@mutmutco/cli 3.2.0 → 3.4.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
@@ -3502,7 +3502,7 @@ async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
 }
 
 // src/index.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -3605,7 +3605,7 @@ function hardExit(code) {
 async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
-  await new Promise((resolve6) => setImmediate(resolve6));
+  await new Promise((resolve5) => setImmediate(resolve5));
   process.exit(code);
 }
 async function failGraceful(msg) {
@@ -3770,7 +3770,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -3914,8 +3914,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve6) => {
-    timer = setTimeout(resolve6, timeoutMs);
+  const timeout = new Promise((resolve5) => {
+    timer = setTimeout(resolve5, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -5257,7 +5257,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -5861,7 +5861,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -6265,11 +6265,10 @@ function parseOwnerRepo(repo) {
   if (owner.includes("\\") || name.includes("\\")) throw new Error("repo must be owner/repo");
   return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
 }
-var DEFAULT_INSTALL_CMD = "npm ci";
 var DEFAULT_GATE_CMD = "npm run check";
 var DEFAULT_GATE_PY_VERSION = "3.11";
 var GATE_RUNTIME_DEFAULTS = {
-  node: { cmd: DEFAULT_GATE_CMD, install: DEFAULT_INSTALL_CMD },
+  node: { cmd: DEFAULT_GATE_CMD, install: "npm ci" },
   python: { cmd: "pytest", install: 'pip install -e ".[dev]"' }
 };
 function gateSeedVars(cls, releaseTrack, runtime = "node") {
@@ -6311,7 +6310,6 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
   out.REPO_NAME ??= parsed.name;
   out.REPO_SLUG ??= parsed.slug;
   out.CLASS ??= cls;
-  out.INSTALL_CMD ??= DEFAULT_INSTALL_CMD;
   const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
   const runtime = out.GATE_RUNTIME === "python" ? "python" : "node";
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime))) {
@@ -7022,7 +7020,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   await sleep(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -7031,7 +7029,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -7164,7 +7162,7 @@ async function sweepDeferredWorktreesWithRetry(store, deps, opts = {}) {
   }
   return last;
 }
-var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function removeWorktreeWithRecovery(wtPath, deps) {
   const maxAttempts = deps.maxAttempts ?? 3;
   const backoff = deps.backoffMs ?? [250, 1e3];
@@ -8035,7 +8033,7 @@ var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process6.exe
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
 function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -8045,7 +8043,7 @@ function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
       child.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve6), graceMs);
+    const timer = setTimeout(() => finish(resolve5), graceMs);
     child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -8255,10 +8253,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve6(false));
-    srv.once("listening", () => srv.close(() => resolve6(true)));
+    srv.once("error", () => resolve5(false));
+    srv.once("listening", () => srv.close(() => resolve5(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -8469,7 +8467,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve6) => setTimeout(resolve6, 500));
+  await new Promise((resolve5) => setTimeout(resolve5, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -8490,7 +8488,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve6) => setTimeout(resolve6, 1e3));
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -8907,6 +8905,14 @@ ${line}
 `;
 }
 
+// src/issue-view-json.ts
+var DEFAULT_ISSUE_VIEW_FIELDS = "number,title,state,url,labels,author,assignees,milestone,body";
+function normalizeIssueViewJsonFields(tokens2) {
+  if (!tokens2 || tokens2.length === 0) return DEFAULT_ISSUE_VIEW_FIELDS;
+  const fields = tokens2.flatMap((token) => token.split(/[,\s]+/)).map((field) => field.trim()).filter(Boolean);
+  return fields.length ? fields.join(",") : DEFAULT_ISSUE_VIEW_FIELDS;
+}
+
 // src/sub-issue.ts
 function parseIssueRef(ref) {
   const trimmed = ref.trim();
@@ -9219,9 +9225,23 @@ function parseNpmVersion(stdout) {
 function staleTrainCliMessage(report, commandName) {
   return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`mmi-cli doctor --apply --no-repo-writes\` to update to ${report.releasedVersion}, then rerun ${commandName} so it uses the current train path`;
 }
-function versionAutoUpdateAction(report, hasPluginRoot) {
+async function resolveReleasedVersion(runners) {
+  try {
+    const npmVersion = parseNpmVersion(await runners.npm());
+    if (npmVersion) return { version: npmVersion, source: "npm" };
+  } catch {
+  }
+  try {
+    const ghVersion = parseManifestVersion(await runners.gh());
+    if (ghVersion) return { version: ghVersion, source: "gh" };
+  } catch {
+  }
+  return { version: void 0, source: "unavailable" };
+}
+function versionAutoUpdateAction(report, hasPluginRoot, releasedSource) {
   if (report.ok || report.staleAgainst !== "released") return "none";
-  return hasPluginRoot ? "plugin-pull" : "npm";
+  if (hasPluginRoot) return "plugin-pull";
+  return releasedSource === "gh" ? "npm-unreachable" : "npm";
 }
 
 // src/issue-related.ts
@@ -9493,7 +9513,7 @@ function bootstrapPlan(repo, repoClass) {
     { label: `apply branch protection / allowlist: ${protectedBranches}`, gated: true },
     { label: "attach GitHub Project v2 and register Hub registry META", gated: true },
     { label: "seed README.md and architecture.md", gated: true },
-    { label: "commit .cursor/rules/<repo>.mdc and .cursor/environment.json", gated: true },
+    { label: "commit .cursor/rules/<repo>.mdc", gated: true },
     { label: `register fanout target on ${repoClass === "content" ? "main" : "development"}`, gated: true }
   ];
 }
@@ -9787,7 +9807,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve5, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -9801,7 +9821,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve5}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -9967,7 +9987,7 @@ function requireProjectMetaForTrain(load, repo) {
 var CORRELATE_ATTEMPTS = 5;
 var CORRELATE_DELAY_MS = 1500;
 var CORRELATE_SKEW_SLACK_MS = 1e4;
-var defaultSleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
@@ -11133,7 +11153,7 @@ function clean2(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -11568,12 +11588,46 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag) {
   return { inFlight: null, superseded };
 }
 
-// src/release-announce.ts
-var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
+// src/slack-alert.ts
 var SSM_REGION = "eu-central-1";
 var SSM_TOKEN_PARAM = "/mmi-future/_org/slack/SLACK_BOT_TOKEN";
 var SSM_CHANNEL_PARAM = "/mmi-future/_org/slack/SLACK_ALERTS_CHANNEL";
 var SLACK_TIMEOUT_MS = 1e4;
+async function ssmParameter(deps, name, decrypt) {
+  const args = [
+    "ssm",
+    "get-parameter",
+    "--region",
+    SSM_REGION,
+    "--name",
+    name,
+    "--query",
+    "Parameter.Value",
+    "--output",
+    "text",
+    ...decrypt ? ["--with-decryption"] : []
+  ];
+  const value = (await deps.run("aws", args)).trim();
+  if (!value || value === "None") throw new Error(`SSM parameter ${name} is empty`);
+  return value;
+}
+async function postToAlertsChannel(deps, text) {
+  const token = await ssmParameter(deps, SSM_TOKEN_PARAM, true);
+  const channel = await ssmParameter(deps, SSM_CHANNEL_PARAM, false);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const res = await fetchImpl("https://slack.com/api/chat.postMessage", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
+    body: JSON.stringify({ channel, text, unfurl_links: false }),
+    signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!json.ok) throw new Error(`slack postMessage failed: ${json.error ?? `http ${res.status}`}`);
+  return { status: "posted", note: "posted to the alerts channel" };
+}
+
+// src/release-announce.ts
+var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
 var MAX_BULLETS = 6;
 var MAX_SUMMARY_LINES = 8;
 function neutralizeHubProductBrands(text) {
@@ -11648,24 +11702,6 @@ function formatAnnouncement(args) {
 function summaryFileLines(content) {
   return content.split("\n").map((l) => l.trim()).filter(Boolean).slice(0, MAX_SUMMARY_LINES).map((l) => escapeMrkdwn(neutralizeHubProductBrands(l.replace(/^[•*-]\s*/, "")))).filter(Boolean).map((l) => `\u2022 ${l}`);
 }
-async function ssmParameter(deps, name, decrypt) {
-  const args = [
-    "ssm",
-    "get-parameter",
-    "--region",
-    SSM_REGION,
-    "--name",
-    name,
-    "--query",
-    "Parameter.Value",
-    "--output",
-    "text",
-    ...decrypt ? ["--with-decryption"] : []
-  ];
-  const value = (await deps.run("aws", args)).trim();
-  if (!value || value === "None") throw new Error(`SSM parameter ${name} is empty`);
-  return value;
-}
 async function announceRelease(deps, args) {
   if (args.repo !== ANNOUNCE_REPO) {
     return { status: "skipped", note: `announce is Hub-only \u2014 ${args.repo} skipped` };
@@ -11687,18 +11723,8 @@ async function announceRelease(deps, args) {
     }
     if (lines.length === 0) lines = curateReleaseNotes(view.body ?? "");
     if (lines.length === 0) lines = ["\u2022 maintenance release \u2014 see the notes for details"];
-    const token = await ssmParameter(deps, SSM_TOKEN_PARAM, true);
-    const channel = await ssmParameter(deps, SSM_CHANNEL_PARAM, false);
     const text = formatAnnouncement({ repo: args.repo, tag: args.tag, lines, releaseUrl });
-    const fetchImpl = deps.fetchImpl ?? fetch;
-    const res = await fetchImpl("https://slack.com/api/chat.postMessage", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
-      body: JSON.stringify({ channel, text, unfurl_links: false }),
-      signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
-    });
-    const json = await res.json().catch(() => ({}));
-    if (!json.ok) throw new Error(`slack postMessage failed: ${json.error ?? `http ${res.status}`}`);
+    await postToAlertsChannel(deps, text);
     return { status: "announced", note: `announced ${args.tag} to the alerts channel` };
   } catch (e) {
     return { status: "failed", note: `announce failed (release unaffected): ${e.message}` };
@@ -12255,7 +12281,6 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       });
     }
   }
-  checks.push({ ok: await contentExists2(deps, repo, baseBranch, ".cursor/environment.json"), label: "Cursor environment committed" });
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
     ok: readme !== null && readme.includes("## Agent context"),
@@ -12508,6 +12533,19 @@ async function fetchTrainAuthority(repo, deps) {
     return { ok: false, error: e.message };
   }
 }
+async function mintWikiToken(repo, deps) {
+  const res = await postJson("/wiki-mint", { repo }, deps, "POST", { noRetry: true });
+  if (res.error) return { ok: false, error: res.error };
+  const body = res.body ?? {};
+  if (res.status === 426) return { ok: false, error: upgradeRequiredError({ status: 426 }, res.body) };
+  if (res.status === 403) return { ok: false, error: `master-admin only (HTTP 403)${body.error ? ` \u2014 ${body.error}` : ""}` };
+  if (res.status === 404) {
+    return { ok: false, error: "the Hub API did not recognize /wiki-mint (HTTP 404) \u2014 the deployed Hub predates this command; it answers once a Hub release carrying it is deployed" };
+  }
+  if (!res.ok) return { ok: false, error: `wiki-mint HTTP ${res.status}${body.error ? ` \u2014 ${body.error}` : ""}` };
+  if (!body.token || !body.expiresAt) return { ok: false, error: "malformed wiki-mint response (no token)" };
+  return { ok: true, mint: { token: body.token, expiresAt: body.expiresAt, repository: body.repository ?? repo, permissions: body.permissions ?? {} } };
+}
 async function fetchProjectsList(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -12645,6 +12683,118 @@ async function tenantDeploy(payload, deps) {
   return postJson("/tenant-deploy", payload, deps, "POST", { noRetry: true, timeoutMs: TENANT_DEPLOY_TIMEOUT_MS });
 }
 
+// src/wiki-publish-command.ts
+async function wikiPublish(deps, opts) {
+  if (!opts.pagesDir) {
+    deps.err("wiki publish: <pages-dir> is required");
+    return false;
+  }
+  const minted = await deps.mint(opts.repo);
+  if (!minted.ok) {
+    deps.err(`wiki publish failed: could not mint a scoped wiki token for ${opts.repo}: ${minted.error}`);
+    return false;
+  }
+  const ok = deps.publish({ repo: opts.repo, token: minted.mint.token, pagesDir: opts.pagesDir });
+  if (!ok) {
+    return false;
+  }
+  deps.log(`wiki published for ${opts.repo} (scoped token, expired/discarded)`);
+  return true;
+}
+
+// src/wiki-publish-git.ts
+var import_node_child_process8 = require("node:child_process");
+var import_node_fs13 = require("node:fs");
+var import_node_os5 = require("node:os");
+var import_node_path14 = require("node:path");
+var WIKI_STAMP_FILE = ".wiki-state.json";
+function redactWikiSecrets(msg) {
+  return msg.replace(/x-access-token:[^@\s]+@/gi, "x-access-token:***@").replace(/(AUTHORIZATION:\s*basic\s+)[A-Za-z0-9+/=]+/gi, "$1***");
+}
+function publishWikiViaGit(deps, opts) {
+  const dir = deps.mkdtemp();
+  const url = `https://github.com/${opts.repo}.wiki.git`;
+  const authArgs = [
+    "-c",
+    `http.extraheader=AUTHORIZATION: basic ${Buffer.from(`x-access-token:${opts.token}`).toString("base64")}`
+  ];
+  try {
+    deps.gitRun(["init", "-q"], dir);
+    deps.gitRun(["remote", "add", "origin", url], dir);
+    if (deps.gitProbe([...authArgs, "fetch", "--depth", "1", "origin", "master"], dir)) {
+      deps.gitRun(["reset", "--hard", "FETCH_HEAD"], dir);
+    }
+    let copied = 0;
+    for (const f of deps.readdir(opts.pagesDir)) {
+      if (f.endsWith(".md")) {
+        deps.copyFile((0, import_node_path14.join)(opts.pagesDir, f), (0, import_node_path14.join)(dir, f));
+        copied++;
+      }
+    }
+    if (!copied) {
+      deps.err(`wiki publish: no .md pages found in ${opts.pagesDir}`);
+      return false;
+    }
+    if (deps.fileExists((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE))) {
+      deps.copyFile((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE), (0, import_node_path14.join)(dir, WIKI_STAMP_FILE));
+    }
+    deps.gitRun(["add", "-A"], dir);
+    if (deps.gitProbe(["diff", "--cached", "--quiet"], dir)) {
+      deps.log("wiki publish: already up to date");
+      return true;
+    }
+    deps.gitRun(
+      [
+        "-c",
+        "user.email=mmi-github-app[bot]@users.noreply.github.com",
+        "-c",
+        "user.name=mmi-github-app[bot]",
+        "commit",
+        "-m",
+        "docs(wiki): refresh MMI Future project wiki"
+      ],
+      dir
+    );
+    try {
+      deps.gitRun([...authArgs, "push", "origin", "HEAD:master"], dir);
+    } catch (e) {
+      deps.err(
+        `wiki publish failed: push to ${opts.repo}.wiki.git rejected: ${redactWikiSecrets(e.message)} \u2014 if the wiki advanced before this push, re-run wiki publish to pick up the latest wiki state`
+      );
+      return false;
+    }
+    deps.log(`wiki publish: published ${copied} page(s) to ${opts.repo} wiki`);
+    return true;
+  } catch (e) {
+    deps.err(`wiki publish failed: ${redactWikiSecrets(e.message)}`);
+    return false;
+  } finally {
+    deps.rm(dir);
+  }
+}
+function realWikiGitPublishDeps() {
+  return {
+    mkdtemp: () => (0, import_node_fs13.mkdtempSync)((0, import_node_path14.join)((0, import_node_os5.tmpdir)(), "wiki-")),
+    readdir: (dir) => (0, import_node_fs13.readdirSync)(dir),
+    copyFile: (src, dest) => (0, import_node_fs13.copyFileSync)(src, dest),
+    fileExists: (p) => (0, import_node_fs13.existsSync)(p),
+    rm: (p) => (0, import_node_fs13.rmSync)(p, { recursive: true, force: true }),
+    gitProbe: (args, cwd) => {
+      try {
+        (0, import_node_child_process8.execFileSync)("git", args, { cwd, stdio: "pipe" });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    gitRun: (args, cwd) => {
+      (0, import_node_child_process8.execFileSync)("git", args, { cwd, stdio: "inherit" });
+    },
+    log: (msg) => console.log(msg),
+    err: (msg) => console.error(msg)
+  };
+}
+
 // src/project-readiness.ts
 function stagesForTrack(meta) {
   return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
@@ -13758,7 +13908,7 @@ function writeError(res) {
 }
 
 // src/secrets.ts
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var OWNER2 = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
@@ -13788,7 +13938,9 @@ function vaultPointer(slug) {
     slug,
     root,
     tiers: {
-      project: `${root}/{dev,rc,main}/*  (project-admin self-serve for this repo)`,
+      // #2482: a stageless catalog entry (stages: []) lives at the slug ROOT — one value per repo —
+      // alongside the staged tree for per-stage entries. Both are the same project-admin wall (#2032).
+      project: `${root}/<KEY>  (stageless, one value per repo)  +  ${root}/{dev,rc,main}/*  (staged entries)  (project-admin self-serve for this repo)`,
       org: [`/mmi-future/{shared,cloudflare,mmi-hub,...}/*  (org-infra, master-gated)`]
     },
     stages: ["dev", "rc", "main"],
@@ -14487,7 +14639,7 @@ async function secretsCopy(deps, opts) {
   return true;
 }
 function defaultSpawn(command, args, env) {
-  const r = (0, import_node_child_process8.spawnSync)(command, args, { stdio: "inherit", env });
+  const r = (0, import_node_child_process9.spawnSync)(command, args, { stdio: "inherit", env });
   if (r.error) throw r.error;
   return r.status ?? 1;
 }
@@ -14547,8 +14699,8 @@ async function secretsUse(deps, key, opts) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path15 = require("node:path");
 var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
 var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
@@ -14556,18 +14708,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path14.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path15.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path14.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path14.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path15.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path15.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs13.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs13.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs14.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs14.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -14633,7 +14785,7 @@ function registerSecretsCommands(program3) {
   secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
     let body;
     try {
-      body = (0, import_node_fs13.readFileSync)((0, import_node_path14.resolve)(o.file), "utf8");
+      body = (0, import_node_fs14.readFileSync)((0, import_node_path15.resolve)(o.file), "utf8");
     } catch (e) {
       return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
     }
@@ -14708,7 +14860,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs13.unlinkSync)((0, import_node_path14.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs14.unlinkSync)((0, import_node_path15.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -14797,11 +14949,11 @@ function registerEdgeCommands(program3) {
 }
 
 // src/doctor-run.ts
-var import_node_fs17 = require("node:fs");
-var import_node_child_process10 = require("node:child_process");
+var import_node_fs18 = require("node:fs");
+var import_node_child_process11 = require("node:child_process");
 var import_promises2 = require("node:fs/promises");
-var import_node_path17 = require("node:path");
-var import_node_os6 = require("node:os");
+var import_node_path18 = require("node:path");
+var import_node_os7 = require("node:os");
 
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
@@ -14813,140 +14965,20 @@ function buildPluginGuardDecision(i) {
 function buildGuardSessionStartLine(state, opts = {}) {
   if (state === "healthy" || state === "not-org") return { exitCode: 0 };
   const recovery = opts.recovery ?? "mmi-cli plugin-heal";
+  const restartHint = opts.restartHint ?? "restart your agent host / reload plugins";
   const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its marketplace/cache is unresolved";
   return {
-    line: `[mmi-guard] ${reason}; run ${recovery} and restart Claude Code / reload plugins.`,
+    line: `[mmi-guard] ${reason}; run ${recovery} and ${restartHint}.`,
     exitCode: 1
   };
 }
 
 // src/cursor-plugin-seed.ts
-var import_node_child_process9 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
-var import_node_os5 = require("node:os");
-var import_node_path15 = require("node:path");
+var import_node_child_process10 = require("node:child_process");
+var import_node_fs15 = require("node:fs");
+var import_node_os6 = require("node:os");
+var import_node_path16 = require("node:path");
 var import_node_util7 = require("node:util");
-function isSemverVersion(v) {
-  return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
-}
-var MMI_HUB_REPO = "mutmutco/MMI-Hub";
-var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
-var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
-var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process9.execFile);
-function gitFetchReleaseTagArgs(hubCheckout, tag) {
-  return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
-}
-function ghReleaseTarballApiArgs(tag) {
-  return ["api", `repos/${MMI_HUB_REPO}/tarball/refs/tags/${tag}`];
-}
-function cursorUserGlobalStatePath() {
-  if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path15.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path15.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
-  }
-  if (process.platform === "darwin") {
-    return (0, import_node_path15.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
-  }
-  return (0, import_node_path15.join)((0, import_node_os5.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
-}
-async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
-  const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs14.existsSync)(dbPath)) return void 0;
-  try {
-    const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
-      timeout: 5e3
-    });
-    const value = stdout.trim().toLowerCase();
-    if (value === "true") return true;
-    if (value === "false") return false;
-    return void 0;
-  } catch {
-    return void 0;
-  }
-}
-function syncDirContents(src, dest) {
-  (0, import_node_fs14.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs14.readdirSync)(dest)) {
-    (0, import_node_fs14.rmSync)((0, import_node_path15.join)(dest, name), { recursive: true, force: true });
-  }
-  (0, import_node_fs14.cpSync)(src, dest, { recursive: true });
-}
-function releaseTag(releasedVersion) {
-  return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
-}
-async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path15.join)(tmpRoot, "archive.tar");
-  try {
-    await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
-    await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
-      timeout: 6e4
-    });
-    await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path15.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs14.existsSync)((0, import_node_path15.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path15.join)(tmpRoot, "repo.tgz");
-  try {
-    (0, import_node_fs14.mkdirSync)(tmpRoot, { recursive: true });
-    const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
-      timeout: 12e4,
-      maxBuffer: 100 * 1024 * 1024,
-      encoding: "buffer",
-      windowsHide: true
-    });
-    (0, import_node_fs14.writeFileSync)(tarPath, stdout);
-    await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs14.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
-    if (!top) return void 0;
-    const pluginMmi = (0, import_node_path15.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs14.existsSync)((0, import_node_path15.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs14.mkdirSync)(tmpRoot, { recursive: true });
-  const tag = releaseTag(releasedVersion);
-  if (hubCheckout) {
-    const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
-    if (fromHub) return fromHub;
-  }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path15.join)(tmpRoot, "gh"));
-}
-function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
-  if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
-  return pins.filter((pin) => {
-    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty) return true;
-    if (isSemverVersion(pin.version) && compareVersions(pin.version, releasedVersion) < 0) return true;
-    return false;
-  });
-}
-function cursorPluginCacheSeedTargets(pins, releasedVersion, cacheRoot, cacheRootExists = false) {
-  const needing = cursorPluginPinsNeedingSeed(pins, releasedVersion);
-  if (needing.length > 0) return needing.map((pin) => pin.path);
-  if (pins.length === 0 && cacheRoot && cacheRootExists && isSemverVersion(releasedVersion)) {
-    return [(0, import_node_path15.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
-  }
-  return [];
-}
-async function applyCursorPluginCacheSeed(input) {
-  if (!isSemverVersion(input.releasedVersion)) return false;
-  const targets = cursorPluginCacheSeedTargets(input.pins, input.releasedVersion, input.cacheRoot, input.cacheRootExists);
-  if (targets.length === 0) return false;
-  const tmpRoot = await input.mkdtemp("mmi-cursor-seed-");
-  const source = await resolvePluginMmiSource(input.releasedVersion, input.hubCheckout, tmpRoot, input.execFileP);
-  if (!source) return false;
-  input.log(`  \u21BB seeding Cursor MMI plugin cache \u2192 ${input.releasedVersion}\u2026`);
-  for (const dest of targets) {
-    syncDirContents(source, dest);
-  }
-  (0, import_node_fs14.rmSync)(tmpRoot, { recursive: true, force: true });
-  return true;
-}
 
 // src/doctor.ts
 var GH_PROJECT_LOGIN_FIX = 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"';
@@ -15230,8 +15262,8 @@ function buildCursorPluginCacheCleanupCheck(input) {
     label: CURSOR_PLUGIN_CACHE_CLEANUP_LABEL,
     fix: CURSOR_PLUGIN_CACHE_CLEANUP_FIX
   };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
-  const semverPins = input.pins.filter((pin) => isSemverVersion2(pin.version));
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
+  const semverPins = input.pins.filter((pin) => isSemverVersion(pin.version));
   if (semverPins.length === 0) return base;
   const activeVersion = semverPins.map((pin) => pin.version).reduce((a, b) => compareVersions(a, b) >= 0 ? a : b);
   const protectedVersions = new Set(
@@ -15281,7 +15313,7 @@ function codexEnabledPluginVersionFromList(jsonText, pluginId = MMI_PLUGIN_ID) {
     const parsed = JSON.parse(jsonText);
     const rows = Array.isArray(parsed?.installed) ? parsed.installed : [];
     const row = rows.find((r) => r?.pluginId === pluginId && r.installed === true && r.enabled === true);
-    return isSemverVersion2(row?.version) ? row.version.trim().replace(/^v/, "") : void 0;
+    return isSemverVersion(row?.version) ? row.version.trim().replace(/^v/, "") : void 0;
   } catch {
     return void 0;
   }
@@ -15292,8 +15324,9 @@ function buildCodexActiveCacheCheck(input) {
     label: CODEX_ACTIVE_CACHE_LABEL,
     fix: CODEX_PLUGIN_RECOVERY
   };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
-  if (isSemverVersion2(input.codexActiveVersion)) {
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
+  if (input.codexPresent === false) return base;
+  if (isSemverVersion(input.codexActiveVersion)) {
     if (compareVersions(input.codexActiveVersion, input.releasedVersion) < 0) {
       return {
         ...base,
@@ -15305,11 +15338,11 @@ function buildCodexActiveCacheCheck(input) {
     }
     return { ...base, activeCacheVersion: input.codexActiveVersion, releasedVersion: input.releasedVersion };
   }
-  if (isSemverVersion2(input.codexRecordVersion) && compareVersions(input.codexRecordVersion, input.releasedVersion) < 0) {
+  if (isSemverVersion(input.codexRecordVersion) && compareVersions(input.codexRecordVersion, input.releasedVersion) < 0) {
     return base;
   }
   const activeCacheVersion = highestSemver(input.codexCacheVersions ?? []);
-  const cacheCurrent = isSemverVersion2(activeCacheVersion) && compareVersions(activeCacheVersion, input.releasedVersion) >= 0;
+  const cacheCurrent = isSemverVersion(activeCacheVersion) && compareVersions(activeCacheVersion, input.releasedVersion) >= 0;
   if (cacheCurrent) {
     return { ...base, activeCacheVersion, releasedVersion: input.releasedVersion };
   }
@@ -15388,7 +15421,7 @@ function buildSessionSkillRootCheck(input) {
   const sessionVersion = parseSessionSkillRootVersion(input.pluginRoot);
   if (!sessionVersion) return base;
   const activeCacheVersion = highestSemver(input.cacheVersions ?? []);
-  if (!isSemverVersion2(activeCacheVersion)) return { ...base, sessionVersion };
+  if (!isSemverVersion(activeCacheVersion)) return { ...base, sessionVersion };
   if (compareVersions(sessionVersion, activeCacheVersion) >= 0) {
     return { ...base, sessionVersion, activeCacheVersion };
   }
@@ -15470,7 +15503,8 @@ var PLUGIN_SURFACE_HEAL = {
     ],
     pluginRunner: "codex",
     fix: (surface) => `${CODEX_RECOVERY}   # then ${reloadAction(surface)}`,
-    updateRecipe: [CODEX_RECOVERY, "codex plugin list   # verify mmi@mutmutco shows the released version"]
+    updateRecipe: [CODEX_RECOVERY, "codex plugin list   # verify mmi@mutmutco shows the released version"],
+    guardRecovery: "$env:MMI_AGENT_SURFACE='codex'; mmi-cli plugin-heal"
   },
   cursor: {
     delivery: "cursor-cache",
@@ -15554,7 +15588,7 @@ function renderSurfaceGuide(label, steps) {
 }
 function highestSemver(versions) {
   return versions.reduce((best, v) => {
-    if (!isSemverVersion2(v)) return best;
+    if (!isSemverVersion(v)) return best;
     if (best === void 0) return v;
     return compareVersions(v, best) > 0 ? v : best;
   }, void 0);
@@ -15566,17 +15600,18 @@ function buildPluginUpdateReport(input) {
   const opencodePlugin = highestSemver(input.opencodePluginVersions ?? []);
   return {
     versions: {
-      ...isSemverVersion2(input.cliVersion) ? { cli: input.cliVersion } : {},
+      ...isSemverVersion(input.cliVersion) ? { cli: input.cliVersion } : {},
       ...claudePlugin ? { claudePlugin } : {},
       ...codexMarketplace ? { codexMarketplace } : {},
       ...codexActiveCache ? { codexActiveCache } : {},
       ...opencodePlugin ? { opencodePlugin } : {},
-      ...isSemverVersion2(input.releasedVersion) ? { released: input.releasedVersion } : {}
+      ...isSemverVersion(input.releasedVersion) ? { released: input.releasedVersion } : {},
+      ...input.releasedVersionSource ? { releasedSource: input.releasedVersionSource } : {}
     },
     recipes: PLUGIN_UPDATE_RECIPES
   };
 }
-function renderPluginUpdateReport(report) {
+function renderPluginVersionBlock(report) {
   const v = report.versions;
   const show = (x) => x ?? "unknown";
   const versionRows = [
@@ -15587,27 +15622,22 @@ function renderPluginUpdateReport(report) {
     ["OpenCode plugin", show(v.opencodePlugin)]
   ];
   const pad = Math.max(...versionRows.map(([label]) => label.length));
-  const lines = [
+  return [
     `MMI versions  (target release: ${show(v.released)})`,
-    ...versionRows.map(([label, value]) => `  ${label.padEnd(pad)}  ${value}`),
-    "",
-    "Update commands by surface"
+    ...versionRows.map(([label, value]) => `  ${label.padEnd(pad)}  ${value}`)
   ];
-  for (const surface of PLUGIN_GUIDE_SURFACES) {
-    lines.push(...renderSurfaceGuide(surface.label, report.recipes[surface.key]));
-  }
-  return lines;
 }
 function buildDoctorJsonPayload(input) {
   return {
-    ok: input.checks.every((c) => c.ok),
+    ok: doctorExitCode(input.checks) === 0,
+    hasAdvisories: input.checks.some((c) => !c.ok && isAdvisoryDoctorCheck(c)),
     checks: input.checks,
     updateReport: input.updateReport,
     ...input.resources.length ? { resources: input.resources } : {}
   };
 }
 var INSTALLED_PLUGIN_VERSION_LABEL = "installed MMI plugin version (vs latest release)";
-function isSemverVersion2(v) {
+function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
 }
 function staleRecordCommand(surface) {
@@ -15630,7 +15660,7 @@ function buildInstalledPluginVersionCheck(input) {
     fix: pluginRecoveryFix(input.surface),
     pluginId
   };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
   if (input.surface === "cursor") return base;
   const stale = [];
   let sawRecord = false;
@@ -15640,7 +15670,7 @@ function buildInstalledPluginVersionCheck(input) {
     if (!Array.isArray(records) || records.length === 0) continue;
     sawRecord = true;
     const installedVersion = bestRecord(records).version;
-    if (!isSemverVersion2(installedVersion)) continue;
+    if (!isSemverVersion(installedVersion)) continue;
     if (compareVersions(installedVersion, input.releasedVersion) >= 0) {
       currentVersion = currentVersion ?? installedVersion;
     } else {
@@ -15695,14 +15725,14 @@ function buildManagedPluginDriftCheck(input) {
     for (const source of input.sources) {
       if (source.directVersions && descriptor.id in source.directVersions) {
         const version2 = source.directVersions[descriptor.id];
-        if (isSemverVersion2(version2)) versions.push({ surface: source.surface, version: normalize(version2) });
+        if (isSemverVersion(version2)) versions.push({ surface: source.surface, version: normalize(version2) });
         continue;
       }
       const records = source.installed?.plugins?.[descriptor.id];
       if (!Array.isArray(records) || records.length === 0) continue;
       const recordVersion = bestRecord(records).version;
-      const version = isSemverVersion2(recordVersion) ? recordVersion : highestSemver(source.cacheVersions?.[descriptor.id] ?? []);
-      if (!isSemverVersion2(version)) continue;
+      const version = isSemverVersion(recordVersion) ? recordVersion : highestSemver(source.cacheVersions?.[descriptor.id] ?? []);
+      if (!isSemverVersion(version)) continue;
       versions.push({ surface: source.surface, version: normalize(version) });
     }
     if (versions.length < 2) continue;
@@ -15717,8 +15747,8 @@ var OPENCODE_VERSION_LABEL = "installed OpenCode MMI adapter version (vs latest
 function buildOpencodeVersionCheck(input) {
   const fix = pluginRecoveryFix("opencode");
   const base = { ok: true, label: OPENCODE_VERSION_LABEL, fix };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
-  if (!isSemverVersion2(input.installedVersion)) {
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
+  if (!isSemverVersion(input.installedVersion)) {
     return { ...base, ok: false, severityOverride: "hard", releasedVersion: input.releasedVersion };
   }
   if (compareVersions(input.installedVersion, input.releasedVersion) >= 0) {
@@ -15735,7 +15765,7 @@ function pickOpencodeActiveVersion(input) {
 }
 function planOpencodePluginCacheQuarantine(input) {
   if (!input.cacheExists) return { quarantine: false };
-  if (!isSemverVersion2(input.cacheVersion) || !isSemverVersion2(input.releasedVersion)) return { quarantine: false };
+  if (!isSemverVersion(input.cacheVersion) || !isSemverVersion(input.releasedVersion)) return { quarantine: false };
   if (compareVersions(input.cacheVersion, input.releasedVersion) < 0) {
     return { quarantine: true, cacheVersion: input.cacheVersion, releasedVersion: input.releasedVersion };
   }
@@ -15971,8 +16001,8 @@ function buildCursorPluginInstallCheck(input) {
       };
     }
   }
-  if (input.cacheRootExists && isSemverVersion2(input.releasedVersion) && input.pins.some((pin) => isSemverVersion2(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0)) {
-    const stale = input.pins.filter((pin) => isSemverVersion2(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0).map((pin) => `${pin.version} at ${pin.name}`).join(", ");
+  if (input.cacheRootExists && isSemverVersion(input.releasedVersion) && input.pins.some((pin) => isSemverVersion(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0)) {
+    const stale = input.pins.filter((pin) => isSemverVersion(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0).map((pin) => `${pin.version} at ${pin.name}`).join(", ");
     return {
       ...base,
       ok: false,
@@ -16166,18 +16196,19 @@ function isAdvisoryDoctorCheck(check) {
 function doctorExitCode(checks) {
   return checks.some((c) => !c.ok && !isAdvisoryDoctorCheck(c)) ? 1 : 0;
 }
-function renderPluginUpdateReportStaleOnly(report) {
+function renderPluginUpdateReportStaleOnly(report, allChecksPass = false) {
   const v = report.versions;
   const released = v.released;
   if (!released) return [];
-  const isStale = (current) => Boolean(current && isSemverVersion2(current) && compareVersions(current, released) < 0);
+  const isStale = (current) => Boolean(current && isSemverVersion(current) && compareVersions(current, released) < 0);
   const blocks = [];
   for (const surface of PLUGIN_GUIDE_SURFACES) {
     if (!surface.versionKeys.some((k) => isStale(v[k]))) continue;
     blocks.push(...renderSurfaceGuide(surface.label, report.recipes[surface.key]));
   }
   if (!blocks.length) return [];
-  return ["Update commands (stale surfaces):", ...blocks];
+  const heading = allChecksPass ? "Optional updates available (all checks passed):" : "Update commands (stale surfaces):";
+  return [heading, ...blocks];
 }
 var DOCTOR_VERBOSE_HINT = "Run mmi-cli doctor --verbose for the full audit checklist + version report.";
 function doctorCheckGlyph(check) {
@@ -16223,14 +16254,14 @@ function doctorHumanLines(input) {
   if (input.shouldApply && input.pluginReloadRequired) {
     lines.push("", `\u21BB ${input.reloadHint ?? "reload"} so the healed plugin/MCP installs load.`);
   }
-  const stale = renderPluginUpdateReportStaleOnly(input.updateReport);
+  const stale = renderPluginUpdateReportStaleOnly(input.updateReport, gaps.length === 0);
   if (stale.length) {
     lines.push("", ...stale);
   } else if (!input.verbose) {
     lines.push("", DOCTOR_VERBOSE_HINT);
   }
   if (!input.verbose) return lines;
-  lines.push("", ...renderPluginUpdateReport(input.updateReport));
+  lines.push("", ...renderPluginVersionBlock(input.updateReport));
   lines.push(
     "",
     doctorSummaryLine({ checks: input.checks, updateReport: input.updateReport, shouldApply: input.shouldApply, healedCount: input.healedCount }),
@@ -16293,7 +16324,7 @@ function buildPluginResolvabilityCheck(input) {
       return {
         ok: false,
         label: PLUGIN_RESOLVABILITY_LABEL,
-        fix: "run: mmi-cli plugin-heal",
+        fix: `run: ${PLUGIN_SURFACE_HEAL[surfaceToken(surface) ?? "claude"]?.recovery ?? PLUGIN_SURFACE_HEAL.claude.recovery}`,
         state
       };
     default: {
@@ -16303,6 +16334,176 @@ function buildPluginResolvabilityCheck(input) {
   }
 }
 
+// src/cursor-plugin-seed.ts
+function isSemverVersion2(v) {
+  return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
+}
+var MMI_HUB_REPO = "mutmutco/MMI-Hub";
+var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
+var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
+var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process10.execFile);
+function gitFetchReleaseTagArgs(hubCheckout, tag) {
+  return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
+}
+function ghReleaseTarballApiArgs(tag) {
+  return ["api", `repos/${MMI_HUB_REPO}/tarball/refs/tags/${tag}`];
+}
+function cursorUserGlobalStatePath() {
+  if (process.platform === "win32") {
+    const base = process.env.APPDATA || (0, import_node_path16.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path16.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+  }
+  if (process.platform === "darwin") {
+    return (0, import_node_path16.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+  }
+  return (0, import_node_path16.join)((0, import_node_os6.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+}
+async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
+  const dbPath = cursorUserGlobalStatePath();
+  if (!(0, import_node_fs15.existsSync)(dbPath)) return void 0;
+  try {
+    const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
+      timeout: 5e3
+    });
+    const value = stdout.trim().toLowerCase();
+    if (value === "true") return true;
+    if (value === "false") return false;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function syncDirContents(src, dest) {
+  (0, import_node_fs15.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs15.readdirSync)(dest)) {
+    (0, import_node_fs15.rmSync)((0, import_node_path16.join)(dest, name), { recursive: true, force: true });
+  }
+  (0, import_node_fs15.cpSync)(src, dest, { recursive: true });
+}
+function releaseTag(releasedVersion) {
+  return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
+}
+async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
+  const tarFile = (0, import_node_path16.join)(tmpRoot, "archive.tar");
+  try {
+    await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
+    await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
+      timeout: 6e4
+    });
+    await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
+    const pluginMmi = (0, import_node_path16.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs15.existsSync)((0, import_node_path16.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function downloadPluginMmiViaGh(tag, tmpRoot) {
+  const tarPath = (0, import_node_path16.join)(tmpRoot, "repo.tgz");
+  try {
+    (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
+    const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
+      timeout: 12e4,
+      maxBuffer: 100 * 1024 * 1024,
+      encoding: "buffer",
+      windowsHide: true
+    });
+    (0, import_node_fs15.writeFileSync)(tarPath, stdout);
+    await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
+    const top = (0, import_node_fs15.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    if (!top) return void 0;
+    const pluginMmi = (0, import_node_path16.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs15.existsSync)((0, import_node_path16.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
+  (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
+  const tag = releaseTag(releasedVersion);
+  if (hubCheckout) {
+    const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
+    if (fromHub) return fromHub;
+  }
+  return downloadPluginMmiViaGh(tag, (0, import_node_path16.join)(tmpRoot, "gh"));
+}
+function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
+  if (!isSemverVersion2(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
+  return pins.filter((pin) => {
+    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty) return true;
+    if (isSemverVersion2(pin.version) && compareVersions(pin.version, releasedVersion) < 0) return true;
+    return false;
+  });
+}
+function cursorPluginCacheSeedTargets(pins, releasedVersion, cacheRoot, cacheRootExists = false) {
+  const needing = cursorPluginPinsNeedingSeed(pins, releasedVersion);
+  if (needing.length > 0) return needing.map((pin) => pin.path);
+  if (pins.length === 0 && cacheRoot && cacheRootExists && isSemverVersion2(releasedVersion)) {
+    return [(0, import_node_path16.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
+  }
+  return [];
+}
+async function applyCursorPluginCacheSeed(input) {
+  if (!isSemverVersion2(input.releasedVersion)) return false;
+  const targets = cursorPluginCacheSeedTargets(input.pins, input.releasedVersion, input.cacheRoot, input.cacheRootExists);
+  if (targets.length === 0) return false;
+  const tmpRoot = await input.mkdtemp("mmi-cursor-seed-");
+  const source = await resolvePluginMmiSource(input.releasedVersion, input.hubCheckout, tmpRoot, input.execFileP);
+  if (!source) return false;
+  input.log(`  \u21BB seeding Cursor MMI plugin cache \u2192 ${input.releasedVersion}\u2026`);
+  for (const dest of targets) {
+    syncDirContents(source, dest);
+  }
+  (0, import_node_fs15.rmSync)(tmpRoot, { recursive: true, force: true });
+  return true;
+}
+var CURSOR_ENABLED_PIN_LABEL = "Cursor Team Marketplace enabled plugin pin";
+function cursorSplitBrainCapabilities() {
+  const skills = OPENCODE_WORKFLOW_COMMANDS.map((c) => `/${c}`).join(", ");
+  return `org skills (${skills}) and SessionStart hooks`;
+}
+function cursorEnabledPinRecovery() {
+  return "refresh the MMI Team Marketplace in Cursor Dashboard \u2192 Settings \u2192 Plugins (Update), or run `mmi-cli doctor --apply` to seed the enabled pin; then restart Cursor";
+}
+var CURSOR_FOUND_CACHED_MMI_RE = /Found cached plugin:\s*mmi\s+at\s+.*?[\\/]([0-9a-f]{6,40})\b/gi;
+var CURSOR_MMI_LOADED_RE = /loadClaudePlugin\s+mmi@mutmutco\s+loaded/i;
+var CURSOR_GIT_AUTH_FAIL_RE = /unable to get password from user/i;
+var CURSOR_SAFE_PIN_NAME_RE = /^[0-9a-zA-Z._-]+$/;
+function parseCursorPluginLog(text) {
+  let enabledPin;
+  for (const m of text.matchAll(CURSOR_FOUND_CACHED_MMI_RE)) enabledPin = m[1];
+  const loadSucceeded = CURSOR_MMI_LOADED_RE.test(text);
+  const loadFailed = CURSOR_GIT_AUTH_FAIL_RE.test(text) && !loadSucceeded;
+  return { enabledPin, loadSucceeded, loadFailed };
+}
+function buildCursorEnabledPinCheck(input) {
+  const label = CURSOR_ENABLED_PIN_LABEL;
+  const healthy = { ok: true, label, fix: "" };
+  if (!input.isOrgRepo) return healthy;
+  if (!input.enabledPin && !input.loadFailed) return healthy;
+  if (input.loadSucceeded && !input.loadFailed) return healthy;
+  const caps = cursorSplitBrainCapabilities();
+  if (input.loadFailed) {
+    return {
+      ok: false,
+      severityOverride: "hard",
+      label,
+      fix: `Cursor Team Marketplace failed to load mmi@mutmutco${input.enabledPin ? ` (${input.enabledPin})` : ""}: mmi-cli is on PATH and the Hub session is valid, but the MMI plugin did not load \u2014 ${caps} are UNAVAILABLE in Cursor. ${cursorEnabledPinRecovery()}`
+    };
+  }
+  const enabledDir = input.pins.find((p) => p.name === input.enabledPin);
+  const complete = !!enabledDir && !enabledDir.isEmpty && enabledDir.hasPluginJson && enabledDir.hasHooksJson;
+  if (!complete) {
+    const others = input.pins.filter((p) => p.name !== input.enabledPin && CURSOR_SAFE_PIN_NAME_RE.test(p.name)).map((p) => p.name);
+    return {
+      ok: false,
+      severityOverride: "hard",
+      label,
+      fix: `Cursor is configured to load mmi@mutmutco at commit ${input.enabledPin}, but that pin is ${enabledDir ? "incomplete" : "missing"} in the cache${others.length ? ` (a complete pin at ${others.join(", ")} is present but will NOT be loaded)` : ""} \u2014 ${caps} are unavailable in Cursor. ${cursorEnabledPinRecovery()}`
+    };
+  }
+  return healthy;
+}
+
 // src/mcp-reconcile.ts
 var PLAYWRIGHT_MCP_SPEC = {
   name: "playwright",
@@ -16347,6 +16548,7 @@ function extractTomlServer(content, spec) {
 }
 function detectMcpState(target, spec) {
   if (!target.present) return { target, state: "skip", action: "skip", reasons: [] };
+  if (target.format === "claude-cli") return detectClaudeCliMcpState(target, spec);
   if (target.content == null) {
     if (target.createWhenFileAbsent) return { target, state: "absent", action: "install", reasons: [] };
     return { target, state: "skip", action: "skip", reasons: [] };
@@ -16370,6 +16572,56 @@ function detectMcpState(target, spec) {
 function planMcpReconcile(targets, spec) {
   return targets.map((t) => detectMcpState(t, spec));
 }
+function parseClaudeMcpGetOutput(stdout) {
+  const commandMatch = /^\s*Command:\s*(.+)$/m.exec(stdout);
+  if (commandMatch == null) return null;
+  const argsMatch = /^\s*Args:\s*(.*)$/m.exec(stdout);
+  const env = {};
+  const lines = stdout.replace(/\r\n/g, "\n").split("\n");
+  const headerIdx = lines.findIndex((l) => /^\s*Environment:\s*$/.test(l));
+  if (headerIdx !== -1) {
+    for (const line of lines.slice(headerIdx + 1)) {
+      if (line.trim() === "") continue;
+      if (!/^[ \t]/.test(line)) break;
+      const kv = /^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+      if (kv != null) env[kv[1]] = kv[2];
+    }
+  }
+  return { command: commandMatch[1].trim(), args: (argsMatch?.[1] ?? "").trim(), env };
+}
+function detectClaudeCliMcpState(target, spec) {
+  if (target.content == null) {
+    return { target, state: "absent", action: "install", reasons: [] };
+  }
+  const matchedName = target.claudeCliMatchedName ?? spec.name;
+  const isLegacy = matchedName !== spec.name;
+  const parsed = parseClaudeMcpGetOutput(target.content);
+  if (parsed == null) {
+    const reasons2 = isLegacy ? ["legacy-name", "unparseable"] : ["unparseable"];
+    return { target, state: "drifted", action: "reconcile", reasons: reasons2, matchedName };
+  }
+  const reasons = [];
+  if (isLegacy) reasons.push("legacy-name");
+  if (textHasPlaywrightVisionCap(parsed.args)) reasons.push("vision-cap");
+  if (!textHasCanonicalPlaywrightOutputDir(parsed.args)) reasons.push("output-dir");
+  if (reasons.length === 0) return { target, state: "healthy", action: "none", reasons: [], matchedName };
+  return { target, state: "drifted", action: "reconcile", reasons, matchedName };
+}
+var CLAUDE_MCP_USER_SCOPE = "user";
+function planClaudeCliMcpHeal(item, spec) {
+  if (item.action !== "install" && item.action !== "reconcile") return [];
+  const commands = [];
+  if (item.action === "reconcile" && item.matchedName != null) {
+    commands.push({ op: "remove", args: ["remove", item.matchedName, "-s", CLAUDE_MCP_USER_SCOPE] });
+  }
+  const parsed = item.target.content != null ? parseClaudeMcpGetOutput(item.target.content) : null;
+  const envFlags = Object.entries(parsed?.env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+  commands.push({
+    op: "add",
+    args: ["add", spec.name, "-s", CLAUDE_MCP_USER_SCOPE, ...envFlags, "--", spec.command, ...spec.args]
+  });
+  return commands;
+}
 function buildMcpReconcileCheck(plan) {
   const base = {
     ok: true,
@@ -16560,9 +16812,9 @@ ${block}
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path16 = require("node:path");
 var import_node_fs16 = require("node:fs");
+var import_node_path17 = require("node:path");
+var import_node_fs17 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -16608,7 +16860,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path16.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path17.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -16628,18 +16880,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path16.isAbsolute)(raw) ? raw : (0, import_node_path16.resolve)(worktreePath, raw);
+  return (0, import_node_path17.isAbsolute)(raw) ? raw : (0, import_node_path17.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs16.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs17.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs15.readFileSync)((0, import_node_path16.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path16.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path16.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path16.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs16.readFileSync)((0, import_node_path17.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path17.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path17.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path17.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -16649,7 +16901,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs16.statSync)(path2);
+    (0, import_node_fs17.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -16658,10 +16910,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path16.join)(path2, ".git");
+  const gitPath = (0, import_node_path17.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs16.lstatSync)(gitPath);
+    st = (0, import_node_fs17.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -16678,7 +16930,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs15.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs16.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -16695,7 +16947,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs16.readdirSync)(path2) };
+    return { entries: (0, import_node_fs17.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -16714,8 +16966,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs16.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path16.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs17.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path17.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -16765,26 +17017,28 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
 }
 async function fetchReleasedVersion() {
-  try {
-    const { stdout } = await execFileP2("gh", pluginManifestVersionArgs(), { timeout: 5e3 });
-    return parseManifestVersion(stdout);
-  } catch {
-    return void 0;
-  }
+  return resolveReleasedVersion({
+    npm: async () => (await runHostBin("npm", npmReleasedVersionArgs(), { timeout: NPM_VIEW_TIMEOUT_MS })).stdout,
+    gh: async () => (await execFileP2("gh", pluginManifestVersionArgs(), { timeout: 5e3 })).stdout
+  });
 }
 var NPM_UPDATE_TIMEOUT_MS = 12e4;
 var NPM_VIEW_TIMEOUT_MS = 15e3;
 var PLUGIN_PULL_TIMEOUT_MS = 3e4;
-async function applyVersionAutoUpdate(report, log) {
-  const action = versionAutoUpdateAction(report, Boolean(process.env.CLAUDE_PLUGIN_ROOT));
+async function applyVersionAutoUpdate(report, log, releasedSource) {
+  const action = versionAutoUpdateAction(report, Boolean(process.env.CLAUDE_PLUGIN_ROOT), releasedSource);
   if (action === "none") return { report, applied: "none" };
   const target = report.releasedVersion ?? "latest";
+  if (action === "npm-unreachable") {
+    log(`  \u2717 mmi-cli ${report.currentVersion} is stale (released ${target}, resolved via gh) \u2014 npm registry unreachable this pass; when npm is back: npm install -g @mutmutco/cli@latest`);
+    return { report, applied: "none" };
+  }
   if (action === "plugin-pull") {
     try {
       const root = (await execFileP2("git", ["-C", process.env.CLAUDE_PLUGIN_ROOT, "rev-parse", "--show-toplevel"], { timeout: PLUGIN_PULL_TIMEOUT_MS })).stdout.trim();
@@ -16829,15 +17083,15 @@ function reexecAttemptOutcome(strategy, code) {
   return "result";
 }
 function spawnReexecAttempt(command, args, env) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     let settled = false;
     const done = (code) => {
       if (!settled) {
         settled = true;
-        resolve6(code);
+        resolve5(code);
       }
     };
-    const child = (0, import_node_child_process10.spawn)(command, args, { stdio: "inherit", env });
+    const child = (0, import_node_child_process11.spawn)(command, args, { stdio: "inherit", env });
     child.on("error", () => done(-1));
     child.on("exit", (code) => done(code ?? 0));
   });
@@ -16912,30 +17166,42 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs18.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
 }
+function marketplaceCloneCandidates(surface, home) {
+  if (surface === "codex") {
+    return [
+      (0, import_node_path18.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path18.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+    ];
+  }
+  return [(0, import_node_path18.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+}
+function marketplaceClonePresent(surface, home, exists = import_node_fs18.existsSync) {
+  return marketplaceCloneCandidates(surface, home).some(exists);
+}
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
   const installed = readInstalledPlugins(surface);
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: (0, import_node_fs17.existsSync)((0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
-    pluginCachePresent: (0, import_node_fs17.existsSync)((0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
+    pluginCachePresent: (0, import_node_fs18.existsSync)((0, import_node_path18.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path17.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs17.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs18.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -16948,8 +17214,8 @@ function managedPluginSurfaceSources() {
       const segments = parseManagedPluginId(descriptor.id);
       if (!segments) continue;
       try {
-        cacheVersions[descriptor.id] = (0, import_node_fs17.readdirSync)(
-          (0, import_node_path17.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "cache", segments.marketplace, segments.name),
+        cacheVersions[descriptor.id] = (0, import_node_fs18.readdirSync)(
+          (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "cache", segments.marketplace, segments.name),
           { withFileTypes: true }
         ).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
       } catch {
@@ -16969,8 +17235,8 @@ function managedPluginCursorDirectVersions() {
     const segments = parseManagedPluginId(descriptor.id);
     if (!segments) continue;
     try {
-      const versions = (0, import_node_fs17.readdirSync)(
-        (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", segments.marketplace, segments.name),
+      const versions = (0, import_node_fs18.readdirSync)(
+        (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", segments.marketplace, segments.name),
         { withFileTypes: true }
       ).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
       out[descriptor.id] = highestSemver(versions);
@@ -16989,7 +17255,7 @@ function managedPluginOpencodeDirectVersions() {
 }
 function readOpencodePackageVersionFrom(packageJsonPath) {
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(packageJsonPath, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(packageJsonPath, "utf8"));
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
   } catch {
     return void 0;
@@ -16999,14 +17265,14 @@ function readOpencodePackageVersion(packageName) {
   const [scope, name] = packageName.startsWith("@") ? packageName.slice(1).split("/", 2) : [void 0, packageName];
   if (!name) return void 0;
   const diskCandidates = [
-    (0, import_node_path17.join)(opencodeConfigDir(), "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"),
-    (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json")
+    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"),
+    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json")
   ];
   const diskVersion = diskCandidates.map(readOpencodePackageVersionFrom).find((v) => v !== void 0);
-  const packagesRoot = (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "packages", ...scope ? [`@${scope}`] : []);
+  const packagesRoot = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", ...scope ? [`@${scope}`] : []);
   let cacheVersion;
   try {
-    const cacheVersions = (0, import_node_fs17.readdirSync)(packagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${name}@`) && !e.name.startsWith(".")).map((e) => readOpencodePackageVersionFrom((0, import_node_path17.join)(packagesRoot, e.name, "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"))).filter((v) => Boolean(v));
+    const cacheVersions = (0, import_node_fs18.readdirSync)(packagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${name}@`) && !e.name.startsWith(".")).map((e) => readOpencodePackageVersionFrom((0, import_node_path18.join)(packagesRoot, e.name, "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"))).filter((v) => Boolean(v));
     if (cacheVersions.length) cacheVersion = cacheVersions.reduce((lowest, v) => compareVersions(v, lowest) < 0 ? v : lowest);
   } catch {
   }
@@ -17014,7 +17280,7 @@ function readOpencodePackageVersion(packageName) {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -17036,7 +17302,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs17.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs18.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17049,9 +17315,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs17.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs17.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17059,22 +17325,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".config", "opencode");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path17.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path18.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path17.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path18.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path17.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs17.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs18.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs17.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs18.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -17097,9 +17363,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan.action === "already") return true;
     if (!plan.text || plan.action === "unsafe") return false;
-    (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs17.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs17.writeFileSync)(path2, plan.text, "utf8");
+    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs18.writeFileSync)(path2, plan.text, "utf8");
     return true;
   } catch {
     return false;
@@ -17114,9 +17380,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs17.existsSync)(snapshot.path)) (0, import_node_fs17.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs17.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs18.existsSync)(snapshot.path)) (0, import_node_fs18.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs18.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17125,7 +17391,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs17.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs18.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -17133,9 +17399,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs18.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs17.writeFileSync)((0, import_node_path17.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs18.writeFileSync)((0, import_node_path18.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -17144,12 +17410,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path17.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -17165,7 +17431,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs17.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs18.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -17173,12 +17439,12 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   }
 }
 function opencodePackagesRoot() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
 }
 function opencodePluginCacheDirs() {
   const root = opencodePackagesRoot();
   try {
-    return (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path17.join)(root, e.name));
+    return (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path18.join)(root, e.name));
   } catch {
     return [];
   }
@@ -17186,7 +17452,7 @@ function opencodePluginCacheDirs() {
 function readOpencodeCacheDirVersion(cacheDir) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs17.readFileSync)((0, import_node_path17.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
+      (0, import_node_fs18.readFileSync)((0, import_node_path18.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
     );
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
   } catch {
@@ -17209,9 +17475,9 @@ function quarantineStaleOpencodePluginCaches(releasedVersion, log) {
     });
     if (!plan.quarantine) continue;
     try {
-      const quarantineRoot = (0, import_node_path17.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
-      (0, import_node_fs17.mkdirSync)(quarantineRoot, { recursive: true });
-      (0, import_node_fs17.renameSync)(cacheDir, (0, import_node_path17.join)(quarantineRoot, (0, import_node_path17.basename)(cacheDir)));
+      const quarantineRoot = (0, import_node_path18.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
+      (0, import_node_fs18.mkdirSync)(quarantineRoot, { recursive: true });
+      (0, import_node_fs18.renameSync)(cacheDir, (0, import_node_path18.join)(quarantineRoot, (0, import_node_path18.basename)(cacheDir)));
       log(`  \u21BB quarantined stale OpenCode plugin cache ${plan.cacheVersion} (< ${plan.releasedVersion}) \u2014 OpenCode reinstalls the current adapter on next start`);
       moved = true;
     } catch {
@@ -17237,30 +17503,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path17.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path17.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path18.join)((0, import_node_os7.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path18.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path17.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path17.join)(root, entry.name)).sort((a, b) => (0, import_node_fs17.statSync)(b).mtimeMs - (0, import_node_fs17.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path18.join)(root, entry.name)).sort((a, b) => (0, import_node_fs18.statSync)(b).mtimeMs - (0, import_node_fs18.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path17.join)(newest, "renderer.log");
-    const text = (0, import_node_fs17.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs17.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path18.join)(newest, "renderer.log");
+    const text = (0, import_node_fs18.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs18.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs17.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs18.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -17272,45 +17538,80 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs17.existsSync)(backupPath)) return false;
-    (0, import_node_fs17.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs18.existsSync)(backupPath)) return false;
+    (0, import_node_fs18.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+}
+function cursorLogsRoot() {
+  if (process.platform === "win32") return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "AppData", "Roaming", "Cursor", "logs");
+  if (process.platform === "darwin") return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "Cursor", "logs");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "Cursor", "logs");
+}
+function safeReaddirNames(dir) {
+  try {
+    return (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true }).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function readCursorPluginLogText() {
+  const root = cursorLogsRoot();
+  const sessions = safeReaddirNames(root).sort().reverse();
+  for (const session of sessions.slice(0, 5)) {
+    const sessionDir = (0, import_node_path18.join)(root, session);
+    const texts = [];
+    for (const win of safeReaddirNames(sessionDir).filter((n) => n.startsWith("window"))) {
+      const dir = (0, import_node_path18.join)(sessionDir, win, "exthost", "anysphere.cursor-agent-exec");
+      for (const file of safeReaddirNames(dir)) {
+        if (!/^Cursor Plugins.*\.log$/i.test(file)) continue;
+        const path2 = (0, import_node_path18.join)(dir, file);
+        try {
+          texts.push({ text: (0, import_node_fs18.readFileSync)(path2, "utf8"), mtime: (0, import_node_fs18.statSync)(path2).mtimeMs });
+        } catch {
+        }
+      }
+    }
+    if (texts.length) {
+      return texts.sort((a, b) => b.mtime - a.mtime).map((t) => t.text).join("\n");
+    }
+  }
+  return void 0;
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path17.join)(root, entry.name);
-      const pluginJson = (0, import_node_path17.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path17.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path17.join)(path2, "cli", "dist", "index.cjs");
-      const cursorHook = (0, import_node_path17.join)(path2, "scripts", "cursor-hook.mjs");
+    return (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path18.join)(root, entry.name);
+      const pluginJson = (0, import_node_path18.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path18.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path18.join)(path2, "cli", "dist", "index.cjs");
+      const cursorHook = (0, import_node_path18.join)(path2, "scripts", "cursor-hook.mjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs17.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs18.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs17.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs18.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs17.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs17.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs17.existsSync)(cliBundle),
-        hasCursorHookScript: (0, import_node_fs17.existsSync)(cursorHook),
+        hasPluginJson: (0, import_node_fs18.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs18.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs18.existsSync)(cliBundle),
+        hasCursorHookScript: (0, import_node_fs18.existsSync)(cursorHook),
         isEmpty,
         version
       };
@@ -17320,19 +17621,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path17.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs17.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path18.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs18.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path17.join)(root, entry.name),
+        path: (0, import_node_path18.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -17343,7 +17644,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs17.statSync)((0, import_node_path17.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs18.statSync)((0, import_node_path18.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -17354,10 +17655,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs17.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs18.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs17.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs18.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -17366,10 +17667,10 @@ function quarantinePluginCacheDirs(plan) {
   const failed = [];
   for (const move of plan) {
     try {
-      if (!(0, import_node_fs17.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs18.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(target), { recursive: true });
-      (0, import_node_fs17.renameSync)(move.from, target);
+      (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(target), { recursive: true });
+      (0, import_node_fs18.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -17388,23 +17689,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs17.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs18.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path17.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs17.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path18.join)((0, import_node_os7.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs18.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs17.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs18.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs17.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs18.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs17.existsSync)(targetPath);
+      return !(0, import_node_fs18.existsSync)(targetPath);
     }
-    (0, import_node_fs17.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs17.existsSync)(targetPath);
+    (0, import_node_fs18.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs18.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -17417,95 +17718,129 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path17.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path18.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs17.existsSync)(path2)) return null;
-    return (0, import_node_fs17.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs18.existsSync)(path2)) return null;
+    return (0, import_node_fs18.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function mcpDirExists(path2) {
   try {
-    return (0, import_node_fs17.existsSync)(path2);
+    return (0, import_node_fs18.existsSync)(path2);
   } catch {
     return false;
   }
 }
 function mcpConfigTargets() {
   const cwd = process.cwd();
-  const home = (0, import_node_os6.homedir)();
-  const cursorProjectDir = (0, import_node_path17.join)(cwd, ".cursor");
-  const cursorUserDir = (0, import_node_path17.join)(home, ".cursor");
-  const codexDir = (0, import_node_path17.join)(home, ".codex");
+  const home = (0, import_node_os7.homedir)();
+  const cursorProjectDir = (0, import_node_path18.join)(cwd, ".cursor");
+  const cursorUserDir = (0, import_node_path18.join)(home, ".cursor");
+  const codexDir = (0, import_node_path18.join)(home, ".codex");
   return [
     // Claude Code project MCP — reconciled if present, never conjured (org seeds .cursor/mcp.json, not this).
     {
       host: "claude-code",
       label: "Claude Code project MCP",
-      path: (0, import_node_path17.join)(cwd, ".mcp.json"),
+      path: (0, import_node_path18.join)(cwd, ".mcp.json"),
       format: "json",
       present: true,
       // parent is the repo root (cwd); the caller gates the whole reconcile on isOrgRepo
       isRepoFile: true,
       createWhenFileAbsent: false,
-      content: readTextFile((0, import_node_path17.join)(cwd, ".mcp.json"))
+      content: readTextFile((0, import_node_path18.join)(cwd, ".mcp.json"))
     },
     // Cursor project MCP — the bootstrap-seeded surface; restored if its .cursor dir exists but the file is gone.
     {
       host: "cursor-project",
       label: "Cursor project MCP",
-      path: (0, import_node_path17.join)(cursorProjectDir, "mcp.json"),
+      path: (0, import_node_path18.join)(cursorProjectDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorProjectDir),
       isRepoFile: true,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path17.join)(cursorProjectDir, "mcp.json"))
+      content: readTextFile((0, import_node_path18.join)(cursorProjectDir, "mcp.json"))
     },
     // Cursor user MCP — global; written only when Cursor is installed (~/.cursor exists).
     {
       host: "cursor-user",
       label: "Cursor user MCP",
-      path: (0, import_node_path17.join)(cursorUserDir, "mcp.json"),
+      path: (0, import_node_path18.join)(cursorUserDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorUserDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path17.join)(cursorUserDir, "mcp.json"))
+      content: readTextFile((0, import_node_path18.join)(cursorUserDir, "mcp.json"))
     },
     // Codex user config (TOML) — global; written only when Codex is installed (~/.codex exists).
     {
       host: "codex",
       label: "Codex user config",
-      path: (0, import_node_path17.join)(codexDir, "config.toml"),
+      path: (0, import_node_path18.join)(codexDir, "config.toml"),
       format: "toml",
       present: mcpDirExists(codexDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path17.join)(codexDir, "config.toml"))
+      content: readTextFile((0, import_node_path18.join)(codexDir, "config.toml"))
     }
   ];
 }
 function writeMcpConfigFile(path2, content) {
   try {
-    (0, import_node_fs17.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs18.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
+var CLAUDE_CLI_MCP_LABEL = "Claude Code MCP store (user scope)";
+var CLAUDE_CLI_MCP_PATH = "claude mcp (user scope)";
+async function claudeCliMcpTarget(spec) {
+  const base = {
+    host: "claude-cli",
+    label: CLAUDE_CLI_MCP_LABEL,
+    path: CLAUDE_CLI_MCP_PATH,
+    format: "claude-cli",
+    isRepoFile: false,
+    createWhenFileAbsent: true
+  };
+  if (!await hostBinAvailable("claude")) return { ...base, present: false, content: null };
+  for (const name of [spec.name, ...spec.legacyNames]) {
+    try {
+      const { stdout } = await runHostBin("claude", ["mcp", "get", name], { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
+      return { ...base, present: true, content: stdout, claudeCliMatchedName: name };
+    } catch {
+    }
+  }
+  return { ...base, present: true, content: null };
+}
+async function runClaudeCliMcpCommands(commands) {
+  for (const cmd of commands) {
+    try {
+      await runHostBin("claude", ["mcp", ...cmd.args], { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
 async function reconcileMcpRegistrations(input) {
   if (!input.isOrgRepo) return buildMcpReconcileCheck([]);
-  const targets = mcpConfigTargets();
+  const snapshot = async () => [...mcpConfigTargets(), await claudeCliMcpTarget(PLAYWRIGHT_MCP_SPEC)];
+  const targets = await snapshot();
   if (!input.apply) return buildMcpReconcileCheck(planMcpReconcile(targets, PLAYWRIGHT_MCP_SPEC));
-  const results = applyMcpReconcile(targets, PLAYWRIGHT_MCP_SPEC, {
+  const fileTargets = targets.filter((t) => t.format !== "claude-cli");
+  const results = applyMcpReconcile(fileTargets, PLAYWRIGHT_MCP_SPEC, {
     repoWritesAllowed: input.repoWritesAllowed,
     write: writeMcpConfigFile
   });
   for (const r of results) {
     if (r.outcome === "wrote") {
       input.onHealed();
+      input.onReloadRequired();
       const verb = r.action === "install" ? "registered" : "reconciled";
       input.log(`  \u21BB ${verb} Playwright MCP in ${r.target.path} \u2014 restart the host to load it`);
     } else if (r.outcome === "unparseable") {
@@ -17514,13 +17849,28 @@ async function reconcileMcpRegistrations(input) {
       input.log(`  \u26A0 ${r.target.label}: failed to write ${r.target.path}`);
     }
   }
-  return buildMcpReconcileCheck(planMcpReconcile(mcpConfigTargets(), PLAYWRIGHT_MCP_SPEC));
+  const claudeTarget = targets.find((t) => t.format === "claude-cli");
+  if (claudeTarget != null) {
+    const item = detectMcpState(claudeTarget, PLAYWRIGHT_MCP_SPEC);
+    if (item.action === "install" || item.action === "reconcile") {
+      const commands = planClaudeCliMcpHeal(item, PLAYWRIGHT_MCP_SPEC);
+      if (await runClaudeCliMcpCommands(commands)) {
+        input.onHealed();
+        input.onReloadRequired();
+        const verb = item.action === "install" ? "registered" : "reconciled";
+        input.log(`  \u21BB ${verb} Playwright MCP via \`claude mcp add\` (${CLAUDE_CLI_MCP_PATH}) \u2014 restart Claude Code to load it`);
+      } else {
+        input.log(`  \u26A0 ${CLAUDE_CLI_MCP_LABEL}: \`claude mcp add\` failed for ${PLAYWRIGHT_MCP_SPEC.name} \u2014 run it by hand`);
+      }
+    }
+  }
+  return buildMcpReconcileCheck(planMcpReconcile(await snapshot(), PLAYWRIGHT_MCP_SPEC));
 }
 function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs17.existsSync)((0, import_node_path17.join)(cwd, rel));
+      return (0, import_node_fs18.existsSync)((0, import_node_path18.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -17528,14 +17878,14 @@ function strayBrowserArtifactPaths() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs17.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs18.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs17.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs18.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -17553,7 +17903,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   const checks = [];
   const REWRITE_KEY = "url.https://github.com/.insteadOf";
   const CLONE_FIX = 'run: git config --global url."https://github.com/".insteadOf "git@github.com:"';
-  const [login, pathProbe, releasedVersion, cfg, callerArn, cloneProbe, isOrgRepo] = await Promise.all([
+  const [login, pathProbe, releasedVersionResolution, cfg, callerArn, cloneProbe, isOrgRepo] = await Promise.all([
     githubLogin(),
     execFileP2(isWin ? "where" : "which", ["mmi-cli"]).then(() => true).catch(() => false),
     fetchReleasedVersion(),
@@ -17565,6 +17915,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     // not the now-always-defaulted `cfg.sagaApiUrl`. Independent git read — resolved concurrently here.
     readOrigin ? isOrgRepoRoot(readOrigin) : isOrgRepoRoot()
   ]);
+  const releasedVersion = releasedVersionResolution.version;
   const surface = detectSurface(process.env);
   const versionReportProbe = buildVersionLagReport({
     currentVersion: resolveClientVersion(),
@@ -17576,7 +17927,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs17.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs18.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo,
     surface,
@@ -17611,7 +17962,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs17.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs18.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -17630,7 +17981,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   });
   let selfUpdatedCli = false;
   if (repairFull && !process.env[DOCTOR_POST_SELF_UPDATE_ENV]) {
-    const updated = await applyVersionAutoUpdate(versionReport, (m) => io.err(m));
+    const updated = await applyVersionAutoUpdate(versionReport, (m) => io.err(m), releasedVersionResolution.source);
     versionReport = updated.report;
     selfUpdatedCli = updated.applied === "npm";
   }
@@ -17758,7 +18109,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   checks.push(gitignoreCheck);
   checks.push(buildRepoLocalWorktreeCheck({
     isOrgRepo,
-    hasRepoLocalWorktrees: (0, import_node_fs17.existsSync)((0, import_node_path17.join)(process.cwd(), ".worktrees"))
+    hasRepoLocalWorktrees: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), ".worktrees"))
   }));
   let driftCheck = buildPluginConfigDriftCheck({ isOrgRepo, installed, surface });
   if (!driftCheck.ok && driftCheck.recordsToWrite && repairLocal) {
@@ -17978,15 +18329,16 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     };
   }
   checks.push(cacheCleanupCheck);
+  const canDriveCodex = surfaceToken(surface) === "codex" || await hostBinAvailable("codex");
   let codexActiveCacheCheck = buildCodexActiveCacheCheck({
     isOrgRepo,
     releasedVersion,
     codexCacheVersions: codexCacheVersions(),
     codexRecordVersion: codexRecordVersion(),
-    codexActiveVersion: await codexActiveVersion()
+    codexActiveVersion: await codexActiveVersion(),
+    codexPresent: canDriveCodex
   });
   if (!codexActiveCacheCheck.ok && repairFull) {
-    const canDriveCodex = surfaceToken(surface) === "codex" || await hostBinAvailable("codex");
     if (canDriveCodex && await applyPluginHeal("codex", surface, (m) => io.err(m), { force: true })) {
       markPluginReloadRequired();
       markHealed();
@@ -17996,7 +18348,8 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
         releasedVersion,
         codexCacheVersions: codexCacheVersions(),
         codexRecordVersion: codexRecordVersion(),
-        codexActiveVersion: await codexActiveVersion()
+        codexActiveVersion: await codexActiveVersion(),
+        codexPresent: canDriveCodex
       });
     }
   }
@@ -18046,7 +18399,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   }
   checks.push(nestedPluginTreeCheck);
   const cursorCacheRoot = cursorPluginCacheRoot();
-  const cursorCacheRootExists = (0, import_node_fs17.existsSync)(cursorCacheRoot);
+  const cursorCacheRootExists = (0, import_node_fs18.existsSync)(cursorCacheRoot);
   let cursorPins = cursorPluginCachePinSnapshots() ?? [];
   checks.push(
     buildCursorPluginCacheCleanupCheck({
@@ -18074,7 +18427,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       cacheRootExists: cursorCacheRootExists,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path17.join)((0, import_node_os6.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path18.join)((0, import_node_os7.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -18107,6 +18460,11 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     }
   }
   checks.push(cursorPluginCheck);
+  if (!opts.banner) {
+    const cursorLogText = readCursorPluginLogText();
+    const enabledPinSignal = cursorLogText ? parseCursorPluginLog(cursorLogText) : {};
+    checks.push(buildCursorEnabledPinCheck({ isOrgRepo, pins: cursorPins, ...enabledPinSignal }));
+  }
   const cursorThirdPartyEnabled = await readCursorThirdPartyExtensibilityEnabled(execFileP2);
   checks.push(
     buildCursorThirdPartyExtensibilityCheck({
@@ -18130,7 +18488,8 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
         apply: Boolean(opts.apply),
         repoWritesAllowed,
         log: (m) => io.err(m),
-        onHealed: markHealed
+        onHealed: markHealed,
+        onReloadRequired: markPluginReloadRequired
       })
     );
   }
@@ -18204,7 +18563,8 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
         codexPluginVersions: sourceVersions("codex"),
         codexCacheVersions: cacheVersionsFor("codex"),
         opencodePluginVersions: opencodePluginVersionsForReport(),
-        releasedVersion
+        releasedVersion,
+        releasedVersionSource: releasedVersionResolution.source
       });
     }
   });
@@ -18262,29 +18622,33 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path17.join)((0, import_node_os6.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path18.join)((0, import_node_os7.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs17.existsSync)(path2)) {
+    if ((0, import_node_fs18.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs17.existsSync)(path2)) (0, import_node_fs17.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs17.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs18.existsSync)(path2)) (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
     return "failed";
   }
 }
+function guardRecoveryCommand(surface) {
+  const token = surfaceToken(surface);
+  return token ? PLUGIN_SURFACE_HEAL[token]?.guardRecovery : void 0;
+}
 async function runGuard(opts = {}, readOrigin) {
   void opts;
   try {
@@ -18292,7 +18656,7 @@ async function runGuard(opts = {}, readOrigin) {
     const isOrgRepo = readOrigin ? await isOrgRepoRoot(readOrigin) : await isOrgRepoRoot();
     const input = snapshotPluginGuardInput(surface, isOrgRepo);
     const { state } = buildPluginGuardDecision(input);
-    const { line, exitCode } = buildGuardSessionStartLine(state);
+    const { line, exitCode } = buildGuardSessionStartLine(state, { recovery: guardRecoveryCommand(surface) });
     if (line) console.error(line);
     process.exitCode = exitCode;
   } catch {
@@ -18412,7 +18776,7 @@ async function applyGcPlan(plan, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs18.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -18435,7 +18799,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs18.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs19.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -18478,13 +18842,13 @@ var program2 = new Command();
 program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path18.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path19.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs18.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs19.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -18626,8 +18990,8 @@ function runWorktreeInstall(command, cwd, quiet) {
   const [bin, ...args] = command.split(" ");
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
-  return new Promise((resolve6, reject) => {
-    const child = (0, import_node_child_process11.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+  return new Promise((resolve5, reject) => {
+    const child = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -18641,7 +19005,7 @@ function runWorktreeInstall(command, cwd, quiet) {
     });
     child.on("exit", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve6();
+      if (code === 0) resolve5();
       else reject(new Error(`${command} exited ${code} in ${cwd}`));
     });
   });
@@ -18649,7 +19013,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path18.dirname)(out) : void 0;
+    return out ? (0, import_node_path19.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -18664,26 +19028,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs18.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs19.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs18.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs19.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs18.closeSync)(fd);
+      (0, import_node_fs19.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs18.rmSync)(lockPath, { force: true });
+        (0, import_node_fs19.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs18.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs18.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs19.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs19.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -18822,7 +19186,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process11.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process12.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -18915,8 +19279,8 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
 async function resolveDnsBounded(host, timeoutMs = 3e3) {
   const { lookup } = await import("node:dns/promises");
   const probe = lookup(host).then(() => true).catch((e) => dnsErrorToResolution(e?.code));
-  const timeout = new Promise((resolve6) => {
-    setTimeout(() => resolve6(void 0), timeoutMs).unref?.();
+  const timeout = new Promise((resolve5) => {
+    setTimeout(() => resolve5(void 0), timeoutMs).unref?.();
   });
   return Promise.race([probe, timeout]);
 }
@@ -19178,7 +19542,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const vars = rawValues("--var");
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs18.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs19.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -19466,18 +19830,20 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
     ...parentLinkFields(parent, parentLinkError)
   }));
 });
-issue.command("view <number>").description("read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json <fields>", "comma-separated gh --json field list (overrides the default field set)").action(async (number, o) => {
+issue.command("view <number>").description("read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("issue view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("issue view: could not resolve repo (pass --repo <owner/repo>)");
-  const fields = o.json && o.json.trim() ? o.json.trim() : "number,title,state,url,labels,author,assignees,milestone,body";
+  const fields = normalizeIssueViewJsonFields(o.json);
   try {
     const data = await ghJson(["issue", "view", String(n), "--repo", repo, "--json", fields]);
     console.log(JSON.stringify(data));
   } catch (e) {
     const err = e;
-    return fail(`issue view: ${(err.stderr || err.message || String(e)).trim()}`);
+    const raw = (err.stderr || err.message || String(e)).trim();
+    const argvNote = o.json ? ` (received --json argv: ${JSON.stringify(o.json)}, normalized to "${fields}")` : "";
+    return fail(`issue view: ${raw}${argvNote}`);
   }
 });
 issue.command("discover-related").description("find related issues for an existing issue and post only high-confidence links").requiredOption("--number <number>", "created issue number").requiredOption("--title <title>", "created issue title").requiredOption("--body <body>", "created issue body").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "print candidates instead of posting").action(async (o) => {
@@ -19746,9 +20112,9 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path18.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs18.existsSync)(wfDir)) return [];
-  return (0, import_node_fs18.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path19.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs19.existsSync)(wfDir)) return [];
+  return (0, import_node_fs19.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -19767,7 +20133,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -19797,7 +20163,7 @@ pr.command("checks-wait <number>").description("bounded wait for PR checks; skip
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
-    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
   });
   if (o.json) printLine(JSON.stringify(result));
   else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
@@ -19824,7 +20190,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
-      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
+      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
     }),
     // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
@@ -19875,7 +20241,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       while (Date.now() < deadlineMs) {
         const stateRead = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 })).stdout, { retries: 2, delayMs: 1e3 });
         if (stateRead.ok && stateRead.state === "MERGED") return true;
-        await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
+        await new Promise((resolve5) => setTimeout(resolve5, PR_LAND_POLL_MS));
       }
       return false;
     }
@@ -19919,7 +20285,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -19935,7 +20301,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
+          await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(registryPath), { recursive: true });
           await (0, import_promises3.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -19949,13 +20315,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs18.lstatSync)(p);
+      st = (0, import_node_fs19.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs18.readlinkSync)(p);
+      (0, import_node_fs19.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -19963,7 +20329,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs18.readdirSync)(p);
+      return (0, import_node_fs19.readdirSync)(p);
     } catch {
       return [];
     }
@@ -19972,9 +20338,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs18.rmdirSync)(p);
+      (0, import_node_fs19.rmdirSync)(p);
     } catch {
-      (0, import_node_fs18.unlinkSync)(p);
+      (0, import_node_fs19.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises3.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -19989,7 +20355,7 @@ async function resolvePrimaryCheckout(execGit) {
 function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
-    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover)
   };
 }
@@ -20004,9 +20370,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs18.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs19.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs18.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs19.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -20072,7 +20438,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs18.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20293,7 +20659,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs18.writeSync)(1, `${value}
+  (0, import_node_fs19.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -20307,8 +20673,8 @@ async function resolveStage() {
   const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
   return decideStage({
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -20741,6 +21107,22 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
   }
   if (!audit.ok) process.exitCode = 1;
 });
+var wiki = program2.command("wiki").description("release wiki lane \u2014 publish generated pages via a short-lived, repo-scoped minted token");
+wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:write token (master-gated) and publish the generated .md pages to <repo>.wiki.git; the token stays in memory (never printed/committed). Runs from any org repo checkout \u2014 the publisher ships inside mmi-cli, no repo-local script required. Fails loud on the credential gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").action(async (pagesDir, o) => {
+  const repo = await resolveRepo(o.repo);
+  if (!repo) return fail("wiki publish: could not determine the target repo (pass --repo owner/name)");
+  const cfg = await loadConfig();
+  const ok = await wikiPublish(
+    {
+      mint: (r) => mintWikiToken(r, registryClientDeps(cfg)),
+      publish: (o2) => publishWikiViaGit(realWikiGitPublishDeps(), o2),
+      log: (msg) => console.log(msg),
+      err: (msg) => console.error(msg)
+    },
+    { repo, pagesDir }
+  );
+  if (!ok) process.exitCode = 1;
+});
 var bootstrap = program2.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").option("--class <class>", "deployable | content", "deployable").option("--json", "machine-readable output").option("--apply", "reserved for future bootstrap execution after explicit master-admin approval").action((o) => {
   if (!o.repo) return fail("bootstrap: required option --repo <owner/repo> not specified");
   if (o.apply) return fail("bootstrap: execution is not implemented yet; use the dry-run plan and the existing /bootstrap skill");
@@ -20760,7 +21142,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -20811,12 +21193,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs18.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs18.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile2 = (p) => (0, import_node_fs18.existsSync)(p) ? (0, import_node_fs18.readFileSync)(p, "utf8") : null;
+  const readFile2 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -21113,16 +21495,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs18.existsSync)("projects.json") ? (0, import_node_fs18.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs19.existsSync)("projects.json") ? (0, import_node_fs19.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs18.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs18.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs19.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs19.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs18.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs18.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs19.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs19.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs18.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs18.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs19.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs19.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -21159,7 +21541,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       readBoard,
       // #1813: warm the slice cache out-of-band (detached) so the ~20s live read
       // never costs banner time and next session's glance renders instantly within budget.
-      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
+      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),
     doctor: (io) => runDoctor({ banner: true }, io)
   });
@@ -21167,7 +21549,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
 });