@mutmutco/cli 3.3.0 → 3.5.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
@@ -3502,7 +3502,7 @@ async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
 }
 
 // src/index.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -3605,7 +3605,7 @@ function hardExit(code) {
 async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
-  await new Promise((resolve6) => setImmediate(resolve6));
+  await new Promise((resolve5) => setImmediate(resolve5));
   process.exit(code);
 }
 async function failGraceful(msg) {
@@ -3770,7 +3770,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -3914,8 +3914,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve6) => {
-    timer = setTimeout(resolve6, timeoutMs);
+  const timeout = new Promise((resolve5) => {
+    timer = setTimeout(resolve5, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -5257,7 +5257,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -5861,7 +5861,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -6265,11 +6265,10 @@ function parseOwnerRepo(repo) {
   if (owner.includes("\\") || name.includes("\\")) throw new Error("repo must be owner/repo");
   return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
 }
-var DEFAULT_INSTALL_CMD = "npm ci";
 var DEFAULT_GATE_CMD = "npm run check";
 var DEFAULT_GATE_PY_VERSION = "3.11";
 var GATE_RUNTIME_DEFAULTS = {
-  node: { cmd: DEFAULT_GATE_CMD, install: DEFAULT_INSTALL_CMD },
+  node: { cmd: DEFAULT_GATE_CMD, install: "npm ci" },
   python: { cmd: "pytest", install: 'pip install -e ".[dev]"' }
 };
 function gateSeedVars(cls, releaseTrack, runtime = "node") {
@@ -6311,7 +6310,6 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
   out.REPO_NAME ??= parsed.name;
   out.REPO_SLUG ??= parsed.slug;
   out.CLASS ??= cls;
-  out.INSTALL_CMD ??= DEFAULT_INSTALL_CMD;
   const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
   const runtime = out.GATE_RUNTIME === "python" ? "python" : "node";
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime))) {
@@ -7022,7 +7020,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   await sleep(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -7031,7 +7029,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -7164,7 +7162,7 @@ async function sweepDeferredWorktreesWithRetry(store, deps, opts = {}) {
   }
   return last;
 }
-var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function removeWorktreeWithRecovery(wtPath, deps) {
   const maxAttempts = deps.maxAttempts ?? 3;
   const backoff = deps.backoffMs ?? [250, 1e3];
@@ -8035,7 +8033,7 @@ var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process6.exe
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
 function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -8045,7 +8043,7 @@ function waitForProcessStability(child, graceMs = EARLY_EXIT_GRACE_MS) {
       child.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve6), graceMs);
+    const timer = setTimeout(() => finish(resolve5), graceMs);
     child.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -8255,10 +8253,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve6(false));
-    srv.once("listening", () => srv.close(() => resolve6(true)));
+    srv.once("error", () => resolve5(false));
+    srv.once("listening", () => srv.close(() => resolve5(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -8469,7 +8467,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve6) => setTimeout(resolve6, 500));
+  await new Promise((resolve5) => setTimeout(resolve5, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -8490,7 +8488,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve6) => setTimeout(resolve6, 1e3));
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -8907,6 +8905,14 @@ ${line}
 `;
 }
 
+// src/issue-view-json.ts
+var DEFAULT_ISSUE_VIEW_FIELDS = "number,title,state,url,labels,author,assignees,milestone,body";
+function normalizeIssueViewJsonFields(tokens2) {
+  if (!tokens2 || tokens2.length === 0) return DEFAULT_ISSUE_VIEW_FIELDS;
+  const fields = tokens2.flatMap((token) => token.split(/[,\s]+/)).map((field) => field.trim()).filter(Boolean);
+  return fields.length ? fields.join(",") : DEFAULT_ISSUE_VIEW_FIELDS;
+}
+
 // src/sub-issue.ts
 function parseIssueRef(ref) {
   const trimmed = ref.trim();
@@ -9507,7 +9513,7 @@ function bootstrapPlan(repo, repoClass) {
     { label: `apply branch protection / allowlist: ${protectedBranches}`, gated: true },
     { label: "attach GitHub Project v2 and register Hub registry META", gated: true },
     { label: "seed README.md and architecture.md", gated: true },
-    { label: "commit .cursor/rules/<repo>.mdc and .cursor/environment.json", gated: true },
+    { label: "commit .cursor/rules/<repo>.mdc", gated: true },
     { label: `register fanout target on ${repoClass === "content" ? "main" : "development"}`, gated: true }
   ];
 }
@@ -9801,7 +9807,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve5, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -9815,7 +9821,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve5}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -9981,7 +9987,7 @@ function requireProjectMetaForTrain(load, repo) {
 var CORRELATE_ATTEMPTS = 5;
 var CORRELATE_DELAY_MS = 1500;
 var CORRELATE_SKEW_SLACK_MS = 1e4;
-var defaultSleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
@@ -10898,7 +10904,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
 }
 async function runTenantRedeploy(deps, options) {
   const { stage: stage2 } = options;
-  const ref = options.ref ?? stage2;
+  const ref = options.ref ?? (stage2 === "dev" ? "development" : stage2);
   const watch = options.watch ?? false;
   const repo = options.repo;
   const [owner, name] = repo.split("/");
@@ -11147,7 +11153,7 @@ function clean2(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -11582,12 +11588,46 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag) {
   return { inFlight: null, superseded };
 }
 
-// src/release-announce.ts
-var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
+// src/slack-alert.ts
 var SSM_REGION = "eu-central-1";
 var SSM_TOKEN_PARAM = "/mmi-future/_org/slack/SLACK_BOT_TOKEN";
 var SSM_CHANNEL_PARAM = "/mmi-future/_org/slack/SLACK_ALERTS_CHANNEL";
 var SLACK_TIMEOUT_MS = 1e4;
+async function ssmParameter(deps, name, decrypt) {
+  const args = [
+    "ssm",
+    "get-parameter",
+    "--region",
+    SSM_REGION,
+    "--name",
+    name,
+    "--query",
+    "Parameter.Value",
+    "--output",
+    "text",
+    ...decrypt ? ["--with-decryption"] : []
+  ];
+  const value = (await deps.run("aws", args)).trim();
+  if (!value || value === "None") throw new Error(`SSM parameter ${name} is empty`);
+  return value;
+}
+async function postToAlertsChannel(deps, text) {
+  const token = await ssmParameter(deps, SSM_TOKEN_PARAM, true);
+  const channel = await ssmParameter(deps, SSM_CHANNEL_PARAM, false);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const res = await fetchImpl("https://slack.com/api/chat.postMessage", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
+    body: JSON.stringify({ channel, text, unfurl_links: false }),
+    signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!json.ok) throw new Error(`slack postMessage failed: ${json.error ?? `http ${res.status}`}`);
+  return { status: "posted", note: "posted to the alerts channel" };
+}
+
+// src/release-announce.ts
+var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
 var MAX_BULLETS = 6;
 var MAX_SUMMARY_LINES = 8;
 function neutralizeHubProductBrands(text) {
@@ -11662,24 +11702,6 @@ function formatAnnouncement(args) {
 function summaryFileLines(content) {
   return content.split("\n").map((l) => l.trim()).filter(Boolean).slice(0, MAX_SUMMARY_LINES).map((l) => escapeMrkdwn(neutralizeHubProductBrands(l.replace(/^[•*-]\s*/, "")))).filter(Boolean).map((l) => `\u2022 ${l}`);
 }
-async function ssmParameter(deps, name, decrypt) {
-  const args = [
-    "ssm",
-    "get-parameter",
-    "--region",
-    SSM_REGION,
-    "--name",
-    name,
-    "--query",
-    "Parameter.Value",
-    "--output",
-    "text",
-    ...decrypt ? ["--with-decryption"] : []
-  ];
-  const value = (await deps.run("aws", args)).trim();
-  if (!value || value === "None") throw new Error(`SSM parameter ${name} is empty`);
-  return value;
-}
 async function announceRelease(deps, args) {
   if (args.repo !== ANNOUNCE_REPO) {
     return { status: "skipped", note: `announce is Hub-only \u2014 ${args.repo} skipped` };
@@ -11701,18 +11723,8 @@ async function announceRelease(deps, args) {
     }
     if (lines.length === 0) lines = curateReleaseNotes(view.body ?? "");
     if (lines.length === 0) lines = ["\u2022 maintenance release \u2014 see the notes for details"];
-    const token = await ssmParameter(deps, SSM_TOKEN_PARAM, true);
-    const channel = await ssmParameter(deps, SSM_CHANNEL_PARAM, false);
     const text = formatAnnouncement({ repo: args.repo, tag: args.tag, lines, releaseUrl });
-    const fetchImpl = deps.fetchImpl ?? fetch;
-    const res = await fetchImpl("https://slack.com/api/chat.postMessage", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
-      body: JSON.stringify({ channel, text, unfurl_links: false }),
-      signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
-    });
-    const json = await res.json().catch(() => ({}));
-    if (!json.ok) throw new Error(`slack postMessage failed: ${json.error ?? `http ${res.status}`}`);
+    await postToAlertsChannel(deps, text);
     return { status: "announced", note: `announced ${args.tag} to the alerts channel` };
   } catch (e) {
     return { status: "failed", note: `announce failed (release unaffected): ${e.message}` };
@@ -12269,7 +12281,6 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       });
     }
   }
-  checks.push({ ok: await contentExists2(deps, repo, baseBranch, ".cursor/environment.json"), label: "Cursor environment committed" });
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
     ok: readme !== null && readme.includes("## Agent context"),
@@ -12678,26 +12689,112 @@ async function wikiPublish(deps, opts) {
     deps.err("wiki publish: <pages-dir> is required");
     return false;
   }
-  const script = deps.scriptPath();
-  if (!deps.scriptExists(script)) {
-    deps.err(`wiki publish: publish script not found at ${script} \u2014 run from the repo checkout root`);
-    return false;
-  }
   const minted = await deps.mint(opts.repo);
   if (!minted.ok) {
     deps.err(`wiki publish failed: could not mint a scoped wiki token for ${opts.repo}: ${minted.error}`);
     return false;
   }
-  const env = { ...process.env, WIKI_REPO: opts.repo, WIKI_TOKEN: minted.mint.token };
-  const code = deps.spawn("node", [script, opts.pagesDir], env);
-  if (code !== 0) {
-    deps.err(`wiki publish failed: publish script exited ${code} (token was scoped to ${opts.repo}, contents:write, expires ${minted.mint.expiresAt})`);
+  const ok = deps.publish({ repo: opts.repo, token: minted.mint.token, pagesDir: opts.pagesDir });
+  if (!ok) {
     return false;
   }
   deps.log(`wiki published for ${opts.repo} (scoped token, expired/discarded)`);
   return true;
 }
 
+// src/wiki-publish-git.ts
+var import_node_child_process8 = require("node:child_process");
+var import_node_fs13 = require("node:fs");
+var import_node_os5 = require("node:os");
+var import_node_path14 = require("node:path");
+var WIKI_STAMP_FILE = ".wiki-state.json";
+function redactWikiSecrets(msg) {
+  return msg.replace(/x-access-token:[^@\s]+@/gi, "x-access-token:***@").replace(/(AUTHORIZATION:\s*basic\s+)[A-Za-z0-9+/=]+/gi, "$1***");
+}
+function publishWikiViaGit(deps, opts) {
+  const dir = deps.mkdtemp();
+  const url = `https://github.com/${opts.repo}.wiki.git`;
+  const authArgs = [
+    "-c",
+    `http.extraheader=AUTHORIZATION: basic ${Buffer.from(`x-access-token:${opts.token}`).toString("base64")}`
+  ];
+  try {
+    deps.gitRun(["init", "-q"], dir);
+    deps.gitRun(["remote", "add", "origin", url], dir);
+    if (deps.gitProbe([...authArgs, "fetch", "--depth", "1", "origin", "master"], dir)) {
+      deps.gitRun(["reset", "--hard", "FETCH_HEAD"], dir);
+    }
+    let copied = 0;
+    for (const f of deps.readdir(opts.pagesDir)) {
+      if (f.endsWith(".md")) {
+        deps.copyFile((0, import_node_path14.join)(opts.pagesDir, f), (0, import_node_path14.join)(dir, f));
+        copied++;
+      }
+    }
+    if (!copied) {
+      deps.err(`wiki publish: no .md pages found in ${opts.pagesDir}`);
+      return false;
+    }
+    if (deps.fileExists((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE))) {
+      deps.copyFile((0, import_node_path14.join)(opts.pagesDir, WIKI_STAMP_FILE), (0, import_node_path14.join)(dir, WIKI_STAMP_FILE));
+    }
+    deps.gitRun(["add", "-A"], dir);
+    if (deps.gitProbe(["diff", "--cached", "--quiet"], dir)) {
+      deps.log("wiki publish: already up to date");
+      return true;
+    }
+    deps.gitRun(
+      [
+        "-c",
+        "user.email=mmi-github-app[bot]@users.noreply.github.com",
+        "-c",
+        "user.name=mmi-github-app[bot]",
+        "commit",
+        "-m",
+        "docs(wiki): refresh MMI Future project wiki"
+      ],
+      dir
+    );
+    try {
+      deps.gitRun([...authArgs, "push", "origin", "HEAD:master"], dir);
+    } catch (e) {
+      deps.err(
+        `wiki publish failed: push to ${opts.repo}.wiki.git rejected: ${redactWikiSecrets(e.message)} \u2014 if the wiki advanced before this push, re-run wiki publish to pick up the latest wiki state`
+      );
+      return false;
+    }
+    deps.log(`wiki publish: published ${copied} page(s) to ${opts.repo} wiki`);
+    return true;
+  } catch (e) {
+    deps.err(`wiki publish failed: ${redactWikiSecrets(e.message)}`);
+    return false;
+  } finally {
+    deps.rm(dir);
+  }
+}
+function realWikiGitPublishDeps() {
+  return {
+    mkdtemp: () => (0, import_node_fs13.mkdtempSync)((0, import_node_path14.join)((0, import_node_os5.tmpdir)(), "wiki-")),
+    readdir: (dir) => (0, import_node_fs13.readdirSync)(dir),
+    copyFile: (src, dest) => (0, import_node_fs13.copyFileSync)(src, dest),
+    fileExists: (p) => (0, import_node_fs13.existsSync)(p),
+    rm: (p) => (0, import_node_fs13.rmSync)(p, { recursive: true, force: true }),
+    gitProbe: (args, cwd) => {
+      try {
+        (0, import_node_child_process8.execFileSync)("git", args, { cwd, stdio: "pipe" });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    gitRun: (args, cwd) => {
+      (0, import_node_child_process8.execFileSync)("git", args, { cwd, stdio: "inherit" });
+    },
+    log: (msg) => console.log(msg),
+    err: (msg) => console.error(msg)
+  };
+}
+
 // src/project-readiness.ts
 function stagesForTrack(meta) {
   return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
@@ -12796,7 +12893,7 @@ function runtimeSecretStreamGap(stage2, meta, presentSecrets) {
   for (const name of stageRequiredSecrets(stage2, meta).map(materializedRuntimeSecretName)) {
     if (seen.has(name)) continue;
     seen.add(name);
-    if (!streamed.has(name) && presentSecrets.has(stageKey(stage2, name))) gap.push(name);
+    if (!streamed.has(name) && (presentSecrets.has(stageKey(stage2, name)) || presentSecrets.has(name))) gap.push(name);
   }
   return gap;
 }
@@ -13040,9 +13137,11 @@ async function buildV2Doctor(repoOrSlug, deps) {
     return [stage2, { required, ok: required ? await deps.hasDeployState(slug, stage2) : true }];
   })));
   const secrets = Object.fromEntries(STAGES.map((stage2) => {
-    const required = stageInTrack(meta, stage2) ? stageRequiredSecrets(stage2, meta).map((key) => stageKey(stage2, key)) : [];
-    const present = required.filter((key) => presentSecrets.has(key));
-    const missing = required.filter((key) => !presentSecrets.has(key));
+    const names = stageInTrack(meta, stage2) ? stageRequiredSecrets(stage2, meta) : [];
+    const satisfied = (key) => presentSecrets.has(stageKey(stage2, key)) || !key.includes("/") && presentSecrets.has(key);
+    const required = names.map((key) => stageKey(stage2, key));
+    const present = names.filter(satisfied).map((key) => stageKey(stage2, key));
+    const missing = names.filter((key) => !satisfied(key)).map((key) => stageKey(stage2, key));
     return [stage2, { required, present, missing }];
   }));
   const runtimeSecretStreamWarnings = Object.fromEntries(STAGES.map((stage2) => [
@@ -13171,7 +13270,6 @@ var DEFAULT_DOMAINS = ["mutatismutandis.co", "mutmut.co"];
 var DEFAULT_CALLBACK_PATH = "/api/auth/callback";
 var ENV_PREFIXES = ["", "dev", "rc"];
 var LOOPBACK = ["http://localhost", "http://127.0.0.1"];
-var SSM_ENVS = ["dev", "rc", "main"];
 var SSM_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 var uniq = (xs) => [...new Set(xs)];
 function defaultSubdomain2(slug) {
@@ -13202,7 +13300,7 @@ function expectedRedirectUris(cfg) {
   ]);
 }
 function oauthSsmKeys() {
-  return SSM_ENVS.flatMap((env) => SSM_NAMES.map((name) => `${env}/${name}`));
+  return [...SSM_NAMES];
 }
 function parseOauthClientJson(input) {
   let parsed;
@@ -13276,11 +13374,20 @@ function parseSecretsCatalogVar(raw) {
     throw new Error("project set: secrets must be a map keyed by canonical KEY");
   }
   const nonEmpty = (v) => typeof v === "string" && v.trim().length > 0;
+  const overrideMapKey = /^([A-Z_][A-Z0-9_]*)@(dev|rc|main)$/;
   for (const [mapKey, value] of Object.entries(parsed)) {
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`project set: secrets["${mapKey}"] must be an object`);
     const e = value;
-    if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key) || e.key !== mapKey) {
-      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key and be an env-name (UPPER_SNAKE)`);
+    if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key)) {
+      throw new Error(`project set: secrets["${mapKey}"].key must be an env-name (UPPER_SNAKE)`);
+    }
+    const override = overrideMapKey.exec(mapKey);
+    if (override) {
+      if (e.key !== override[1] || !Array.isArray(e.stages) || e.stages.length !== 1 || e.stages[0] !== override[2]) {
+        throw new Error(`project set: secrets["${mapKey}"] is an override entry (#2528) \u2014 key must be ${override[1]} and stages exactly ["${override[2]}"]`);
+      }
+    } else if (e.key !== mapKey) {
+      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key (or use the KEY@<stage> override form, #2528)`);
     }
     if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
     if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`project set: secrets["${mapKey}"].provider must be a non-empty string`);
@@ -13811,7 +13918,7 @@ function writeError(res) {
 }
 
 // src/secrets.ts
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var OWNER2 = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
@@ -13827,8 +13934,7 @@ function classifyTier(_slug, key) {
   return key.slice(0, slash) === PROJECT_TIER_SEGMENT ? "project" : "org";
 }
 function secretParamName(slug, key) {
-  const rel = key.includes("/") ? key : `${PROJECT_TIER_SEGMENT}/${key}`;
-  return `${SSM_ROOT}/${slug}/${rel}`;
+  return `${SSM_ROOT}/${slug}/${key}`;
 }
 function formatSecretList(items) {
   if (!items.length) return "no secrets";
@@ -13847,10 +13953,10 @@ function vaultPointer(slug) {
       org: [`/mmi-future/{shared,cloudflare,mmi-hub,...}/*  (org-infra, master-gated)`]
     },
     stages: ["dev", "rc", "main"],
-    // Google OAuth is one client per repo; creds live at every stage under the standard key names
-    // (local is port-agnostic and reuses the dev tier). See the oauth-everywhere convention.
+    // Google OAuth is one client per repo = ONE stageless value pair at the slug root (#2244/#2528);
+    // every stage (and local) reads the same pair. The staged {dev,rc,main}/GOOGLE_* shape is retired.
     wellKnown: {
-      googleOAuth: ["dev/GOOGLE_CLIENT_ID", "dev/GOOGLE_CLIENT_SECRET", "rc/GOOGLE_CLIENT_ID", "rc/GOOGLE_CLIENT_SECRET", "main/GOOGLE_CLIENT_ID", "main/GOOGLE_CLIENT_SECRET"]
+      googleOAuth: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]
     }
   };
 }
@@ -14106,8 +14212,9 @@ function formatCatalog(r) {
   return lines.join("\n");
 }
 function formatDrift(d) {
-  if (d.ok) return "vault doctor: zero drift \u2014 SSM matches the catalog.";
-  const lines = ["vault doctor: drift found", ""];
+  const shadows = d.stagedShadow ?? [];
+  if (d.ok && !shadows.length) return "vault doctor: zero drift \u2014 SSM matches the catalog.";
+  const lines = [d.ok ? "vault doctor: zero drift \u2014 SSM matches the catalog. Advisories:" : "vault doctor: drift found", ""];
   const section = (title, rows) => {
     if (!rows.length) return;
     lines.push(`${title} (${rows.length}):`, ...rows.map((r) => `  - ${r}`), "");
@@ -14116,6 +14223,10 @@ function formatDrift(d) {
   section("ORPHAN in SSM, undeclared \u2014 declare or delete", d.orphan.map((o) => o.path));
   section("OFF-SCHEME path", d.offScheme.map((o) => `${o.path}  (${o.reason})`));
   section("STAGE-SPLIT \u2014 collapse to one shared key", (d.stageSplit ?? []).map((s) => `${s.slug}/${s.leaf} split across ${s.stages.join("/")}`));
+  section(
+    "STAGED SHADOW \u2014 the staged override WINS its stage over the stageless canonical (#2522)",
+    shadows.map((s) => `${s.path} shadows ${s.canonicalPath}${s.declared ? "" : "  (UNDECLARED residue \u2014 triage per #2526)"}`)
+  );
   section("DUPLICATE org-infra secret", d.duplicate.map((dup) => `${dup.logical}: ${dup.paths.join(" , ")}`));
   return lines.join("\n").trimEnd();
 }
@@ -14220,10 +14331,11 @@ async function secretsPreflight(deps, opts) {
   }
   const { secrets } = await res.json();
   const present = new Set((secrets ?? []).map((s) => s.key));
-  const required = opts.required.map((key) => stageKey2(opts.stage, key));
-  const missing = required.filter((key) => !present.has(key));
+  const missing = opts.required.filter(
+    (key) => !present.has(stageKey2(opts.stage, key)) && !(key.includes("/") ? false : present.has(key))
+  );
   if (missing.length) {
-    deps.log(`missing ${missing.join(", ")}`);
+    deps.log(`missing ${missing.map((key) => key.includes("/") ? key : `${stageKey2(opts.stage, key)} (and no stageless ${key})`).join(", ")}`);
     return false;
   }
   deps.log(`all required ${opts.stage} secret names are present`);
@@ -14255,7 +14367,8 @@ async function secretsGet(deps, key, opts) {
     );
     return false;
   }
-  const { value } = await res.json();
+  const { value, notes } = await res.json();
+  for (const note of notes ?? []) deps.err(`note: ${note}`);
   deps.log(value ?? "");
   return true;
 }
@@ -14335,6 +14448,8 @@ async function putSecret(deps, key, value, opts) {
     );
     return false;
   }
+  const { warnings } = await res.json();
+  for (const warning of warnings ?? []) deps.err(`warning: ${warning}`);
   const provider = providerForSecretKey(key);
   if (provider) {
     const result = await verifySecretValue(deps, key, value, opts);
@@ -14542,7 +14657,7 @@ async function secretsCopy(deps, opts) {
   return true;
 }
 function defaultSpawn(command, args, env) {
-  const r = (0, import_node_child_process8.spawnSync)(command, args, { stdio: "inherit", env });
+  const r = (0, import_node_child_process9.spawnSync)(command, args, { stdio: "inherit", env });
   if (r.error) throw r.error;
   return r.status ?? 1;
 }
@@ -14602,8 +14717,8 @@ async function secretsUse(deps, key, opts) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path15 = require("node:path");
 var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
 var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
@@ -14611,18 +14726,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path14.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path15.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path14.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path14.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path15.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path15.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs13.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs13.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs14.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs14.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -14688,7 +14803,7 @@ function registerSecretsCommands(program3) {
   secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
     let body;
     try {
-      body = (0, import_node_fs13.readFileSync)((0, import_node_path14.resolve)(o.file), "utf8");
+      body = (0, import_node_fs14.readFileSync)((0, import_node_path15.resolve)(o.file), "utf8");
     } catch (e) {
       return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
     }
@@ -14730,7 +14845,7 @@ function registerSecretsCommands(program3) {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("set <key>").description("write/rotate a secret; value is read from stdin (never an argument)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsSet(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
@@ -14763,7 +14878,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs13.unlinkSync)((0, import_node_path14.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs14.unlinkSync)((0, import_node_path15.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -14852,11 +14967,11 @@ function registerEdgeCommands(program3) {
 }
 
 // src/doctor-run.ts
-var import_node_fs17 = require("node:fs");
-var import_node_child_process10 = require("node:child_process");
+var import_node_fs18 = require("node:fs");
+var import_node_child_process11 = require("node:child_process");
 var import_promises2 = require("node:fs/promises");
-var import_node_path17 = require("node:path");
-var import_node_os6 = require("node:os");
+var import_node_path18 = require("node:path");
+var import_node_os7 = require("node:os");
 
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
@@ -14868,140 +14983,20 @@ function buildPluginGuardDecision(i) {
 function buildGuardSessionStartLine(state, opts = {}) {
   if (state === "healthy" || state === "not-org") return { exitCode: 0 };
   const recovery = opts.recovery ?? "mmi-cli plugin-heal";
+  const restartHint = opts.restartHint ?? "restart your agent host / reload plugins";
   const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its marketplace/cache is unresolved";
   return {
-    line: `[mmi-guard] ${reason}; run ${recovery} and restart Claude Code / reload plugins.`,
+    line: `[mmi-guard] ${reason}; run ${recovery} and ${restartHint}.`,
     exitCode: 1
   };
 }
 
 // src/cursor-plugin-seed.ts
-var import_node_child_process9 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
-var import_node_os5 = require("node:os");
-var import_node_path15 = require("node:path");
+var import_node_child_process10 = require("node:child_process");
+var import_node_fs15 = require("node:fs");
+var import_node_os6 = require("node:os");
+var import_node_path16 = require("node:path");
 var import_node_util7 = require("node:util");
-function isSemverVersion(v) {
-  return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
-}
-var MMI_HUB_REPO = "mutmutco/MMI-Hub";
-var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
-var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
-var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process9.execFile);
-function gitFetchReleaseTagArgs(hubCheckout, tag) {
-  return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
-}
-function ghReleaseTarballApiArgs(tag) {
-  return ["api", `repos/${MMI_HUB_REPO}/tarball/refs/tags/${tag}`];
-}
-function cursorUserGlobalStatePath() {
-  if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path15.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path15.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
-  }
-  if (process.platform === "darwin") {
-    return (0, import_node_path15.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
-  }
-  return (0, import_node_path15.join)((0, import_node_os5.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
-}
-async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
-  const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs14.existsSync)(dbPath)) return void 0;
-  try {
-    const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
-      timeout: 5e3
-    });
-    const value = stdout.trim().toLowerCase();
-    if (value === "true") return true;
-    if (value === "false") return false;
-    return void 0;
-  } catch {
-    return void 0;
-  }
-}
-function syncDirContents(src, dest) {
-  (0, import_node_fs14.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs14.readdirSync)(dest)) {
-    (0, import_node_fs14.rmSync)((0, import_node_path15.join)(dest, name), { recursive: true, force: true });
-  }
-  (0, import_node_fs14.cpSync)(src, dest, { recursive: true });
-}
-function releaseTag(releasedVersion) {
-  return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
-}
-async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path15.join)(tmpRoot, "archive.tar");
-  try {
-    await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
-    await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
-      timeout: 6e4
-    });
-    await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path15.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs14.existsSync)((0, import_node_path15.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path15.join)(tmpRoot, "repo.tgz");
-  try {
-    (0, import_node_fs14.mkdirSync)(tmpRoot, { recursive: true });
-    const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
-      timeout: 12e4,
-      maxBuffer: 100 * 1024 * 1024,
-      encoding: "buffer",
-      windowsHide: true
-    });
-    (0, import_node_fs14.writeFileSync)(tarPath, stdout);
-    await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs14.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
-    if (!top) return void 0;
-    const pluginMmi = (0, import_node_path15.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs14.existsSync)((0, import_node_path15.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs14.mkdirSync)(tmpRoot, { recursive: true });
-  const tag = releaseTag(releasedVersion);
-  if (hubCheckout) {
-    const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
-    if (fromHub) return fromHub;
-  }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path15.join)(tmpRoot, "gh"));
-}
-function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
-  if (!isSemverVersion(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
-  return pins.filter((pin) => {
-    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty) return true;
-    if (isSemverVersion(pin.version) && compareVersions(pin.version, releasedVersion) < 0) return true;
-    return false;
-  });
-}
-function cursorPluginCacheSeedTargets(pins, releasedVersion, cacheRoot, cacheRootExists = false) {
-  const needing = cursorPluginPinsNeedingSeed(pins, releasedVersion);
-  if (needing.length > 0) return needing.map((pin) => pin.path);
-  if (pins.length === 0 && cacheRoot && cacheRootExists && isSemverVersion(releasedVersion)) {
-    return [(0, import_node_path15.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
-  }
-  return [];
-}
-async function applyCursorPluginCacheSeed(input) {
-  if (!isSemverVersion(input.releasedVersion)) return false;
-  const targets = cursorPluginCacheSeedTargets(input.pins, input.releasedVersion, input.cacheRoot, input.cacheRootExists);
-  if (targets.length === 0) return false;
-  const tmpRoot = await input.mkdtemp("mmi-cursor-seed-");
-  const source = await resolvePluginMmiSource(input.releasedVersion, input.hubCheckout, tmpRoot, input.execFileP);
-  if (!source) return false;
-  input.log(`  \u21BB seeding Cursor MMI plugin cache \u2192 ${input.releasedVersion}\u2026`);
-  for (const dest of targets) {
-    syncDirContents(source, dest);
-  }
-  (0, import_node_fs14.rmSync)(tmpRoot, { recursive: true, force: true });
-  return true;
-}
 
 // src/doctor.ts
 var GH_PROJECT_LOGIN_FIX = 'run: gh auth login --hostname github.com --git-protocol https --web --scopes "project"';
@@ -15285,8 +15280,8 @@ function buildCursorPluginCacheCleanupCheck(input) {
     label: CURSOR_PLUGIN_CACHE_CLEANUP_LABEL,
     fix: CURSOR_PLUGIN_CACHE_CLEANUP_FIX
   };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
-  const semverPins = input.pins.filter((pin) => isSemverVersion2(pin.version));
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
+  const semverPins = input.pins.filter((pin) => isSemverVersion(pin.version));
   if (semverPins.length === 0) return base;
   const activeVersion = semverPins.map((pin) => pin.version).reduce((a, b) => compareVersions(a, b) >= 0 ? a : b);
   const protectedVersions = new Set(
@@ -15336,7 +15331,7 @@ function codexEnabledPluginVersionFromList(jsonText, pluginId = MMI_PLUGIN_ID) {
     const parsed = JSON.parse(jsonText);
     const rows = Array.isArray(parsed?.installed) ? parsed.installed : [];
     const row = rows.find((r) => r?.pluginId === pluginId && r.installed === true && r.enabled === true);
-    return isSemverVersion2(row?.version) ? row.version.trim().replace(/^v/, "") : void 0;
+    return isSemverVersion(row?.version) ? row.version.trim().replace(/^v/, "") : void 0;
   } catch {
     return void 0;
   }
@@ -15347,9 +15342,9 @@ function buildCodexActiveCacheCheck(input) {
     label: CODEX_ACTIVE_CACHE_LABEL,
     fix: CODEX_PLUGIN_RECOVERY
   };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
   if (input.codexPresent === false) return base;
-  if (isSemverVersion2(input.codexActiveVersion)) {
+  if (isSemverVersion(input.codexActiveVersion)) {
     if (compareVersions(input.codexActiveVersion, input.releasedVersion) < 0) {
       return {
         ...base,
@@ -15361,11 +15356,11 @@ function buildCodexActiveCacheCheck(input) {
     }
     return { ...base, activeCacheVersion: input.codexActiveVersion, releasedVersion: input.releasedVersion };
   }
-  if (isSemverVersion2(input.codexRecordVersion) && compareVersions(input.codexRecordVersion, input.releasedVersion) < 0) {
+  if (isSemverVersion(input.codexRecordVersion) && compareVersions(input.codexRecordVersion, input.releasedVersion) < 0) {
     return base;
   }
   const activeCacheVersion = highestSemver(input.codexCacheVersions ?? []);
-  const cacheCurrent = isSemverVersion2(activeCacheVersion) && compareVersions(activeCacheVersion, input.releasedVersion) >= 0;
+  const cacheCurrent = isSemverVersion(activeCacheVersion) && compareVersions(activeCacheVersion, input.releasedVersion) >= 0;
   if (cacheCurrent) {
     return { ...base, activeCacheVersion, releasedVersion: input.releasedVersion };
   }
@@ -15444,7 +15439,7 @@ function buildSessionSkillRootCheck(input) {
   const sessionVersion = parseSessionSkillRootVersion(input.pluginRoot);
   if (!sessionVersion) return base;
   const activeCacheVersion = highestSemver(input.cacheVersions ?? []);
-  if (!isSemverVersion2(activeCacheVersion)) return { ...base, sessionVersion };
+  if (!isSemverVersion(activeCacheVersion)) return { ...base, sessionVersion };
   if (compareVersions(sessionVersion, activeCacheVersion) >= 0) {
     return { ...base, sessionVersion, activeCacheVersion };
   }
@@ -15526,7 +15521,8 @@ var PLUGIN_SURFACE_HEAL = {
     ],
     pluginRunner: "codex",
     fix: (surface) => `${CODEX_RECOVERY}   # then ${reloadAction(surface)}`,
-    updateRecipe: [CODEX_RECOVERY, "codex plugin list   # verify mmi@mutmutco shows the released version"]
+    updateRecipe: [CODEX_RECOVERY, "codex plugin list   # verify mmi@mutmutco shows the released version"],
+    guardRecovery: "$env:MMI_AGENT_SURFACE='codex'; mmi-cli plugin-heal"
   },
   cursor: {
     delivery: "cursor-cache",
@@ -15610,7 +15606,7 @@ function renderSurfaceGuide(label, steps) {
 }
 function highestSemver(versions) {
   return versions.reduce((best, v) => {
-    if (!isSemverVersion2(v)) return best;
+    if (!isSemverVersion(v)) return best;
     if (best === void 0) return v;
     return compareVersions(v, best) > 0 ? v : best;
   }, void 0);
@@ -15622,12 +15618,12 @@ function buildPluginUpdateReport(input) {
   const opencodePlugin = highestSemver(input.opencodePluginVersions ?? []);
   return {
     versions: {
-      ...isSemverVersion2(input.cliVersion) ? { cli: input.cliVersion } : {},
+      ...isSemverVersion(input.cliVersion) ? { cli: input.cliVersion } : {},
       ...claudePlugin ? { claudePlugin } : {},
       ...codexMarketplace ? { codexMarketplace } : {},
       ...codexActiveCache ? { codexActiveCache } : {},
       ...opencodePlugin ? { opencodePlugin } : {},
-      ...isSemverVersion2(input.releasedVersion) ? { released: input.releasedVersion } : {},
+      ...isSemverVersion(input.releasedVersion) ? { released: input.releasedVersion } : {},
       ...input.releasedVersionSource ? { releasedSource: input.releasedVersionSource } : {}
     },
     recipes: PLUGIN_UPDATE_RECIPES
@@ -15651,14 +15647,15 @@ function renderPluginVersionBlock(report) {
 }
 function buildDoctorJsonPayload(input) {
   return {
-    ok: input.checks.every((c) => c.ok),
+    ok: doctorExitCode(input.checks) === 0,
+    hasAdvisories: input.checks.some((c) => !c.ok && isAdvisoryDoctorCheck(c)),
     checks: input.checks,
     updateReport: input.updateReport,
     ...input.resources.length ? { resources: input.resources } : {}
   };
 }
 var INSTALLED_PLUGIN_VERSION_LABEL = "installed MMI plugin version (vs latest release)";
-function isSemverVersion2(v) {
+function isSemverVersion(v) {
   return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
 }
 function staleRecordCommand(surface) {
@@ -15681,7 +15678,7 @@ function buildInstalledPluginVersionCheck(input) {
     fix: pluginRecoveryFix(input.surface),
     pluginId
   };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
   if (input.surface === "cursor") return base;
   const stale = [];
   let sawRecord = false;
@@ -15691,7 +15688,7 @@ function buildInstalledPluginVersionCheck(input) {
     if (!Array.isArray(records) || records.length === 0) continue;
     sawRecord = true;
     const installedVersion = bestRecord(records).version;
-    if (!isSemverVersion2(installedVersion)) continue;
+    if (!isSemverVersion(installedVersion)) continue;
     if (compareVersions(installedVersion, input.releasedVersion) >= 0) {
       currentVersion = currentVersion ?? installedVersion;
     } else {
@@ -15746,14 +15743,14 @@ function buildManagedPluginDriftCheck(input) {
     for (const source of input.sources) {
       if (source.directVersions && descriptor.id in source.directVersions) {
         const version2 = source.directVersions[descriptor.id];
-        if (isSemverVersion2(version2)) versions.push({ surface: source.surface, version: normalize(version2) });
+        if (isSemverVersion(version2)) versions.push({ surface: source.surface, version: normalize(version2) });
         continue;
       }
       const records = source.installed?.plugins?.[descriptor.id];
       if (!Array.isArray(records) || records.length === 0) continue;
       const recordVersion = bestRecord(records).version;
-      const version = isSemverVersion2(recordVersion) ? recordVersion : highestSemver(source.cacheVersions?.[descriptor.id] ?? []);
-      if (!isSemverVersion2(version)) continue;
+      const version = isSemverVersion(recordVersion) ? recordVersion : highestSemver(source.cacheVersions?.[descriptor.id] ?? []);
+      if (!isSemverVersion(version)) continue;
       versions.push({ surface: source.surface, version: normalize(version) });
     }
     if (versions.length < 2) continue;
@@ -15768,8 +15765,8 @@ var OPENCODE_VERSION_LABEL = "installed OpenCode MMI adapter version (vs latest
 function buildOpencodeVersionCheck(input) {
   const fix = pluginRecoveryFix("opencode");
   const base = { ok: true, label: OPENCODE_VERSION_LABEL, fix };
-  if (!input.isOrgRepo || !isSemverVersion2(input.releasedVersion)) return base;
-  if (!isSemverVersion2(input.installedVersion)) {
+  if (!input.isOrgRepo || !isSemverVersion(input.releasedVersion)) return base;
+  if (!isSemverVersion(input.installedVersion)) {
     return { ...base, ok: false, severityOverride: "hard", releasedVersion: input.releasedVersion };
   }
   if (compareVersions(input.installedVersion, input.releasedVersion) >= 0) {
@@ -15786,7 +15783,7 @@ function pickOpencodeActiveVersion(input) {
 }
 function planOpencodePluginCacheQuarantine(input) {
   if (!input.cacheExists) return { quarantine: false };
-  if (!isSemverVersion2(input.cacheVersion) || !isSemverVersion2(input.releasedVersion)) return { quarantine: false };
+  if (!isSemverVersion(input.cacheVersion) || !isSemverVersion(input.releasedVersion)) return { quarantine: false };
   if (compareVersions(input.cacheVersion, input.releasedVersion) < 0) {
     return { quarantine: true, cacheVersion: input.cacheVersion, releasedVersion: input.releasedVersion };
   }
@@ -16022,8 +16019,8 @@ function buildCursorPluginInstallCheck(input) {
       };
     }
   }
-  if (input.cacheRootExists && isSemverVersion2(input.releasedVersion) && input.pins.some((pin) => isSemverVersion2(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0)) {
-    const stale = input.pins.filter((pin) => isSemverVersion2(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0).map((pin) => `${pin.version} at ${pin.name}`).join(", ");
+  if (input.cacheRootExists && isSemverVersion(input.releasedVersion) && input.pins.some((pin) => isSemverVersion(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0)) {
+    const stale = input.pins.filter((pin) => isSemverVersion(pin.version) && compareVersions(pin.version, input.releasedVersion) < 0).map((pin) => `${pin.version} at ${pin.name}`).join(", ");
     return {
       ...base,
       ok: false,
@@ -16217,18 +16214,19 @@ function isAdvisoryDoctorCheck(check) {
 function doctorExitCode(checks) {
   return checks.some((c) => !c.ok && !isAdvisoryDoctorCheck(c)) ? 1 : 0;
 }
-function renderPluginUpdateReportStaleOnly(report) {
+function renderPluginUpdateReportStaleOnly(report, allChecksPass = false) {
   const v = report.versions;
   const released = v.released;
   if (!released) return [];
-  const isStale = (current) => Boolean(current && isSemverVersion2(current) && compareVersions(current, released) < 0);
+  const isStale = (current) => Boolean(current && isSemverVersion(current) && compareVersions(current, released) < 0);
   const blocks = [];
   for (const surface of PLUGIN_GUIDE_SURFACES) {
     if (!surface.versionKeys.some((k) => isStale(v[k]))) continue;
     blocks.push(...renderSurfaceGuide(surface.label, report.recipes[surface.key]));
   }
   if (!blocks.length) return [];
-  return ["Update commands (stale surfaces):", ...blocks];
+  const heading = allChecksPass ? "Optional updates available (all checks passed):" : "Update commands (stale surfaces):";
+  return [heading, ...blocks];
 }
 var DOCTOR_VERBOSE_HINT = "Run mmi-cli doctor --verbose for the full audit checklist + version report.";
 function doctorCheckGlyph(check) {
@@ -16274,7 +16272,7 @@ function doctorHumanLines(input) {
   if (input.shouldApply && input.pluginReloadRequired) {
     lines.push("", `\u21BB ${input.reloadHint ?? "reload"} so the healed plugin/MCP installs load.`);
   }
-  const stale = renderPluginUpdateReportStaleOnly(input.updateReport);
+  const stale = renderPluginUpdateReportStaleOnly(input.updateReport, gaps.length === 0);
   if (stale.length) {
     lines.push("", ...stale);
   } else if (!input.verbose) {
@@ -16344,7 +16342,7 @@ function buildPluginResolvabilityCheck(input) {
       return {
         ok: false,
         label: PLUGIN_RESOLVABILITY_LABEL,
-        fix: "run: mmi-cli plugin-heal",
+        fix: `run: ${PLUGIN_SURFACE_HEAL[surfaceToken(surface) ?? "claude"]?.recovery ?? PLUGIN_SURFACE_HEAL.claude.recovery}`,
         state
       };
     default: {
@@ -16354,6 +16352,176 @@ function buildPluginResolvabilityCheck(input) {
   }
 }
 
+// src/cursor-plugin-seed.ts
+function isSemverVersion2(v) {
+  return typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
+}
+var MMI_HUB_REPO = "mutmutco/MMI-Hub";
+var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
+var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
+var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process10.execFile);
+function gitFetchReleaseTagArgs(hubCheckout, tag) {
+  return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
+}
+function ghReleaseTarballApiArgs(tag) {
+  return ["api", `repos/${MMI_HUB_REPO}/tarball/refs/tags/${tag}`];
+}
+function cursorUserGlobalStatePath() {
+  if (process.platform === "win32") {
+    const base = process.env.APPDATA || (0, import_node_path16.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path16.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+  }
+  if (process.platform === "darwin") {
+    return (0, import_node_path16.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+  }
+  return (0, import_node_path16.join)((0, import_node_os6.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+}
+async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
+  const dbPath = cursorUserGlobalStatePath();
+  if (!(0, import_node_fs15.existsSync)(dbPath)) return void 0;
+  try {
+    const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
+      timeout: 5e3
+    });
+    const value = stdout.trim().toLowerCase();
+    if (value === "true") return true;
+    if (value === "false") return false;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function syncDirContents(src, dest) {
+  (0, import_node_fs15.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs15.readdirSync)(dest)) {
+    (0, import_node_fs15.rmSync)((0, import_node_path16.join)(dest, name), { recursive: true, force: true });
+  }
+  (0, import_node_fs15.cpSync)(src, dest, { recursive: true });
+}
+function releaseTag(releasedVersion) {
+  return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
+}
+async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
+  const tarFile = (0, import_node_path16.join)(tmpRoot, "archive.tar");
+  try {
+    await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
+    await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
+      timeout: 6e4
+    });
+    await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
+    const pluginMmi = (0, import_node_path16.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs15.existsSync)((0, import_node_path16.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function downloadPluginMmiViaGh(tag, tmpRoot) {
+  const tarPath = (0, import_node_path16.join)(tmpRoot, "repo.tgz");
+  try {
+    (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
+    const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
+      timeout: 12e4,
+      maxBuffer: 100 * 1024 * 1024,
+      encoding: "buffer",
+      windowsHide: true
+    });
+    (0, import_node_fs15.writeFileSync)(tarPath, stdout);
+    await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
+    const top = (0, import_node_fs15.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    if (!top) return void 0;
+    const pluginMmi = (0, import_node_path16.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs15.existsSync)((0, import_node_path16.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
+  (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
+  const tag = releaseTag(releasedVersion);
+  if (hubCheckout) {
+    const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
+    if (fromHub) return fromHub;
+  }
+  return downloadPluginMmiViaGh(tag, (0, import_node_path16.join)(tmpRoot, "gh"));
+}
+function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
+  if (!isSemverVersion2(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
+  return pins.filter((pin) => {
+    if (!pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty) return true;
+    if (isSemverVersion2(pin.version) && compareVersions(pin.version, releasedVersion) < 0) return true;
+    return false;
+  });
+}
+function cursorPluginCacheSeedTargets(pins, releasedVersion, cacheRoot, cacheRootExists = false) {
+  const needing = cursorPluginPinsNeedingSeed(pins, releasedVersion);
+  if (needing.length > 0) return needing.map((pin) => pin.path);
+  if (pins.length === 0 && cacheRoot && cacheRootExists && isSemverVersion2(releasedVersion)) {
+    return [(0, import_node_path16.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
+  }
+  return [];
+}
+async function applyCursorPluginCacheSeed(input) {
+  if (!isSemverVersion2(input.releasedVersion)) return false;
+  const targets = cursorPluginCacheSeedTargets(input.pins, input.releasedVersion, input.cacheRoot, input.cacheRootExists);
+  if (targets.length === 0) return false;
+  const tmpRoot = await input.mkdtemp("mmi-cursor-seed-");
+  const source = await resolvePluginMmiSource(input.releasedVersion, input.hubCheckout, tmpRoot, input.execFileP);
+  if (!source) return false;
+  input.log(`  \u21BB seeding Cursor MMI plugin cache \u2192 ${input.releasedVersion}\u2026`);
+  for (const dest of targets) {
+    syncDirContents(source, dest);
+  }
+  (0, import_node_fs15.rmSync)(tmpRoot, { recursive: true, force: true });
+  return true;
+}
+var CURSOR_ENABLED_PIN_LABEL = "Cursor Team Marketplace enabled plugin pin";
+function cursorSplitBrainCapabilities() {
+  const skills = OPENCODE_WORKFLOW_COMMANDS.map((c) => `/${c}`).join(", ");
+  return `org skills (${skills}) and SessionStart hooks`;
+}
+function cursorEnabledPinRecovery() {
+  return "refresh the MMI Team Marketplace in Cursor Dashboard \u2192 Settings \u2192 Plugins (Update), or run `mmi-cli doctor --apply` to seed the enabled pin; then restart Cursor";
+}
+var CURSOR_FOUND_CACHED_MMI_RE = /Found cached plugin:\s*mmi\s+at\s+.*?[\\/]([0-9a-f]{6,40})\b/gi;
+var CURSOR_MMI_LOADED_RE = /loadClaudePlugin\s+mmi@mutmutco\s+loaded/i;
+var CURSOR_GIT_AUTH_FAIL_RE = /unable to get password from user/i;
+var CURSOR_SAFE_PIN_NAME_RE = /^[0-9a-zA-Z._-]+$/;
+function parseCursorPluginLog(text) {
+  let enabledPin;
+  for (const m of text.matchAll(CURSOR_FOUND_CACHED_MMI_RE)) enabledPin = m[1];
+  const loadSucceeded = CURSOR_MMI_LOADED_RE.test(text);
+  const loadFailed = CURSOR_GIT_AUTH_FAIL_RE.test(text) && !loadSucceeded;
+  return { enabledPin, loadSucceeded, loadFailed };
+}
+function buildCursorEnabledPinCheck(input) {
+  const label = CURSOR_ENABLED_PIN_LABEL;
+  const healthy = { ok: true, label, fix: "" };
+  if (!input.isOrgRepo) return healthy;
+  if (!input.enabledPin && !input.loadFailed) return healthy;
+  if (input.loadSucceeded && !input.loadFailed) return healthy;
+  const caps = cursorSplitBrainCapabilities();
+  if (input.loadFailed) {
+    return {
+      ok: false,
+      severityOverride: "hard",
+      label,
+      fix: `Cursor Team Marketplace failed to load mmi@mutmutco${input.enabledPin ? ` (${input.enabledPin})` : ""}: mmi-cli is on PATH and the Hub session is valid, but the MMI plugin did not load \u2014 ${caps} are UNAVAILABLE in Cursor. ${cursorEnabledPinRecovery()}`
+    };
+  }
+  const enabledDir = input.pins.find((p) => p.name === input.enabledPin);
+  const complete = !!enabledDir && !enabledDir.isEmpty && enabledDir.hasPluginJson && enabledDir.hasHooksJson;
+  if (!complete) {
+    const others = input.pins.filter((p) => p.name !== input.enabledPin && CURSOR_SAFE_PIN_NAME_RE.test(p.name)).map((p) => p.name);
+    return {
+      ok: false,
+      severityOverride: "hard",
+      label,
+      fix: `Cursor is configured to load mmi@mutmutco at commit ${input.enabledPin}, but that pin is ${enabledDir ? "incomplete" : "missing"} in the cache${others.length ? ` (a complete pin at ${others.join(", ")} is present but will NOT be loaded)` : ""} \u2014 ${caps} are unavailable in Cursor. ${cursorEnabledPinRecovery()}`
+    };
+  }
+  return healthy;
+}
+
 // src/mcp-reconcile.ts
 var PLAYWRIGHT_MCP_SPEC = {
   name: "playwright",
@@ -16662,9 +16830,9 @@ ${block}
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path16 = require("node:path");
 var import_node_fs16 = require("node:fs");
+var import_node_path17 = require("node:path");
+var import_node_fs17 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -16710,7 +16878,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path16.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path17.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -16730,18 +16898,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path16.isAbsolute)(raw) ? raw : (0, import_node_path16.resolve)(worktreePath, raw);
+  return (0, import_node_path17.isAbsolute)(raw) ? raw : (0, import_node_path17.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs16.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs17.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs15.readFileSync)((0, import_node_path16.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path16.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path16.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path16.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs16.readFileSync)((0, import_node_path17.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path17.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path17.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path17.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -16751,7 +16919,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs16.statSync)(path2);
+    (0, import_node_fs17.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -16760,10 +16928,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path16.join)(path2, ".git");
+  const gitPath = (0, import_node_path17.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs16.lstatSync)(gitPath);
+    st = (0, import_node_fs17.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -16780,7 +16948,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs15.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs16.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -16797,7 +16965,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs16.readdirSync)(path2) };
+    return { entries: (0, import_node_fs17.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -16816,8 +16984,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs16.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path16.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs17.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path17.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -16867,7 +17035,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -16933,15 +17101,15 @@ function reexecAttemptOutcome(strategy, code) {
   return "result";
 }
 function spawnReexecAttempt(command, args, env) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     let settled = false;
     const done = (code) => {
       if (!settled) {
         settled = true;
-        resolve6(code);
+        resolve5(code);
       }
     };
-    const child = (0, import_node_child_process10.spawn)(command, args, { stdio: "inherit", env });
+    const child = (0, import_node_child_process11.spawn)(command, args, { stdio: "inherit", env });
     child.on("error", () => done(-1));
     child.on("exit", (code) => done(code ?? 0));
   });
@@ -16994,6 +17162,14 @@ ${stderr}`);
     return false;
   }
 }
+function healBannerLine(bin, token, refSupported) {
+  const installVerb = token === "codex" ? "add" : "install";
+  return refSupported ? `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add --ref main \u2192 ${installVerb})\u2026` : `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add \u2192 ${installVerb}; release ref pinned by the marketplace manifest)\u2026`;
+}
+function refAbsenceNote(bin, refSupported) {
+  return refSupported ? "" : `
+  Note: \`${bin}\` has no \`--ref\` option; the marketplace manifest pins the released branch, so none is needed (#2516).`;
+}
 async function applyPluginHeal(token, surface, log, opts) {
   if (!opts?.force && surfaceToken(surface) !== token) return false;
   const descriptor = PLUGIN_SURFACE_HEAL[token];
@@ -17002,13 +17178,8 @@ async function applyPluginHeal(token, surface, log, opts) {
   const bin = descriptor.pluginRunner === "codex" ? "codex" : "claude";
   const runner = descriptor.pluginRunner === "codex" ? runCodexPlugin : runClaudePlugin;
   const refSupported = await marketplaceAddRefSupported(bin);
-  const { steps, strippedRef } = adaptHealStepsForRefSupport(tableSteps, refSupported);
-  log(
-    refSupported ? `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add --ref main \u2192 ${token === "codex" ? "add" : "install"})\u2026` : `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add \u2192 ${token === "codex" ? "add" : "install"})\u2026`
-  );
-  if (strippedRef) {
-    log(`  \u26A0 \`${bin}\` has no \`--ref\` option \u2014 cloning the default branch; update \`${bin}\` to pin the released \`main\` branch (#2080)`);
-  }
+  const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
+  log(healBannerLine(bin, token, refSupported));
   for (const step of steps) {
     if (healStepAborts(step, await runner([...step.args]))) return false;
   }
@@ -17016,30 +17187,42 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs18.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
 }
+function marketplaceCloneCandidates(surface, home) {
+  if (surface === "codex") {
+    return [
+      (0, import_node_path18.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path18.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+    ];
+  }
+  return [(0, import_node_path18.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+}
+function marketplaceClonePresent(surface, home, exists = import_node_fs18.existsSync) {
+  return marketplaceCloneCandidates(surface, home).some(exists);
+}
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
   const installed = readInstalledPlugins(surface);
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: (0, import_node_fs17.existsSync)((0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
-    pluginCachePresent: (0, import_node_fs17.existsSync)((0, import_node_path17.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
+    pluginCachePresent: (0, import_node_fs18.existsSync)((0, import_node_path18.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path17.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs17.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs18.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -17052,8 +17235,8 @@ function managedPluginSurfaceSources() {
       const segments = parseManagedPluginId(descriptor.id);
       if (!segments) continue;
       try {
-        cacheVersions[descriptor.id] = (0, import_node_fs17.readdirSync)(
-          (0, import_node_path17.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "cache", segments.marketplace, segments.name),
+        cacheVersions[descriptor.id] = (0, import_node_fs18.readdirSync)(
+          (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "cache", segments.marketplace, segments.name),
           { withFileTypes: true }
         ).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
       } catch {
@@ -17073,8 +17256,8 @@ function managedPluginCursorDirectVersions() {
     const segments = parseManagedPluginId(descriptor.id);
     if (!segments) continue;
     try {
-      const versions = (0, import_node_fs17.readdirSync)(
-        (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", segments.marketplace, segments.name),
+      const versions = (0, import_node_fs18.readdirSync)(
+        (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", segments.marketplace, segments.name),
         { withFileTypes: true }
       ).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
       out[descriptor.id] = highestSemver(versions);
@@ -17093,7 +17276,7 @@ function managedPluginOpencodeDirectVersions() {
 }
 function readOpencodePackageVersionFrom(packageJsonPath) {
   try {
-    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(packageJsonPath, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(packageJsonPath, "utf8"));
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
   } catch {
     return void 0;
@@ -17103,14 +17286,14 @@ function readOpencodePackageVersion(packageName) {
   const [scope, name] = packageName.startsWith("@") ? packageName.slice(1).split("/", 2) : [void 0, packageName];
   if (!name) return void 0;
   const diskCandidates = [
-    (0, import_node_path17.join)(opencodeConfigDir(), "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"),
-    (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json")
+    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"),
+    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json")
   ];
   const diskVersion = diskCandidates.map(readOpencodePackageVersionFrom).find((v) => v !== void 0);
-  const packagesRoot = (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "packages", ...scope ? [`@${scope}`] : []);
+  const packagesRoot = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", ...scope ? [`@${scope}`] : []);
   let cacheVersion;
   try {
-    const cacheVersions = (0, import_node_fs17.readdirSync)(packagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${name}@`) && !e.name.startsWith(".")).map((e) => readOpencodePackageVersionFrom((0, import_node_path17.join)(packagesRoot, e.name, "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"))).filter((v) => Boolean(v));
+    const cacheVersions = (0, import_node_fs18.readdirSync)(packagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${name}@`) && !e.name.startsWith(".")).map((e) => readOpencodePackageVersionFrom((0, import_node_path18.join)(packagesRoot, e.name, "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"))).filter((v) => Boolean(v));
     if (cacheVersions.length) cacheVersion = cacheVersions.reduce((lowest, v) => compareVersions(v, lowest) < 0 ? v : lowest);
   } catch {
   }
@@ -17118,7 +17301,7 @@ function readOpencodePackageVersion(packageName) {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path17.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -17140,7 +17323,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs17.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs18.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17153,9 +17336,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs17.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs17.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17163,22 +17346,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".config", "opencode");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path17.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path18.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path17.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path18.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path17.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs17.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs18.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs17.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs18.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -17201,9 +17384,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan.action === "already") return true;
     if (!plan.text || plan.action === "unsafe") return false;
-    (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs17.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs17.writeFileSync)(path2, plan.text, "utf8");
+    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs18.writeFileSync)(path2, plan.text, "utf8");
     return true;
   } catch {
     return false;
@@ -17218,9 +17401,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs17.existsSync)(snapshot.path)) (0, import_node_fs17.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs17.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs18.existsSync)(snapshot.path)) (0, import_node_fs18.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs18.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17229,7 +17412,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs17.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs18.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -17237,9 +17420,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs18.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs17.writeFileSync)((0, import_node_path17.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs18.writeFileSync)((0, import_node_path18.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -17248,12 +17431,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path17.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -17269,7 +17452,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs17.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs18.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -17277,12 +17460,12 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   }
 }
 function opencodePackagesRoot() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
 }
 function opencodePluginCacheDirs() {
   const root = opencodePackagesRoot();
   try {
-    return (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path17.join)(root, e.name));
+    return (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path18.join)(root, e.name));
   } catch {
     return [];
   }
@@ -17290,7 +17473,7 @@ function opencodePluginCacheDirs() {
 function readOpencodeCacheDirVersion(cacheDir) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs17.readFileSync)((0, import_node_path17.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
+      (0, import_node_fs18.readFileSync)((0, import_node_path18.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
     );
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
   } catch {
@@ -17313,9 +17496,9 @@ function quarantineStaleOpencodePluginCaches(releasedVersion, log) {
     });
     if (!plan.quarantine) continue;
     try {
-      const quarantineRoot = (0, import_node_path17.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
-      (0, import_node_fs17.mkdirSync)(quarantineRoot, { recursive: true });
-      (0, import_node_fs17.renameSync)(cacheDir, (0, import_node_path17.join)(quarantineRoot, (0, import_node_path17.basename)(cacheDir)));
+      const quarantineRoot = (0, import_node_path18.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
+      (0, import_node_fs18.mkdirSync)(quarantineRoot, { recursive: true });
+      (0, import_node_fs18.renameSync)(cacheDir, (0, import_node_path18.join)(quarantineRoot, (0, import_node_path18.basename)(cacheDir)));
       log(`  \u21BB quarantined stale OpenCode plugin cache ${plan.cacheVersion} (< ${plan.releasedVersion}) \u2014 OpenCode reinstalls the current adapter on next start`);
       moved = true;
     } catch {
@@ -17341,30 +17524,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path17.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path17.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path18.join)((0, import_node_os7.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path18.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path17.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path17.join)(root, entry.name)).sort((a, b) => (0, import_node_fs17.statSync)(b).mtimeMs - (0, import_node_fs17.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path18.join)(root, entry.name)).sort((a, b) => (0, import_node_fs18.statSync)(b).mtimeMs - (0, import_node_fs18.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path17.join)(newest, "renderer.log");
-    const text = (0, import_node_fs17.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs17.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path18.join)(newest, "renderer.log");
+    const text = (0, import_node_fs18.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs18.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs17.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs18.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -17376,45 +17559,80 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs17.existsSync)(backupPath)) return false;
-    (0, import_node_fs17.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs18.existsSync)(backupPath)) return false;
+    (0, import_node_fs18.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+}
+function cursorLogsRoot() {
+  if (process.platform === "win32") return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "AppData", "Roaming", "Cursor", "logs");
+  if (process.platform === "darwin") return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "Cursor", "logs");
+  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "Cursor", "logs");
+}
+function safeReaddirNames(dir) {
+  try {
+    return (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true }).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function readCursorPluginLogText() {
+  const root = cursorLogsRoot();
+  const sessions = safeReaddirNames(root).sort().reverse();
+  for (const session of sessions.slice(0, 5)) {
+    const sessionDir = (0, import_node_path18.join)(root, session);
+    const texts = [];
+    for (const win of safeReaddirNames(sessionDir).filter((n) => n.startsWith("window"))) {
+      const dir = (0, import_node_path18.join)(sessionDir, win, "exthost", "anysphere.cursor-agent-exec");
+      for (const file of safeReaddirNames(dir)) {
+        if (!/^Cursor Plugins.*\.log$/i.test(file)) continue;
+        const path2 = (0, import_node_path18.join)(dir, file);
+        try {
+          texts.push({ text: (0, import_node_fs18.readFileSync)(path2, "utf8"), mtime: (0, import_node_fs18.statSync)(path2).mtimeMs });
+        } catch {
+        }
+      }
+    }
+    if (texts.length) {
+      return texts.sort((a, b) => b.mtime - a.mtime).map((t) => t.text).join("\n");
+    }
+  }
+  return void 0;
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path17.join)(root, entry.name);
-      const pluginJson = (0, import_node_path17.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path17.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path17.join)(path2, "cli", "dist", "index.cjs");
-      const cursorHook = (0, import_node_path17.join)(path2, "scripts", "cursor-hook.mjs");
+    return (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path18.join)(root, entry.name);
+      const pluginJson = (0, import_node_path18.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path18.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path18.join)(path2, "cli", "dist", "index.cjs");
+      const cursorHook = (0, import_node_path18.join)(path2, "scripts", "cursor-hook.mjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs17.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs18.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs17.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs18.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs17.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs17.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs17.existsSync)(cliBundle),
-        hasCursorHookScript: (0, import_node_fs17.existsSync)(cursorHook),
+        hasPluginJson: (0, import_node_fs18.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs18.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs18.existsSync)(cliBundle),
+        hasCursorHookScript: (0, import_node_fs18.existsSync)(cursorHook),
         isEmpty,
         version
       };
@@ -17424,19 +17642,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path17.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs17.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path18.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs18.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs17.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path17.join)(root, entry.name),
+        path: (0, import_node_path18.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -17447,7 +17665,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs17.statSync)((0, import_node_path17.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs18.statSync)((0, import_node_path18.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -17458,10 +17676,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs17.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs18.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs17.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs18.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -17470,10 +17688,10 @@ function quarantinePluginCacheDirs(plan) {
   const failed = [];
   for (const move of plan) {
     try {
-      if (!(0, import_node_fs17.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs18.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(target), { recursive: true });
-      (0, import_node_fs17.renameSync)(move.from, target);
+      (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(target), { recursive: true });
+      (0, import_node_fs18.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -17492,23 +17710,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs17.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs18.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path17.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs17.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path18.join)((0, import_node_os7.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs18.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs17.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs18.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs17.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs18.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs17.existsSync)(targetPath);
+      return !(0, import_node_fs18.existsSync)(targetPath);
     }
-    (0, import_node_fs17.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs17.existsSync)(targetPath);
+    (0, import_node_fs18.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs18.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -17521,79 +17739,79 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path17.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path18.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs17.existsSync)(path2)) return null;
-    return (0, import_node_fs17.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs18.existsSync)(path2)) return null;
+    return (0, import_node_fs18.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function mcpDirExists(path2) {
   try {
-    return (0, import_node_fs17.existsSync)(path2);
+    return (0, import_node_fs18.existsSync)(path2);
   } catch {
     return false;
   }
 }
 function mcpConfigTargets() {
   const cwd = process.cwd();
-  const home = (0, import_node_os6.homedir)();
-  const cursorProjectDir = (0, import_node_path17.join)(cwd, ".cursor");
-  const cursorUserDir = (0, import_node_path17.join)(home, ".cursor");
-  const codexDir = (0, import_node_path17.join)(home, ".codex");
+  const home = (0, import_node_os7.homedir)();
+  const cursorProjectDir = (0, import_node_path18.join)(cwd, ".cursor");
+  const cursorUserDir = (0, import_node_path18.join)(home, ".cursor");
+  const codexDir = (0, import_node_path18.join)(home, ".codex");
   return [
     // Claude Code project MCP — reconciled if present, never conjured (org seeds .cursor/mcp.json, not this).
     {
       host: "claude-code",
       label: "Claude Code project MCP",
-      path: (0, import_node_path17.join)(cwd, ".mcp.json"),
+      path: (0, import_node_path18.join)(cwd, ".mcp.json"),
       format: "json",
       present: true,
       // parent is the repo root (cwd); the caller gates the whole reconcile on isOrgRepo
       isRepoFile: true,
       createWhenFileAbsent: false,
-      content: readTextFile((0, import_node_path17.join)(cwd, ".mcp.json"))
+      content: readTextFile((0, import_node_path18.join)(cwd, ".mcp.json"))
     },
     // Cursor project MCP — the bootstrap-seeded surface; restored if its .cursor dir exists but the file is gone.
     {
       host: "cursor-project",
       label: "Cursor project MCP",
-      path: (0, import_node_path17.join)(cursorProjectDir, "mcp.json"),
+      path: (0, import_node_path18.join)(cursorProjectDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorProjectDir),
       isRepoFile: true,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path17.join)(cursorProjectDir, "mcp.json"))
+      content: readTextFile((0, import_node_path18.join)(cursorProjectDir, "mcp.json"))
     },
     // Cursor user MCP — global; written only when Cursor is installed (~/.cursor exists).
     {
       host: "cursor-user",
       label: "Cursor user MCP",
-      path: (0, import_node_path17.join)(cursorUserDir, "mcp.json"),
+      path: (0, import_node_path18.join)(cursorUserDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorUserDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path17.join)(cursorUserDir, "mcp.json"))
+      content: readTextFile((0, import_node_path18.join)(cursorUserDir, "mcp.json"))
     },
     // Codex user config (TOML) — global; written only when Codex is installed (~/.codex exists).
     {
       host: "codex",
       label: "Codex user config",
-      path: (0, import_node_path17.join)(codexDir, "config.toml"),
+      path: (0, import_node_path18.join)(codexDir, "config.toml"),
       format: "toml",
       present: mcpDirExists(codexDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path17.join)(codexDir, "config.toml"))
+      content: readTextFile((0, import_node_path18.join)(codexDir, "config.toml"))
     }
   ];
 }
 function writeMcpConfigFile(path2, content) {
   try {
-    (0, import_node_fs17.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs18.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -17673,7 +17891,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs17.existsSync)((0, import_node_path17.join)(cwd, rel));
+      return (0, import_node_fs18.existsSync)((0, import_node_path18.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -17681,14 +17899,14 @@ function strayBrowserArtifactPaths() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs17.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs18.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs17.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs18.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -17730,7 +17948,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs17.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs18.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo,
     surface,
@@ -17765,7 +17983,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs17.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs18.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -17912,7 +18130,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   checks.push(gitignoreCheck);
   checks.push(buildRepoLocalWorktreeCheck({
     isOrgRepo,
-    hasRepoLocalWorktrees: (0, import_node_fs17.existsSync)((0, import_node_path17.join)(process.cwd(), ".worktrees"))
+    hasRepoLocalWorktrees: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), ".worktrees"))
   }));
   let driftCheck = buildPluginConfigDriftCheck({ isOrgRepo, installed, surface });
   if (!driftCheck.ok && driftCheck.recordsToWrite && repairLocal) {
@@ -18202,7 +18420,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   }
   checks.push(nestedPluginTreeCheck);
   const cursorCacheRoot = cursorPluginCacheRoot();
-  const cursorCacheRootExists = (0, import_node_fs17.existsSync)(cursorCacheRoot);
+  const cursorCacheRootExists = (0, import_node_fs18.existsSync)(cursorCacheRoot);
   let cursorPins = cursorPluginCachePinSnapshots() ?? [];
   checks.push(
     buildCursorPluginCacheCleanupCheck({
@@ -18230,7 +18448,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       cacheRootExists: cursorCacheRootExists,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path17.join)((0, import_node_os6.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path18.join)((0, import_node_os7.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -18263,6 +18481,11 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     }
   }
   checks.push(cursorPluginCheck);
+  if (!opts.banner) {
+    const cursorLogText = readCursorPluginLogText();
+    const enabledPinSignal = cursorLogText ? parseCursorPluginLog(cursorLogText) : {};
+    checks.push(buildCursorEnabledPinCheck({ isOrgRepo, pins: cursorPins, ...enabledPinSignal }));
+  }
   const cursorThirdPartyEnabled = await readCursorThirdPartyExtensibilityEnabled(execFileP2);
   checks.push(
     buildCursorThirdPartyExtensibilityCheck({
@@ -18420,29 +18643,33 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path17.join)((0, import_node_os6.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path18.join)((0, import_node_os7.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs17.existsSync)(path2)) {
+    if ((0, import_node_fs18.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs17.mkdirSync)((0, import_node_path17.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs17.existsSync)(path2)) (0, import_node_fs17.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs17.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs18.existsSync)(path2)) (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
     return "failed";
   }
 }
+function guardRecoveryCommand(surface) {
+  const token = surfaceToken(surface);
+  return token ? PLUGIN_SURFACE_HEAL[token]?.guardRecovery : void 0;
+}
 async function runGuard(opts = {}, readOrigin) {
   void opts;
   try {
@@ -18450,7 +18677,7 @@ async function runGuard(opts = {}, readOrigin) {
     const isOrgRepo = readOrigin ? await isOrgRepoRoot(readOrigin) : await isOrgRepoRoot();
     const input = snapshotPluginGuardInput(surface, isOrgRepo);
     const { state } = buildPluginGuardDecision(input);
-    const { line, exitCode } = buildGuardSessionStartLine(state);
+    const { line, exitCode } = buildGuardSessionStartLine(state, { recovery: guardRecoveryCommand(surface) });
     if (line) console.error(line);
     process.exitCode = exitCode;
   } catch {
@@ -18473,8 +18700,7 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
     const bin = descriptor.pluginRunner === "codex" ? "codex" : "claude";
     const refSupported = await marketplaceAddRefSupported(bin);
     const recovery = refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
-    const note = refSupported ? "" : `
-  Note: \`${bin}\` has no \`--ref\` option here; update \`${bin}\` to pin the released \`main\` branch.`;
+    const note = refAbsenceNote(bin, refSupported);
     console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
   ${recovery}${note}`);
   }
@@ -18570,7 +18796,7 @@ async function applyGcPlan(plan, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs18.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -18593,7 +18819,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs18.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs19.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -18636,13 +18862,13 @@ var program2 = new Command();
 program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path18.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path19.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs18.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs19.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -18784,8 +19010,8 @@ function runWorktreeInstall(command, cwd, quiet) {
   const [bin, ...args] = command.split(" ");
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
-  return new Promise((resolve6, reject) => {
-    const child = (0, import_node_child_process11.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+  return new Promise((resolve5, reject) => {
+    const child = (0, import_node_child_process12.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -18799,7 +19025,7 @@ function runWorktreeInstall(command, cwd, quiet) {
     });
     child.on("exit", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve6();
+      if (code === 0) resolve5();
       else reject(new Error(`${command} exited ${code} in ${cwd}`));
     });
   });
@@ -18807,7 +19033,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path18.dirname)(out) : void 0;
+    return out ? (0, import_node_path19.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -18822,26 +19048,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs18.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs19.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs18.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs19.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs18.closeSync)(fd);
+      (0, import_node_fs19.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs18.rmSync)(lockPath, { force: true });
+        (0, import_node_fs19.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs18.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs18.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs19.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs19.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -18980,7 +19206,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process11.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process12.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -19036,8 +19262,8 @@ tenant.command("readiness <owner/repo> <stage>").description("alias for tenant s
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false) process.exitCode = 1;
 });
-tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main \u2014 the promoted ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage2, o) => {
-  if (stage2 !== "rc" && stage2 !== "main") return fail("tenant redeploy: <stage> must be rc or main");
+tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage2, o) => {
+  if (stage2 !== "dev" && stage2 !== "rc" && stage2 !== "main") return fail("tenant redeploy: <stage> must be dev, rc, or main");
   try {
     const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage: stage2, ref: o.ref, watch: o.watch });
     return printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantRedeploy(result));
@@ -19073,8 +19299,8 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
 async function resolveDnsBounded(host, timeoutMs = 3e3) {
   const { lookup } = await import("node:dns/promises");
   const probe = lookup(host).then(() => true).catch((e) => dnsErrorToResolution(e?.code));
-  const timeout = new Promise((resolve6) => {
-    setTimeout(() => resolve6(void 0), timeoutMs).unref?.();
+  const timeout = new Promise((resolve5) => {
+    setTimeout(() => resolve5(void 0), timeoutMs).unref?.();
   });
   return Promise.race([probe, timeout]);
 }
@@ -19336,7 +19562,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const vars = rawValues("--var");
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs18.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs19.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -19498,7 +19724,7 @@ SSM cred params (under /mmi-future/${slug}/):`);
   ssm.forEach((k) => console.log(`  ${k}`));
   console.log("\nProvision/repair the Console client per docs/Guides/oauth-provision.md; store creds with `mmi-cli oauth set-creds`.");
 });
-oauth.command("set-creds").description('store the OAuth client into the canonical {dev,rc,main}/GOOGLE_CLIENT_* SSM keys (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
+oauth.command("set-creds").description('store the OAuth client into the canonical stageless GOOGLE_CLIENT_ID/SECRET pair (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   const raw = await readStdin();
   if (!raw.trim()) {
     return fail("oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli oauth set-creds --repo <owner/repo> < client.json");
@@ -19517,10 +19743,10 @@ oauth.command("set-creds").description('store the OAuth client into the canonica
         return;
       }
     }
-    console.log(`OAuth client stored in all ${oauthSsmKeys().length} canonical keys. Run \`mmi-cli oauth verify\` to confirm the client is port-agnostic.`);
+    console.log(`OAuth client stored in the ${oauthSsmKeys().length} canonical stageless keys. Run \`mmi-cli oauth verify\` to confirm the client is port-agnostic.`);
   });
 });
-oauth.command("verify").description("probe Google authorize with an arbitrary port (:9123) to confirm the client is port-agnostic").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--client-id <id>", "OAuth client_id (else read dev/GOOGLE_CLIENT_ID from SSM)").option("--json", "machine-readable output").action(async (o) => {
+oauth.command("verify").description("probe Google authorize with an arbitrary port (:9123) to confirm the client is port-agnostic").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--client-id <id>", "OAuth client_id (else read the stageless GOOGLE_CLIENT_ID from SSM)").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const slug = (o.repo ? o.repo.split("/").pop() : cfg.project ?? await repoSlug()).toLowerCase();
   const meta = await fetchProjectBySlug(slug, registryClientDeps(cfg));
@@ -19533,11 +19759,11 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   let clientId = o.clientId;
   if (!clientId) {
     await withSecrets(async (d) => {
-      clientId = await fetchSecretValue(d, "dev/GOOGLE_CLIENT_ID", { repo: o.repo }) ?? void 0;
+      clientId = await fetchSecretValue(d, "GOOGLE_CLIENT_ID", { repo: o.repo }) ?? void 0;
     });
   }
   if (!clientId) {
-    return failGraceful("oauth verify: no client_id (pass --client-id, or provision the repo so dev/GOOGLE_CLIENT_ID exists)");
+    return failGraceful("oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
   }
   const redirectUri = probeRedirectUri(oc.callbackPath);
   let body = "";
@@ -19624,18 +19850,20 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
     ...parentLinkFields(parent, parentLinkError)
   }));
 });
-issue.command("view <number>").description("read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json <fields>", "comma-separated gh --json field list (overrides the default field set)").action(async (number, o) => {
+issue.command("view <number>").description("read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("issue view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("issue view: could not resolve repo (pass --repo <owner/repo>)");
-  const fields = o.json && o.json.trim() ? o.json.trim() : "number,title,state,url,labels,author,assignees,milestone,body";
+  const fields = normalizeIssueViewJsonFields(o.json);
   try {
     const data = await ghJson(["issue", "view", String(n), "--repo", repo, "--json", fields]);
     console.log(JSON.stringify(data));
   } catch (e) {
     const err = e;
-    return fail(`issue view: ${(err.stderr || err.message || String(e)).trim()}`);
+    const raw = (err.stderr || err.message || String(e)).trim();
+    const argvNote = o.json ? ` (received --json argv: ${JSON.stringify(o.json)}, normalized to "${fields}")` : "";
+    return fail(`issue view: ${raw}${argvNote}`);
   }
 });
 issue.command("discover-related").description("find related issues for an existing issue and post only high-confidence links").requiredOption("--number <number>", "created issue number").requiredOption("--title <title>", "created issue title").requiredOption("--body <body>", "created issue body").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "print candidates instead of posting").action(async (o) => {
@@ -19904,9 +20132,9 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path18.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs18.existsSync)(wfDir)) return [];
-  return (0, import_node_fs18.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path19.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs19.existsSync)(wfDir)) return [];
+  return (0, import_node_fs19.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -19925,7 +20153,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -19955,7 +20183,7 @@ pr.command("checks-wait <number>").description("bounded wait for PR checks; skip
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
-    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
   });
   if (o.json) printLine(JSON.stringify(result));
   else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
@@ -19982,7 +20210,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
-      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
+      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
     }),
     // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
@@ -20033,7 +20261,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       while (Date.now() < deadlineMs) {
         const stateRead = await readGhPrStateWithRetry(async () => (await execFileP2("gh", ["pr", "view", prNumber, ...args, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 })).stdout, { retries: 2, delayMs: 1e3 });
         if (stateRead.ok && stateRead.state === "MERGED") return true;
-        await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
+        await new Promise((resolve5) => setTimeout(resolve5, PR_LAND_POLL_MS));
       }
       return false;
     }
@@ -20077,7 +20305,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -20093,7 +20321,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(registryPath), { recursive: true });
+          await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(registryPath), { recursive: true });
           await (0, import_promises3.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -20107,13 +20335,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs18.lstatSync)(p);
+      st = (0, import_node_fs19.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs18.readlinkSync)(p);
+      (0, import_node_fs19.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -20121,7 +20349,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs18.readdirSync)(p);
+      return (0, import_node_fs19.readdirSync)(p);
     } catch {
       return [];
     }
@@ -20130,9 +20358,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs18.rmdirSync)(p);
+      (0, import_node_fs19.rmdirSync)(p);
     } catch {
-      (0, import_node_fs18.unlinkSync)(p);
+      (0, import_node_fs19.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises3.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -20147,7 +20375,7 @@ async function resolvePrimaryCheckout(execGit) {
 function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
-    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover)
   };
 }
@@ -20162,9 +20390,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs18.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs19.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs18.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs19.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -20230,7 +20458,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs18.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20451,7 +20679,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs18.writeSync)(1, `${value}
+  (0, import_node_fs19.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -20465,8 +20693,8 @@ async function resolveStage() {
   const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
   return decideStage({
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -20900,21 +21128,14 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
   if (!audit.ok) process.exitCode = 1;
 });
 var wiki = program2.command("wiki").description("release wiki lane \u2014 publish generated pages via a short-lived, repo-scoped minted token");
-wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:write token (master-gated) and publish the generated .md pages to <repo>.wiki.git via scripts/wiki-publish.mjs; the token stays in memory (never printed/committed). Fails loud on the credential gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").action(async (pagesDir, o) => {
+wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:write token (master-gated) and publish the generated .md pages to <repo>.wiki.git; the token stays in memory (never printed/committed). Runs from any org repo checkout \u2014 the publisher ships inside mmi-cli, no repo-local script required. Fails loud on the credential gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").action(async (pagesDir, o) => {
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("wiki publish: could not determine the target repo (pass --repo owner/name)");
   const cfg = await loadConfig();
   const ok = await wikiPublish(
     {
       mint: (r) => mintWikiToken(r, registryClientDeps(cfg)),
-      // scripts/wiki-publish.mjs lives at the repo root; Lane B runs there. Resolve against cwd.
-      scriptPath: () => (0, import_node_path18.resolve)(process.cwd(), "scripts", "wiki-publish.mjs"),
-      scriptExists: (p) => (0, import_node_fs18.existsSync)(p),
-      spawn: (command, args, env) => {
-        const r = (0, import_node_child_process11.spawnSync)(command, args, { stdio: "inherit", env });
-        if (r.error) throw r.error;
-        return r.status ?? 1;
-      },
+      publish: (o2) => publishWikiViaGit(realWikiGitPublishDeps(), o2),
       log: (msg) => console.log(msg),
       err: (msg) => console.error(msg)
     },
@@ -20941,7 +21162,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -20992,12 +21213,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs18.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs18.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile2 = (p) => (0, import_node_fs18.existsSync)(p) ? (0, import_node_fs18.readFileSync)(p, "utf8") : null;
+  const readFile2 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -21294,16 +21515,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs18.existsSync)("projects.json") ? (0, import_node_fs18.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs19.existsSync)("projects.json") ? (0, import_node_fs19.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs18.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs18.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs19.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs19.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs18.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs18.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs19.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs19.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs18.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs18.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs19.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs19.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -21340,7 +21561,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       readBoard,
       // #1813: warm the slice cache out-of-band (detached) so the ~20s live read
       // never costs banner time and next session's glance renders instantly within budget.
-      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
+      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),
     doctor: (io) => runDoctor({ banner: true }, io)
   });
@@ -21348,7 +21569,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
 });