.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
       await (0, import_promises8.writeFile)(f, c, "utf8");
     }
@@ -22377,7 +22141,6 @@ registerSagaCommands(program2);
 registerHandoffCommands(program2);
 registerCoopCommands(program2);
 registerOverlordCommands(program2);
-registerThrottleCommands(program2);
 program2.command("commands").description("print the command manifest \u2014 every subcommand + its flags (ground against this instead of guessing)").option("--json", "machine-readable JSON: { name, version, tree, index } \u2014 index is a flat list of every leaf command path").action((o) => {
   const manifest = buildCommandManifest(program2);
   consoleIo.log(o.json ? JSON.stringify(manifest, null, 2) : formatManifestHuman(manifest));
@@ -22515,7 +22278,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve6, reject) => {
-    const child = (0, import_node_child_process14.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child = (0, import_node_child_process13.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -22537,7 +22300,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path23.dirname)(out) : void 0;
+    return out ? (0, import_node_path22.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -22550,28 +22313,28 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
   };
 }
 function acquireWorktreeSetupLock(worktreeRoot) {
-  const lockPath = (0, import_node_path23.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
+  const lockPath = (0, import_node_path22.join)(worktreeRoot, ".mmi", "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs26.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs25.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs26.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs25.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs26.closeSync)(fd);
+      (0, import_node_fs25.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs26.rmSync)(lockPath, { force: true });
+        (0, import_node_fs25.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs26.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs26.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs25.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs25.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -22710,7 +22473,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process14.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process13.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -23060,7 +22823,7 @@ project.command("attest [owner/repo]").description("attest this repo's app-owned
   const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
   return reportWrite("project attest", res);
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and set it as --var secrets (robust for large maps)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -23070,6 +22833,14 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   }
   const slug = slugOf(target);
   const repo = target.includes("/") ? target : `mutmutco/${slug}`;
+  const vars = rawValues("--var");
+  if (o.secretsFile) {
+    try {
+      vars.push(`secrets=${(0, import_node_fs25.readFileSync)(o.secretsFile, "utf8")}`);
+    } catch (e) {
+      return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
+    }
+  }
   let patch;
   try {
     patch = buildProjectSetPatch({
@@ -23077,7 +22848,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
       projectType: o.projectType,
       deployModel: o.deployModel,
       releaseTrack: o.releaseTrack,
-      vars: rawValues("--var"),
+      vars,
       unsets: rawValues("--unset"),
       clearWebProfile: Boolean(o.clearWebProfile)
     });
@@ -23688,9 +23459,9 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   console.log(JSON.stringify(created));
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path23.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs26.existsSync)(wfDir)) return [];
-  return (0, import_node_fs26.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path22.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs25.existsSync)(wfDir)) return [];
+  return (0, import_node_fs25.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -23709,7 +23480,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs26.existsSync)(path2) ? (0, import_node_fs26.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs25.existsSync)(path2) ? (0, import_node_fs25.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -23846,7 +23617,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -23862,7 +23633,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises8.mkdir)((0, import_node_path23.dirname)(registryPath), { recursive: true });
+          await (0, import_promises8.mkdir)((0, import_node_path22.dirname)(registryPath), { recursive: true });
           await (0, import_promises8.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -23876,13 +23647,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs26.lstatSync)(p);
+      st = (0, import_node_fs25.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs26.readlinkSync)(p);
+      (0, import_node_fs25.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -23890,7 +23661,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs26.readdirSync)(p);
+      return (0, import_node_fs25.readdirSync)(p);
     } catch {
       return [];
     }
@@ -23899,9 +23670,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs26.rmdirSync)(p);
+      (0, import_node_fs25.rmdirSync)(p);
     } catch {
-      (0, import_node_fs26.unlinkSync)(p);
+      (0, import_node_fs25.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -23931,9 +23702,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs26.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs25.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs26.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs25.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -24006,7 +23777,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     } : await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs26.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs25.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -24203,7 +23974,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs26.writeSync)(1, `${value}
+  (0, import_node_fs25.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -24220,8 +23991,8 @@ async function resolveStage() {
     local,
     shell: shellFor(),
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs26.existsSync)((0, import_node_path23.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs26.existsSync)((0, import_node_path23.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs25.existsSync)((0, import_node_path22.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs25.existsSync)((0, import_node_path22.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -24685,7 +24456,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs26.existsSync)(path2) ? (0, import_node_fs26.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs25.existsSync)(path2) ? (0, import_node_fs25.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -24728,12 +24499,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs26.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs26.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs25.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs25.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile7 = (p) => (0, import_node_fs26.existsSync)(p) ? (0, import_node_fs26.readFileSync)(p, "utf8") : null;
+  const readFile7 = (p) => (0, import_node_fs25.existsSync)(p) ? (0, import_node_fs25.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -24980,16 +24751,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs26.existsSync)("projects.json") ? (0, import_node_fs26.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs25.existsSync)("projects.json") ? (0, import_node_fs25.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs26.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs26.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs25.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs25.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs26.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs26.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs25.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs25.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs26.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs26.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs25.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs25.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -25003,77 +24774,40 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
 ));
 program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk; loud one-line stderr at session start").option("--session-start", "run in user-scope SessionStart mode").action((opts) => runGuard({ sessionStart: opts.sessionStart }));
 program2.command("plugin-heal").description("reinstall + re-enable the MMI plugin (recover from a marketplace prune)").action(() => runPluginHeal());
-program2.command("session-start").description("run the SessionStart verbs (rules sync, Jervaise-only continuity, whoami, doctor, plan-store check) in one process; docs sync runs detached").action(async () => {
+program2.command("session-start").description("run the SessionStart verbs (rules purge, whoami, board slice, doctor) in one process; docs sync runs detached").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
     console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     return;
   }
   if (!isOrgRepoRoot(process.cwd())) return;
-  const continuityEnabled = (await continuityAccess().catch(() => ({ allowed: false }))).allowed;
-  if (continuityEnabled) {
-    try {
-      const hook = parseHookInput(await readStdin());
-      if (hook.session_id) persistSession(hook.session_id);
-    } catch (e) {
-      console.error(`[mmi-hook] saga session failed: ${e.message}`);
-    }
-  }
-  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
   spawnDeferredGcSweep();
-  let northstarInjected = false;
-  const { parallel, sequential } = buildSessionStartPlan(
-    {
-      rulesPurge: (io) => runRulesPurge({ quiet: true }, io),
-      sagaShow: (io) => runSagaShow({ quiet: true }, io),
-      handoffOffer: (io) => runHandoffOffer(io, { fast: true }),
-      coopPending: (io) => runCoopPendingBanner(io),
-      northstarContext: async (io) => {
-        const cfg = await loadConfig();
-        if (!cfg.sagaApiUrl) return;
-        const planDeps = makePlanDeps(cfg, io);
-        northstarInjected = await runNorthstarContext(io, {
-          loadPlans: () => scopedPlanList(planDeps),
-          readLocal: (slug) => planDeps.readLocal(slug),
-          // #1812: thread the saga HEAD's North Star anchor (its NEXT slug) into the relevance gate so
-          // the plan the agent is actively on is force-injected even on a generic branch with no token
-          // overlap. fetchSagaHead errors are swallowed via a silent io — a missing/failed HEAD just
-          // falls back to token-overlap scoring, never noises or blocks the banner.
-          gatherSignals: () => gatherRelevanceSignals({
-            anchorSlug: () => fetchSagaHead({ log: () => {
-            }, err: () => {
-            } }).then((h) => h?.anchor?.slug ?? void 0)
-          })
-        });
-      },
-      sagaHealth: (io) => runSagaHealth({ banner: true, quiet: true }, io),
-      // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
-      // when unknown — a missing gh login must not noise or fail the banner.
-      whoami: async (io) => {
-        const report = await resolveWhoami({
-          hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
-          ghLogin: githubLogin
-        });
-        const line = whoamiLine(report);
-        if (line) io.log(line);
-      },
-      boardSlice: (io) => runBoardSlice(io, {
-        loadConfig: () => loadConfigForRepo(),
-        readBoard,
-        // #1813: warm the slice cache out-of-band (detached, like docs sync) so the ~20s live read
-        // never costs banner time and next session's glance renders instantly within budget.
-        scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
-      }),
-      doctor: (io) => runDoctor({ banner: true }, io)
+  const { parallel, sequential } = buildSessionStartPlan({
+    rulesPurge: (io) => runRulesPurge({ quiet: true }, io),
+    // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
+    // when unknown — a missing gh login must not noise or fail the banner.
+    whoami: async (io) => {
+      const report = await resolveWhoami({
+        hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
+        ghLogin: githubLogin
+      });
+      const line = whoamiLine(report);
+      if (line) io.log(line);
     },
-    { continuityEnabled }
-  );
+    boardSlice: (io) => runBoardSlice(io, {
+      loadConfig: () => loadConfigForRepo(),
+      readBoard,
+      // #1813: warm the slice cache out-of-band (detached, like docs sync) so the ~20s live read
+      // never costs banner time and next session's glance renders instantly within budget.
+      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
+    }),
+    doctor: (io) => runDoctor({ banner: true }, io)
+  });
   await runSessionStart(parallel, sequential, consoleIo);
-  for (const line of sessionStartContinuityLines({ continuityEnabled, northstarInjected, cwd: process.cwd() })) consoleIo.log(line);
-  if (continuityEnabled) await runPlanAutosave(consoleIo, { quiet: true }).catch(() => void 0);
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
 });