@mutmutco/cli 3.48.1 → 3.50.0

package/dist/main.cjs

@@ -4478,6 +4478,52 @@ async function runSessionStart(parallel, sequential, io) {
   for (const lines of buffered) flush(lines, io);
   for (const step of sequential) flush(await runBufferedStep(step), io);
 }
+var SESSION_PAYLOAD_CAP_CHARS = 1e4;
+var SESSION_PAYLOAD_BUDGET_CHARS = 8e3;
+function sessionPayloadStatus(chars) {
+  if (chars > SESSION_PAYLOAD_CAP_CHARS) return "red";
+  if (chars > SESSION_PAYLOAD_BUDGET_CHARS) return "amber";
+  return "ok";
+}
+function measuredSessionIo(io) {
+  let chars = 0;
+  return {
+    io: {
+      log: (text) => {
+        chars += text.length + 1;
+        io.log(text);
+      },
+      err: (text) => io.err(text)
+    },
+    chars: () => chars
+  };
+}
+function sessionPayloadStatePath(cwd) {
+  return repoRuntimeStatePath(cwd, "session-payload.json");
+}
+function recordSessionPayload(cwd, chars, now = /* @__PURE__ */ new Date()) {
+  try {
+    const path2 = sessionPayloadStatePath(cwd);
+    (0, import_node_fs8.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
+    const record = { chars, status: sessionPayloadStatus(chars), at: now.toISOString() };
+    (0, import_node_fs8.writeFileSync)(path2, `${JSON.stringify(record)}
+`, "utf8");
+  } catch {
+  }
+}
+function readSessionPayload(cwd) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(sessionPayloadStatePath(cwd), "utf8"));
+    if (typeof parsed?.chars !== "number" || !Number.isFinite(parsed.chars)) return void 0;
+    return {
+      chars: parsed.chars,
+      status: sessionPayloadStatus(parsed.chars),
+      at: typeof parsed.at === "string" ? parsed.at : ""
+    };
+  } catch {
+    return void 0;
+  }
+}
 function buildSessionStartPlan(verbs) {
   return {
     parallel: [
@@ -5375,7 +5421,33 @@ function resolveSafeSiblingWorktreeCleanupTarget(worktreePath, siblingRoot, deps
 }
 function siblingMmiWorktreesRoot(repoRoot2) {
   const parent = (0, import_node_path7.dirname)(repoRoot2);
-  return (0, import_node_path7.basename)(parent).toLowerCase() === "mmi-worktrees" ? parent : (0, import_node_path7.join)(parent, "mmi-worktrees");
+  if ((0, import_node_path7.basename)(parent).toLowerCase() === "mmi-worktrees") return parent;
+  const grandparent = (0, import_node_path7.dirname)(parent);
+  if ((0, import_node_path7.basename)(grandparent).toLowerCase() === "mmi-worktrees") return grandparent;
+  return (0, import_node_path7.join)(parent, "mmi-worktrees");
+}
+function worktreeScanDirs(root, repoRoot2, listDirs, isRepoCheckout) {
+  const projectsDir = (0, import_node_path7.dirname)(root);
+  const ownName = (0, import_node_path7.basename)(repoRoot2).toLowerCase();
+  const flat = [];
+  let ownContainer = null;
+  for (const dir of listDirs(root)) {
+    const name = (0, import_node_path7.basename)(dir);
+    if (isRepoCheckout((0, import_node_path7.join)(projectsDir, name))) {
+      if (name.toLowerCase() === ownName) ownContainer = dir;
+      continue;
+    }
+    flat.push(dir);
+  }
+  return ownContainer ? [...flat, ...listDirs(ownContainer)] : flat;
+}
+function explicitRepoWorktreesRoot(root, repoRoot2, rootDirs) {
+  const repoName = (0, import_node_path7.basename)(repoRoot2);
+  const repoDir = rootDirs.find((name) => name.toLowerCase() === repoName.toLowerCase());
+  return repoDir ? (0, import_node_path7.join)(root, repoDir) : root;
+}
+function strayWorktreeRootPaths(container, names, authoritativeRoot) {
+  return names.filter((name) => /worktrees/i.test(name)).map((name) => (0, import_node_path7.join)(container, name)).filter((path2) => !samePath(path2, authoritativeRoot));
 }
 function classifySiblingWorktreeDir(entry) {
   if (!entry.ownedByCurrentRepo) {
@@ -6235,6 +6307,7 @@ var import_node_child_process5 = require("node:child_process");
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
+var ORG_INFRA_SLUG = "_org";
 var KEY_RE = /^(?:[a-z][a-z0-9-]*\/)?[A-Za-z][A-Za-z0-9_]*$/;
 function isValidSecretKey(key) {
   if (!key || key.length > 256) return false;
@@ -6445,7 +6518,7 @@ no vault credentials visible`;
     ...lines,
     "",
     "+ = usable now. Consume keyless: `mmi-cli secrets use <KEY> -- <cmd>` (inject, never printed); validate: `mmi-cli secrets verify <KEY>`. No command prints a raw value (#2844).",
-    "  Cross-slug (org-infra): `mmi-cli secrets use GLOBAL_API_KEY --slug cloudflare -- <cmd>` consumes it keyless (master-gated)."
+    `  Org-infra (#3463): \`--slug\` is ALWAYS \`${ORG_INFRA_SLUG}\`; the provider is the key's FIRST SEGMENT \u2014 \`mmi-cli secrets use cloudflare/GLOBAL_API_KEY --slug ${ORG_INFRA_SLUG} -- <cmd>\` (master-gated).`
   ].join("\n");
 }
 async function secretsCapabilities(deps, opts) {
@@ -6487,6 +6560,81 @@ async function secretsCapabilities(deps, opts) {
   }
   deps.log(formatCapabilities(report));
 }
+var PROBE_TIMEOUT_MS = 4e3;
+async function probeCapabilities(deps, repo) {
+  try {
+    const qs = new URLSearchParams({ repo }).toString();
+    const res = await deps.fetch(`${deps.apiUrl}/secrets/capabilities?${qs}`, {
+      method: "GET",
+      headers: await deps.headers(),
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+    });
+    if (!res.ok) return void 0;
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+function secretKeyLeaf(key) {
+  const slash = key.lastIndexOf("/");
+  return slash === -1 ? key : key.slice(slash + 1);
+}
+function resolveNotFoundGuidance(input) {
+  const { key, repo, slug, report } = input;
+  const tried = secretParamName(slug ?? "<repo-slug>", key);
+  const isMaster = report?.role === "master";
+  const mnemonic = `Org-infra shape: \`--slug\` is ALWAYS \`${ORG_INFRA_SLUG}\`; the provider is the key's FIRST SEGMENT (e.g. \`cloudflare/API_TOKEN --slug ${ORG_INFRA_SLUG}\`).`;
+  const escalate = (target) => target && target.slug === ORG_INFRA_SLUG ? `Approved escalation: mmi-cli secrets request ${key} --repo ${repo} --reason "org-infra grant for ${target.scope} (key ${target.key}, slug ${ORG_INFRA_SLUG}) \u2014 <why it is needed>"` : `Approved escalation: mmi-cli secrets request ${key} --repo ${repo} --reason "<why it is needed>"`;
+  const leaf = secretKeyLeaf(key);
+  const sameLeaf = (report?.capabilities ?? []).filter(
+    (c) => secretKeyLeaf(c.key) === leaf && !(c.slug === slug && c.key === key)
+  );
+  const exact = sameLeaf.filter((c) => slug ? c.key === `${slug}/${leaf}` : false);
+  const unambiguous = exact.length === 1 ? exact : sameLeaf.length === 1 ? sameLeaf : [];
+  const usable = unambiguous.find((c) => c.accessible);
+  if (usable) {
+    return {
+      reachable: true,
+      lines: [
+        `Secret ${key} was not found at ${tried}.`,
+        `It lives at ${usable.scope} and you can already consume it \u2014 no request needed:`,
+        `  mmi-cli secrets use ${usable.key} --slug ${usable.slug} -- <cmd>`,
+        mnemonic
+      ]
+    };
+  }
+  if (!unambiguous.length && sameLeaf.length > 1) {
+    const lines2 = [
+      `Secret ${key} was not found at ${tried}.`,
+      `${sameLeaf.length} different keys are named ${leaf} \u2014 pick the one you meant, this command cannot:`,
+      ...sameLeaf.map((c) => `  ${c.accessible ? "+" : " "} mmi-cli secrets use ${c.key} --slug ${c.slug} -- <cmd>   (${c.scope})`),
+      mnemonic
+    ];
+    if (!isMaster) lines2.push(escalate(sameLeaf.find((c) => !c.accessible)));
+    return { reachable: false, lines: lines2 };
+  }
+  if (unambiguous.length) {
+    const other = unambiguous[0];
+    const lines2 = [
+      `Secret ${key} was not found at ${tried}.`,
+      `A key named ${leaf} exists at ${other.scope}, but it is not granted to you (this is an ACCESS gap, not a missing key).`
+    ];
+    if (isMaster) lines2.push("You are master \u2014 grant yourself directly: `mmi-cli secrets grant <repo> <login> <provider>/<KEY>`.");
+    else lines2.push(escalate(other));
+    return { reachable: false, lines: lines2 };
+  }
+  const lines = [
+    `Secret ${key} was not found at ${tried}, and no key named ${leaf} is visible to you.`,
+    `Locate it by intent first: \`mmi-cli secrets find "<what it is for>"\` \u2014 it returns the exact keyless-use command.`,
+    mnemonic
+  ];
+  if (isMaster) {
+    lines.push("You are master: if it truly does not exist yet, create it with `mmi-cli secrets set` rather than requesting a grant from yourself.");
+  } else {
+    lines.push(escalate());
+  }
+  return { reachable: false, lines };
+}
 async function fetchCatalog(deps, label, repo, extra) {
   const qs = new URLSearchParams({ repo, ...extra }).toString();
   let res;
@@ -6754,11 +6902,17 @@ async function secretsVerify(deps, key, opts) {
     deps.err(`invalid secret key ${JSON.stringify(key)}`);
     return false;
   }
-  if (!providerForSecretKey(key)) {
-    deps.err(`no provider verifier configured for ${secretLeafName(key)}`);
-    return false;
-  }
+  const hasProviderVerifier = Boolean(providerForSecretKey(key));
   const value = await fetchSecretValue(deps, key, opts);
+  if (!hasProviderVerifier) {
+    if (!value) {
+      deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
+      deps.err(`Locate a key across every vault you can reach: mmi-cli org access capabilities${opts.repo ? ` --repo ${opts.repo}` : ""}`);
+      return false;
+    }
+    deps.log(`${key}: PRESENT (${value.length} chars) \u2014 reachability only; no provider verifier is configured for ${secretLeafName(key)}, so the credential itself was not validated`);
+    return true;
+  }
   if (!value) {
     deps.err(`secrets verify: could not read ${key}; no value was printed`);
     return false;
@@ -6777,6 +6931,16 @@ async function secretsRequest(deps, key, opts) {
     return false;
   }
   const repo = await targetRepo(deps, opts);
+  const requester = await probeCapabilities(deps, repo);
+  if (requester?.role === "master") {
+    deps.err(`secrets request: you are master on ${repo} \u2014 a request would file an issue and notify yourself.`);
+    const candidates = (requester.capabilities ?? []).filter((c) => secretKeyLeaf(c.key) === secretKeyLeaf(key) && c.accessible);
+    const reachable = candidates.length === 1 ? candidates[0] : void 0;
+    if (reachable) deps.err(`${key} is already reachable: \`mmi-cli secrets use ${reachable.key} --slug ${reachable.slug} -- <cmd>\``);
+    else if (candidates.length > 1) deps.err(`${candidates.length} keys are named ${secretKeyLeaf(key)} \u2014 pick one with \`mmi-cli secrets find "<what it is for>"\`.`);
+    else deps.err(`Grant directly with \`mmi-cli secrets grant <repo> <login> <provider>/<KEY>\`, or create it with \`mmi-cli secrets set\` if it does not exist yet.`);
+    return false;
+  }
   const res = await deps.fetch(`${deps.apiUrl}/secrets/request`, {
     method: "POST",
     headers: await deps.headers({ "content-type": "application/json" }),
@@ -6903,6 +7067,11 @@ async function secretsDeclare(deps, key, opts) {
   const body = await readJsonBody(res);
   if (!res.ok) {
     deps.err(await upgradeMessage(res, body) ?? `secrets declare failed: HTTP ${res.status}${errorDetail(body)}`);
+    if (res.status === 404 && !errorDetail(body)) {
+      deps.err(
+        `The Hub did not recognize the declare route (no error body \u2014 an API-gateway 404, not an authority refusal). Fall back to the master-side catalog write: mmi-cli org project set ${repo} --secrets-file <catalog.json> (shape: keyed by env name; each entry {key,purpose,group,owner,stages[],consumers[]} \u2014 see docs/Guides/oauth-provision.md \xA7 Cred catalog shape).`
+      );
+    }
     return false;
   }
   if (opts.json) {
@@ -7115,7 +7284,12 @@ async function secretsUse(deps, key, opts) {
         "  \u2022 Runtime: the central deploy injects the declared stage env; broker consumers use the workload's scoped runtime token. Never bake a value into an image or commit it.",
         `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
         "  \u2022 Own project: the stageless canonical and any declared dev/rc/main overrides are project-admin self-service.",
-        "  \u2022 Org-infra/cross-slug keys remain master-gated unless exactly granted."
+        "  \u2022 Org-infra/cross-slug keys remain master-gated unless exactly granted.",
+        "",
+        "Answer it without consuming it (#3436):",
+        "  \u2022 WHERE does a key live, across every vault you can reach: `mmi-cli org access capabilities` (names + tier + scope, never values). `secrets list` is this repo only and cannot see _org.",
+        `  \u2022 DOES it exist here: \`mmi-cli secrets verify ${key}${opts.slug ? ` --slug ${opts.slug}` : ""}\` \u2014 PRESENT/ABSENT even with no provider verifier configured.`,
+        "  \u2022 PowerShell note: `mmi-cli` resolves to npm's mmi-cli.ps1, whose binder eats the `--` separator. The wrapped command works either way; if a flag still misbinds, call `mmi-cli.cmd` explicitly."
       ].join("\n")
     );
     return;
@@ -7135,8 +7309,8 @@ async function secretsUse(deps, key, opts) {
   if (!res.ok) {
     const body = await readJsonBody(res);
     if (res.status === 404 && body.code === "secret_not_found") {
-      deps.err(`Secret ${key} was not found.`);
-      deps.err(`Approved escalation: mmi-cli secrets request ${key} --repo ${repo} --reason "<why it is needed>"`);
+      const guidance = resolveNotFoundGuidance({ key, repo, slug, report: await probeCapabilities(deps, repo) });
+      for (const line of guidance.lines) deps.err(line);
       return false;
     }
     deps.err(
@@ -7361,18 +7535,37 @@ async function preservedBranches() {
     return [];
   }
 }
-async function siblingWorktreeDirs() {
+async function siblingWorktreeDirs(explicitRoot) {
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const siblingRoot = siblingMmiWorktreesRoot(repoRoot2);
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path8.dirname)((0, import_node_path8.dirname)(worktreeGitRoot)) : repoRoot2;
   try {
-    const entries = (0, import_node_fs10.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path8.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const dirs = explicitRoot ? listDirsIn(resolveExplicitScanRoot(explicitRoot, primaryRepoRoot)) : worktreeScanDirs(siblingMmiWorktreesRoot(primaryRepoRoot), primaryRepoRoot, listDirsIn, isRepoCheckoutDir);
+    return dirs.map((dir) => inspectSiblingWorktreeDir(dir, worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
 }
-async function gcPlan(remote, limit) {
+function listDirsIn(dir) {
+  try {
+    return (0, import_node_fs10.readdirSync)(dir, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => (0, import_node_path8.join)(dir, ent.name));
+  } catch {
+    return [];
+  }
+}
+function isRepoCheckoutDir(dir) {
+  return (0, import_node_fs10.existsSync)((0, import_node_path8.join)(dir, ".git"));
+}
+function resolveExplicitScanRoot(explicitRoot, repoRoot2) {
+  let rootDirs;
+  try {
+    rootDirs = (0, import_node_fs10.readdirSync)(explicitRoot, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
+  } catch {
+    return explicitRoot;
+  }
+  return explicitRepoWorktreesRoot(explicitRoot, repoRoot2, rootDirs);
+}
+async function gcPlan(remote, limit, opts = {}) {
   const [branches, heads, current, stale, prs, worktrees, siblingDirs, preserved] = await Promise.all([
     gitOut(["branch", "--format=%(refname:short)"]),
     localBranchHeads(),
@@ -7382,7 +7575,7 @@ async function gcPlan(remote, limit) {
     }),
     ghPrs(limit),
     worktreeBranches(),
-    siblingWorktreeDirs(),
+    siblingWorktreeDirs(opts.root),
     preservedBranches()
   ]);
   return buildGcPlan({
@@ -7397,6 +7590,62 @@ async function gcPlan(remote, limit) {
     preservedBranches: preserved
   });
 }
+var STRAY_ROOT_WALK_BUDGET_MS = 4e3;
+function measureWorktreeRoot(root, deadline) {
+  let dirs = 0;
+  let bytes = 0;
+  let partial = false;
+  const stack = [root];
+  let depth0 = true;
+  while (stack.length) {
+    if (Date.now() > deadline) {
+      partial = true;
+      break;
+    }
+    const current = stack.pop();
+    let entries;
+    try {
+      entries = (0, import_node_fs10.readdirSync)(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const ent of entries) {
+      const child2 = (0, import_node_path8.join)(current, ent.name);
+      if (ent.isDirectory()) {
+        if (depth0) dirs++;
+        let isLink = false;
+        try {
+          (0, import_node_fs10.readlinkSync)(child2);
+          isLink = true;
+        } catch {
+        }
+        if (!isLink) stack.push(child2);
+      } else if (ent.isFile()) {
+        try {
+          bytes += (0, import_node_fs10.statSync)(child2).size;
+        } catch {
+        }
+      }
+    }
+    depth0 = false;
+  }
+  return partial ? { dirs, bytes, partial } : { dirs, bytes };
+}
+function worktreeRootsProbe(repoRoot2) {
+  const authoritative = siblingMmiWorktreesRoot(repoRoot2);
+  const container = (0, import_node_path8.dirname)(authoritative);
+  let names;
+  try {
+    names = (0, import_node_fs10.readdirSync)(container, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
+  } catch {
+    return { authoritative, stray: [] };
+  }
+  const deadline = Date.now() + STRAY_ROOT_WALK_BUDGET_MS;
+  return {
+    authoritative,
+    stray: strayWorktreeRootPaths(container, names, authoritative).map((path2) => ({ path: path2, ...measureWorktreeRoot(path2, deadline) }))
+  };
+}
 
 // src/repo-resolve.ts
 function slugOf(repoOrSlug) {
@@ -8873,7 +9122,7 @@ async function provisionWorktree(worktreeRoot, deps) {
 }
 function defaultWorktreePath(repoRoot2, branch) {
   const safe = branch.replace(/[/\\]+/g, "-");
-  return (0, import_node_path11.join)((0, import_node_path11.dirname)(repoRoot2), "mmi-worktrees", safe);
+  return (0, import_node_path11.join)((0, import_node_path11.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path11.basename)(repoRoot2), safe);
 }
 async function primaryCheckoutRootOf(git) {
   try {
@@ -8984,7 +9233,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path26 = require("node:path");
+var import_node_path27 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -9179,8 +9428,11 @@ async function waitForPrChecks(deps) {
       failureStreak += 1;
       if (failureStreak >= PR_CHECKS_FAILURE_CONFIRMATIONS) {
         const diagnosis = deps.diagnoseFailure ? await deps.diagnoseFailure().catch(() => null) : null;
-        if (diagnosis?.cause === "ci-budget-kill") {
-          return { policy, status: "failure", reason: diagnosis.reason, detail: "ci-budget-kill" };
+        if (diagnosis?.cause === "stale-head") {
+          return { policy, status: "failure", reason: diagnosis.reason, detail: "stale-head" };
+        }
+        if (diagnosis?.cause === "runner-infra") {
+          return { policy, status: "failure", reason: diagnosis.reason, detail: "runner-infra" };
         }
         return { policy, status: "failure", reason, detail: "checks-failure" };
       }
@@ -9434,7 +9686,7 @@ var MANAGED_GITIGNORE_LINES = [
   // and `.cursor/rules/` because a repo may want its rules tracked despite the wall.
   ".codex/",
   ".agents/",
-  // #2321 doctrine: the canonical worktree home is the SIBLING `../mmi-worktrees/<branch>` (outside the tree,
+  // #2321 doctrine: the canonical worktree home is the SIBLING `../mmi-worktrees/<RepoName>/<branch>` (outside the tree,
   // via `mmi-cli worktree create`), so a repo-local `.worktrees/` is NOT un-ignored org-wide — `mmi-cli
   // doctor` flags one explicitly instead (buildRepoLocalWorktreeCheck) rather than baking the fallback path
   // into every repo's .gitignore.
@@ -11774,6 +12026,10 @@ var PATH_OVERRIDES = {
   "secrets grant": { category: "admin", discovery: "all-only", help_group: "Operations" },
   "secrets revoke": { category: "admin", discovery: "all-only", help_group: "Operations" }
 };
+var DEFAULT_ADMIN_MARKER = "(master-only)";
+var ADMIN_MARKERS = {
+  "secrets org-catalog": "(writes master-only)"
+};
 var HIDDEN_OPTIONS = {
   "worktree create": ["--base"],
   "org project set": ["--set"]
@@ -11808,27 +12064,42 @@ function setCommandMetadata(command, metadata) {
 function commandMetadata(command) {
   return command[COMMAND_METADATA];
 }
-function classifyTree(command, path2, inherited) {
-  const metadata = PATH_OVERRIDES[path2] ?? inherited;
+var REQUIRED_OPTION_HELP = {
+  optionDescription(option) {
+    const described = Help.prototype.optionDescription.call(this, option);
+    return option.mandatory ? `(required) ${described}` : described;
+  }
+};
+function classifyTree(command, path2, inherited, hideFromParent) {
+  const override = PATH_OVERRIDES[path2];
+  const metadata = override ?? inherited;
   setCommandMetadata(command, metadata);
-  if (metadata.discovery !== "primary") {
+  const hideByOverride = override !== void 0 && metadata.discovery === "hidden";
+  if ((hideByOverride || hideFromParent) && metadata.discovery !== "primary") {
     command._hidden = true;
   }
+  if (override !== void 0 && metadata.discovery === "all-only" && metadata.category === "admin" && !command.summary()) {
+    const marker = ADMIN_MARKERS[path2] ?? DEFAULT_ADMIN_MARKER;
+    const described = command.description();
+    command.summary(described ? `${marker} ${described}` : marker);
+  }
   for (const option of command.options) {
     if ((HIDDEN_OPTIONS[path2] ?? []).includes(option.long ?? option.short ?? "")) option.hideHelp();
   }
+  command.configureHelp(REQUIRED_OPTION_HELP);
   for (const child2 of command.commands) {
     const childPath = path2 ? `${path2} ${child2.name()}` : child2.name();
-    classifyTree(child2, childPath, PATH_OVERRIDES[childPath] ?? metadata);
+    classifyTree(child2, childPath, metadata, false);
   }
 }
 function applyCommandTaxonomy(program3) {
   for (const command of program3.commands) {
     const metadata = topLevelMetadata(command.name());
     command.helpGroup(metadata.help_group);
-    classifyTree(command, command.name(), metadata);
+    classifyTree(command, command.name(), metadata, true);
   }
   program3.configureHelp({
+    ...REQUIRED_OPTION_HELP,
     visibleCommands(command) {
       const visible = command.commands.filter((child2) => !child2._hidden);
       const helpCommand = command._getHelpCommand();
@@ -16872,7 +17143,7 @@ async function withSecrets(run) {
 function registerSecretsCommands(program3) {
   const secrets = program3.command("secrets").description("project vault \u2014 project-admins self-serve their own repo's full tree (stageless + dev/rc/main); org-infra namespaces are master-gated");
   secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsWhere(d, o)));
-  secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
+  secrets.command("list").description("list secret NAMES + tier for THIS repo (never values). To locate a key you cannot place \u2014 including org-infra (_org) \u2014 use the cross-slug view: `mmi-cli org access capabilities` (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
   secrets.command("find <intent>").description("resolve a plain-language intent to canonical secret names + the exact keyless-use command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
     if (!await secretsFind(d, intent, o)) process.exitCode = 1;
   }));
@@ -16995,7 +17266,7 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("verify <key>").description("validate a known provider secret without printing its value").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+  secrets.command("verify <key>").description("validate a known provider secret without printing its value; a key with no configured provider verifier falls back to a value-free PRESENT/ABSENT reachability check (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
@@ -17045,7 +17316,7 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   }));
   secrets.command("rm <key>").description("remove a secret from your own full project vault; org-infra requires master or an exact grant. --slug _org removes an org-infra <provider>/<KEY> value (#3315)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value removal \u2014 master or an exact grant (#3315)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
-  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
+  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it. The wrapped command keeps its OWN flags (`-- node -e \u2026`, `-- curl -H \u2026`) with or without the `--`, because npm's PowerShell shim swallows `--` before the CLI sees it (#3436)").allowUnknownOption().option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
     const ok = await secretsUse(d, key, { ...o, command });
     if (ok === false) process.exitCode = 1;
   }));
@@ -17459,9 +17730,9 @@ function extractWorkflowCrons(yamlText) {
 function workflowEntry(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   if (!crons.length) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
   return {
-    name: `${repo}/${basename3.replace(/\.ya?ml$/, "")}`,
+    name: `${repo}/${basename4.replace(/\.ya?ml$/, "")}`,
     cadence: crons.join(" + "),
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
@@ -17493,16 +17764,30 @@ function awsRuleEntries(payload) {
   }
   return entries;
 }
+function lambdaTargetFromArn(arn) {
+  const marker = ":function:";
+  const i = arn.indexOf(marker);
+  if (i < 0) return { functionName: arn.split(":").pop() ?? "" };
+  const rest = arn.slice(i + marker.length);
+  const q = rest.indexOf(":");
+  if (q < 0) return { functionName: rest };
+  return { functionName: rest.slice(0, q), qualifier: rest.slice(q + 1) };
+}
 function awsScheduleEntry(payload) {
   if (!payload || typeof payload !== "object") return null;
   const { Name, ScheduleExpression, State, Target, Description } = payload;
   if (typeof Name !== "string" || typeof ScheduleExpression !== "string") return null;
   if (State !== "ENABLED" || isJervResource(Name)) return null;
   let target = "";
+  let qualifier;
   let scheduleId;
   if (Target && typeof Target === "object") {
     const { Arn, Input } = Target;
-    if (typeof Arn === "string") target = Arn.split(":").pop() ?? "";
+    if (typeof Arn === "string") {
+      const parsed = lambdaTargetFromArn(Arn);
+      target = parsed.functionName;
+      qualifier = parsed.qualifier;
+    }
     if (typeof Input === "string") {
       try {
         const parsed = JSON.parse(Input);
@@ -17511,13 +17796,15 @@ function awsScheduleEntry(payload) {
       }
     }
   }
+  const sourceBase = `aws scheduler schedule ${Name} (eu-central-1)`;
+  const source = qualifier && target ? `${sourceBase} \u2192 ${target}:${qualifier}` : sourceBase;
   return {
     name: Name,
     cadence: ScheduleExpression,
     executor: target ? `aws-scheduler \u2192 ${target}` : "aws-scheduler",
     llm: readLlmDeclaration(typeof Description === "string" ? Description : void 0),
     resolved: "live",
-    source: `aws scheduler schedule ${Name} (eu-central-1)`,
+    source,
     ...scheduleId ? { scheduleId } : {}
   };
 }
@@ -17673,7 +17960,7 @@ function strayCronDrifts(workflows) {
 function unlauncheredLlmDrift(entry) {
   if (entry.llm !== "yes") return null;
   if (isHarbourLlmLauncher(entry.executor)) return null;
-  if (entry.executor.startsWith("aws-scheduler") && entry.executor.includes("mmi-hub-schedule-dispatcher")) return null;
+  if (entry.executor === "aws-scheduler \u2192 mmi-hub-schedule-dispatcher") return null;
   const allowed = [...HARBOUR_LLM_LAUNCHERS].join(", ");
   return {
     class: "unlaunchered-llm",
@@ -17766,8 +18053,8 @@ async function repoWorkflowEntries(client, repo) {
       );
       if (typeof contents?.content !== "string" || contents.encoding !== "base64") continue;
       const text = Buffer.from(contents.content, "base64").toString("utf8");
-      const basename3 = wf.path.split("/").pop() ?? wf.path;
-      const name = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+      const basename4 = wf.path.split("/").pop() ?? wf.path;
+      const name = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
       workflows.push({ name, yamlText: text });
       const entry = workflowEntry(repo, wf.path, text);
       if (entry) entries.push(entry);
@@ -17990,8 +18277,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
   if (!crons.length && !header.schedule) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
-  const expectedId = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
     throw new Error(`schedules lift: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
@@ -18179,7 +18466,9 @@ function planInfraTunnel(hostname, upstream) {
   ].join("\n");
   const steps = [
     "Install cloudflared on the box (or run locally for dev-only tunnels).",
-    "Fetch CF account creds (master-gated): mmi-cli secrets use --slug cloudflare API_TOKEN -- <cmd>",
+    // #3463: `--slug <provider> <KEY>` is the retired shape and resolves to nothing. Org-infra is one
+    // slug (`_org`) with the provider as the key's first segment.
+    "Fetch CF account creds (master-gated): mmi-cli secrets use cloudflare/API_TOKEN --slug _org -- <cmd>",
     "Create tunnel: cloudflared tunnel create " + tunnelName,
     "Route DNS: cloudflared tunnel route dns " + tunnelName + " " + host,
     "Write config (below) to /etc/cloudflared/config.yml and run: cloudflared tunnel run " + tunnelName,
@@ -18204,7 +18493,7 @@ function formatInfraTunnelPlan(plan) {
 function registerEdgeCommands(program3) {
   const edge = program3.command("edge").description("infra-service edge helpers (non-tenant loopback services)");
   const tunnel = edge.command("tunnel").description("Cloudflare Tunnel planning for loopback infra services");
-  tunnel.command("plan").description("print a cloudflared tunnel plan (no API calls \u2014 use with secrets use --slug cloudflare)").requiredOption("--hostname <host>", "public hostname (e.g. open-meteo.tools.mutatismutandis.co)").requiredOption("--upstream <url>", "loopback origin (e.g. http://127.0.0.1:8080)").option("--json", "machine-readable output").action((o) => {
+  tunnel.command("plan").description("print a cloudflared tunnel plan (no API calls \u2014 pair with `secrets use cloudflare/API_TOKEN --slug _org`)").requiredOption("--hostname <host>", "public hostname (e.g. open-meteo.tools.mutatismutandis.co)").requiredOption("--upstream <url>", "loopback origin (e.g. http://127.0.0.1:8080)").option("--json", "machine-readable output").action((o) => {
     try {
       const plan = planInfraTunnel(o.hostname, o.upstream);
       if (o.json) {
@@ -20101,6 +20390,7 @@ function registerBoardCommands(program3) {
 // src/merge-cleanup.ts
 var import_node_fs24 = require("node:fs");
 var import_promises5 = require("node:fs/promises");
+var import_node_path22 = require("node:path");
 var import_node_child_process11 = require("node:child_process");
 
 // src/board-advance.ts
@@ -20410,7 +20700,7 @@ function assertPrMergeHousekeepingClean(startingPath, context, options = {}) {
   if (verdict.blocked) throw new Error(verdict.reason);
   return housekeeping;
 }
-async function applyGcPlan(plan, remote) {
+async function applyGcPlan(plan, remote, opts = {}) {
   const result = { removedBranches: [], removedRemoteBranches: [], removedTrackingRefs: [], removedWorktreeDirs: [], failed: [], pruned: false };
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
@@ -20444,8 +20734,9 @@ async function applyGcPlan(plan, remote) {
   result.failed.push(...branchTracking.failed);
   const removeDeps = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
-  const siblingRoot = siblingMmiWorktreesRoot(repoRoot2);
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path22.dirname)((0, import_node_path22.dirname)(worktreeGitRoot)) : repoRoot2;
+  const siblingRoot = opts.root ? resolveExplicitScanRoot(opts.root, primaryRepoRoot) : siblingMmiWorktreesRoot(primaryRepoRoot);
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
@@ -20748,14 +21039,30 @@ function parseRestPrSnapshot(json) {
   const pr2 = json ?? {};
   const headSha = pr2.head?.sha ?? "";
   if (!headSha) throw new Error("pulls endpoint returned no head SHA");
+  const headRepo = pr2.head?.repo?.full_name;
+  const baseRepo = pr2.base?.repo?.full_name;
   return {
     headSha,
+    headRef: pr2.head?.ref ?? "",
+    // Only call it a fork when BOTH names are known and differ — an absent name (private/deleted fork)
+    // must not read as same-repo and send a git-ref probe at a branch the base repo does not have.
+    headIsFork: Boolean(headRepo && baseRepo && headRepo !== baseRepo),
     mergeable: pr2.mergeable === true ? "MERGEABLE" : pr2.mergeable === false ? "CONFLICTING" : "UNKNOWN",
     baseRef: pr2.base?.ref ?? "development",
     merged: pr2.merged === true,
     state: pr2.state ?? ""
   };
 }
+async function fetchBranchTipSha(repo, ref, gh = defaultGhApi) {
+  if (!ref) return null;
+  try {
+    const parsed = JSON.parse(await gh([`repos/${repo}/git/ref/heads/${ref}`]));
+    const sha = parsed.object?.sha;
+    return typeof sha === "string" && sha ? sha : null;
+  } catch {
+    return null;
+  }
+}
 async function fetchRestPrSnapshot(prNumber, repo, gh = defaultGhApi) {
   return parseRestPrSnapshot(JSON.parse(await gh([`repos/${repo}/pulls/${prNumber}`])));
 }
@@ -20790,36 +21097,54 @@ async function pollRestPrMerged(prNumber, repo, gh = defaultGhApi) {
   }
 }
 var CI_BUDGET_ANNOTATION_TITLE = "CI budget exceeded";
+var CI_DISK_ANNOTATION_TITLE = "CI runner disk";
+var CI_TOOLCHAIN_ANNOTATION_TITLE = "CI runner toolchain";
+var RUNNER_INFRA_ANNOTATION_TITLES = /* @__PURE__ */ new Set([
+  CI_BUDGET_ANNOTATION_TITLE,
+  CI_DISK_ANNOTATION_TITLE,
+  CI_TOOLCHAIN_ANNOTATION_TITLE
+]);
 function isErrorAnnotation(a) {
   const level = a.annotation_level?.toLowerCase();
   return level === "failure" || level === "error";
 }
 function classifyFailedChecks(failing) {
-  const budgetKilled = [];
+  const infraFailures = [];
   const otherFailures = [];
   for (const check of failing) {
     const errors = check.annotations.filter(isErrorAnnotation);
-    const allBudget = errors.length > 0 && errors.every((a) => a.title?.trim() === CI_BUDGET_ANNOTATION_TITLE);
-    (allBudget ? budgetKilled : otherFailures).push(check.name);
+    const allInfra = errors.length > 0 && errors.every((a) => RUNNER_INFRA_ANNOTATION_TITLES.has(a.title?.trim() ?? ""));
+    (allInfra ? infraFailures : otherFailures).push(check.name);
   }
-  if (budgetKilled.length && !otherFailures.length) {
+  if (infraFailures.length && !otherFailures.length) {
     return {
-      cause: "ci-budget-kill",
-      budgetKilled,
+      cause: "runner-infra",
+      infraFailures,
       otherFailures,
-      reason: `${budgetKilled.length} check(s) were KILLED for wall-clock, not failed: ${budgetKilled.join(", ")}. No test failed \u2014 this is runner contention (concurrent gates sharing one runner). Rerun once the other gates drain (gh run rerun --failed); do not debug the diff.`
+      reason: `${infraFailures.length} check(s) failed on RUNNER INFRASTRUCTURE, not your diff: ${infraFailures.join(", ")}. No test failed \u2014 the shared runner hit a wall-clock budget kill, ran out of disk, or was missing a toolchain (the check annotation names which). Re-run once the runner drains/heals (gh run rerun --failed); do not debug the diff.`
     };
   }
   return {
     cause: "checks-failure",
-    budgetKilled,
+    infraFailures,
     otherFailures,
-    reason: budgetKilled.length ? `checks failed: ${otherFailures.join(", ")}; separately, ${budgetKilled.join(", ")} was killed for wall-clock, not failed.` : `checks failed: ${otherFailures.join(", ") || "unknown"}.`
+    reason: infraFailures.length ? `checks failed: ${otherFailures.join(", ")}; separately, ${infraFailures.join(", ")} failed on runner infrastructure, not a test.` : `checks failed: ${otherFailures.join(", ") || "unknown"}.`
   };
 }
 async function diagnoseFailedRestChecks(prNumber, repo, gh = defaultGhApi) {
   try {
     const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh);
+    if (!snapshot.headIsFork) {
+      const branchTip = await fetchBranchTipSha(repo, snapshot.headRef, gh);
+      if (branchTip && branchTip !== snapshot.headSha) {
+        return {
+          cause: "stale-head",
+          infraFailures: [],
+          otherFailures: [],
+          reason: `the PR head (${snapshot.headSha.slice(0, 7)}) is BEHIND the branch tip (${branchTip.slice(0, 7)}) \u2014 GitHub likely dropped a \`synchronize\` event, so the reported red is a superseded commit and NO run exists for your current push. This is not your diff failing. Re-push (an empty commit is enough) or close and reopen the PR to re-sync the head and trigger a fresh run.`
+        };
+      }
+    }
     const failing = (await fetchHeadCheckRuns(snapshot.headSha, repo, gh)).filter((run) => classifyCheckRun(run) === "fail" && typeof run.id === "number");
     if (!failing.length) return null;
     const annotated = await Promise.all(failing.map(async (run) => ({
@@ -20844,7 +21169,7 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 
 // src/worktree-lifecycle-commands.ts
 var import_node_fs25 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -20947,7 +21272,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path22.join)(root, e.name));
+      return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path23.join)(root, e.name));
     } catch {
       return [];
     }
@@ -21003,13 +21328,13 @@ function registerWorktreeCommands(program3) {
       if (PROTECTED_BRANCHES2.has(branch)) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
-      const gitFile = (0, import_node_path22.join)(wtPath, ".git");
+      const gitFile = (0, import_node_path23.join)(wtPath, ".git");
       const isLinked = (0, import_node_fs25.existsSync)(gitFile) && (0, import_node_fs25.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path22.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path23.dirname)(commonDir) : wtPath;
       const stageSummary = readStageSummary(wtPath);
       const hasStage = stageSummary != null;
       const steps = landSteps(branch, true, hasStage);
@@ -21119,10 +21444,15 @@ async function gatherWorktreeContext() {
     const s = readStageSummary(wt.path);
     if (s) stages.push({ path: wt.path, port: s.port });
   }
-  const wtRoot = siblingMmiWorktreesRoot(repoRoot2);
+  const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path23.dirname)((0, import_node_path23.dirname)(worktreeGitRoot)) : repoRoot2;
+  const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
   if ((0, import_node_fs25.existsSync)(wtRoot)) {
-    orphanDirs = scanOrphanDirs(wtRoot, await currentRepoWorktreeGitRoot(repoRoot2));
+    orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
+      ...defaultOrphanDirScanDeps,
+      listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
+    });
   }
   return { worktrees, localBranches, currentBranch: currentBranch2, openPrBranches, closedBranches, stages, orphanDirs };
 }
@@ -21711,11 +22041,11 @@ ${lines}`);
 
 // src/train-commands.ts
 var import_node_fs28 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/plugin-guard-io.ts
 var import_node_fs27 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
@@ -21845,7 +22175,7 @@ function runHostBin(bin, args, opts) {
 }
 var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
@@ -21857,11 +22187,11 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path23.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path23.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path24.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path24.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path23.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path24.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
 function marketplaceClonePresent(surface, home, exists = import_node_fs27.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
@@ -21891,7 +22221,7 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -22026,7 +22356,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -23169,6 +23499,28 @@ function checkRepoWorktrees(probe) {
     ]
   };
 }
+function formatBytes(bytes, partial) {
+  const prefix = partial ? "\u2265" : "";
+  return bytes >= 1e9 ? `${prefix}${(bytes / 1e9).toFixed(2)} GB` : `${prefix}${(bytes / 1e6).toFixed(1)} MB`;
+}
+function checkWorktreeRoots(probe) {
+  if (!probe) return null;
+  const evidence = [
+    `scanned by worktree gc/list: ${probe.authoritative}`,
+    ...probe.stray.length ? probe.stray.map((s) => `unreachable by any gc: ${s.path} \u2014 ${s.dirs} dir(s), ${formatBytes(s.bytes, s.partial)}`) : ["no other *worktrees* directory beside this repo"]
+  ];
+  if (!probe.stray.length) return { ok: true, label: "worktree roots", verbose: evidence };
+  const named = probe.stray.map((s) => `${s.path} (${s.dirs} dir(s), ${formatBytes(s.bytes, s.partial)})`).join("; ");
+  const cutShort = probe.stray.some((s) => s.partial) ? " (a \u2265 figure is a floor \u2014 the size walk hit its time budget, so the real total is larger)" : "";
+  return {
+    ok: false,
+    label: "worktree roots",
+    // The fix is a review, never a delete: `gc --root` still refuses anything it cannot classify as dead,
+    // and doctor itself — with or without --apply — never touches these directories.
+    fix: `${probe.stray.length} worktrees root(s) outside ${probe.authoritative} \u2014 ${named}; no gc scans them. Review, then sweep deliberately from the owning repo with \`mmi-cli worktree gc --root <path> --apply\` (report-only here: doctor never deletes these)${cutShort}`,
+    verbose: evidence
+  };
+}
 function pluginHealTrigger(probe) {
   if (probe.guardState === "no-install" || probe.guardState === "unresolved") return "unresolved";
   const behind = Boolean(probe.installed && probe.released) && compareVersions(probe.installed, probe.released) < 0;
@@ -23306,6 +23658,45 @@ function checkDocsAudit(probe) {
   }
   return { ok: true, label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
 }
+function checkSessionPayload(probe) {
+  if (!probe) return null;
+  const { chars } = probe;
+  const evidence = [
+    `last emitted: ${chars} characters${probe.at ? ` (${probe.at})` : ""}`,
+    `budget ${SESSION_PAYLOAD_BUDGET_CHARS}, Claude Code cap ${SESSION_PAYLOAD_CAP_CHARS}`,
+    // Named in the evidence because the units are the whole trap: the cap is documented in characters
+    // while the runtime's overflow message reports bytes, and they diverge on the non-ASCII the doctrine
+    // blocks preserve. A reader comparing this number to a byte figure is comparing two different things.
+    "measured in CHARACTERS (the documented unit of the cap), never bytes"
+  ];
+  const status = sessionPayloadStatus(chars);
+  if (status === "red") {
+    return {
+      ok: false,
+      label: "SessionStart payload",
+      fix: `${chars} characters exceeds the ${SESSION_PAYLOAD_CAP_CHARS}-character additionalContext cap \u2014 Claude Code truncates it to a ~2,000-character preview with no error, so agents are starting on partial doctrine; cut a block from the session-start banner`,
+      verbose: evidence
+    };
+  }
+  if (status === "amber") {
+    return {
+      ok: true,
+      // warn: the banner lane must print this too. Without it the banner's failing-only filter made the
+      // amber tier dead code on the one lane that runs every session — drift past the budget was
+      // invisible until it became a truncation. Still ✓, still never moves the exit code.
+      warn: true,
+      label: "SessionStart payload",
+      detail: `amber \u2014 ${chars} characters, over the ${SESSION_PAYLOAD_BUDGET_CHARS}-character budget and ${SESSION_PAYLOAD_CAP_CHARS - chars} from the hard cap`,
+      verbose: evidence
+    };
+  }
+  return {
+    ok: true,
+    label: "SessionStart payload",
+    detail: `${chars} of ${SESSION_PAYLOAD_BUDGET_CHARS} budgeted characters`,
+    verbose: evidence
+  };
+}
 function planGitignore(current) {
   const { content, changed } = upsertManagedGitignoreBlock(current);
   return changed ? { ok: false, content } : { ok: true };
@@ -23401,6 +23792,10 @@ async function runDoctorClean(opts, io, deps) {
     checks.push(checkCliVersion(cliInput));
   }
   checks.push(checkPluginCache(deps.pluginCache()));
+  if (deps.sessionPayload) {
+    const payload = checkSessionPayload(deps.sessionPayload());
+    if (payload) checks.push(payload);
+  }
   if (!opts.fast && !opts.banner && !opts.preflight) {
     const probe = await deps.schedulesNotebook().catch((e) => ({
       armed: 0,
@@ -23421,6 +23816,11 @@ async function runDoctorClean(opts, io, deps) {
     const docsAudit2 = checkDocsAudit(probe);
     if (docsAudit2) checks.push(docsAudit2);
   }
+  if (!opts.fast && !opts.banner && !opts.preflight && deps.worktreeRoots) {
+    const probe = await deps.worktreeRoots().catch(() => void 0);
+    const roots = checkWorktreeRoots(probe);
+    if (roots) checks.push(roots);
+  }
   if (isOrgRepo && !opts.fast && !opts.banner) {
     try {
       checks.push(checkTrainSync(await deps.syncTrain()));
@@ -23492,7 +23892,7 @@ async function runDoctorClean(opts, io, deps) {
     return exitCode;
   }
   if (opts.banner) {
-    const actionable = checks.filter((c) => !c.ok);
+    const actionable = checks.filter((c) => !c.ok || c.warn);
     for (const c of actionable) {
       io.log(renderReport([c], { restartPending: false }));
       if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
@@ -23585,7 +23985,7 @@ function ghAccountCaveat(announcedLogin, accounts) {
 // src/doctor-io.ts
 var import_node_fs29 = require("node:fs");
 var import_node_os7 = require("node:os");
-var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
 var import_node_child_process12 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process12.execFile);
@@ -23593,7 +23993,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs29.readFileSync)((0, import_node_path25.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs29.readFileSync)((0, import_node_path26.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -23614,7 +24014,7 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path25.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path26.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
@@ -23653,7 +24053,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs29.existsSync)((0, import_node_path25.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -23776,7 +24176,14 @@ function mmiDoctorDeps() {
       const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
       const status = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today });
       return { armed: status.state !== "not-armed", ok: status.ok, detail: status.line };
-    }
+    },
+    // #3471: the competing-worktrees-roots probe. Full doctor only (the gather skips it on
+    // fast/banner/preflight), and READ-ONLY by construction — it stats, it never removes. Nothing here is
+    // wired to a reaper, in either mode.
+    worktreeRoots: async () => worktreeRootsProbe(await repoRoot()),
+    // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
+    // A local record read — cheap enough for every lane, including the banner.
+    sessionPayload: () => readSessionPayload(process.cwd())
   };
 }
 async function requireFreshTrainCli(commandName) {
@@ -23901,7 +24308,7 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path26.join)(process.cwd(), ".gitignore");
+  const path2 = (0, import_node_path27.join)(process.cwd(), ".gitignore");
   const current = (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -24023,12 +24430,12 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
     process.exit(process.exitCode ?? 0);
   });
 });
-gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
+gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").option("--root <path>", "sweep an explicitly named worktrees root instead of the authoritative ../mmi-worktrees (#3471) \u2014 descends into this repo container when present; ownership, dead-dir, and content guards still apply").action(async (o) => {
   if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
-      const root = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
-      const run = executeScratchGc(root, { apply: Boolean(o.apply) });
+      const root2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
+      const run = executeScratchGc(root2, { apply: Boolean(o.apply) });
       if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, ...run }, null, 2));
       return console.log(formatScratchGcPlan(run.plan, Boolean(o.apply), run.applied));
     } catch (e) {
@@ -24037,8 +24444,19 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   }
   const limit = Number.parseInt(o.limit, 10);
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
+  let root;
+  if (o.root !== void 0) {
+    root = (0, import_node_path27.resolve)(o.root);
+    if (!(0, import_node_fs30.existsSync)(root) || !(0, import_node_fs30.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
+    if (isPathUnderDirectory(gcRepoRoot, root)) {
+      return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
+    }
+  }
   try {
-    const plan = await gcPlan(o.remote, limit);
+    const plan = await gcPlan(o.remote, limit, { root });
+    if (root && !o.json) console.log(`worktree gc: scanning the explicitly named root ${root} for worktrees proven to belong to this repo
+`);
     if (o.apply && !o.json) console.log(formatGcPlan(plan, true));
     let applyResult;
     if (o.apply) {
@@ -24049,10 +24467,10 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
         // git fsmonitor daemon from inheriting this sweep's stdio pipe and wedging the git call on Windows.
         worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-c", "core.fsmonitor=false", ...args], { timeout: GIT_TIMEOUT_MS })).stdout)
       ).catch(() => void 0);
-      applyResult = await applyGcPlan(plan, o.remote);
+      applyResult = await applyGcPlan(plan, o.remote, { root });
     }
     if (o.json) {
-      console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, plan, applyResult }, null, 2));
+      console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, ...root ? { root } : {}, plan, applyResult }, null, 2));
     } else if (!o.apply) {
       console.log(formatGcPlan(plan, false));
     } else {
@@ -24117,7 +24535,7 @@ function acquireWorktreeSetupLock(worktreeRoot) {
     };
   };
   try {
-    (0, import_node_fs30.mkdirSync)((0, import_node_path26.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs30.mkdirSync)((0, import_node_path27.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
@@ -24132,7 +24550,7 @@ function acquireWorktreeSetupLock(worktreeRoot) {
 }
 var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
 withExamples(mutating(
-  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch> \u2014 authoritative; worktree gc/list scan only this root)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
+  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<RepoName>/<branch> \u2014 authoritative; the <RepoName> segment is what makes ownership provable from the path, #3471. gc/list read this root in BOTH the nested and the legacy flat shape)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
   worktreeCreatePlan
 ).action(async (target, o, cmd) => {
   try {
@@ -24548,7 +24966,7 @@ projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# fa
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload));
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|\u2026], "provider":"<optional>"}').option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -24735,7 +25153,15 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
   try {
     oc = parseOauthConfig(meta ?? {}, slug);
   } catch (e) {
-    return failGraceful(`org oauth plan: ${e.message}`);
+    const message = e.message;
+    if (/^oauth is not configured for /.test(message)) {
+      return failGraceful(
+        `org oauth plan: ${message}. Declare it in the registry META first:
+  mmi-cli org project set ${o.repo ?? `mutmutco/${slug}`} --var 'oauth={"subdomains":["${defaultSubdomain(slug)}"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}'
+  New repo? The GCP project and its Google Auth Platform consent screen must exist too \u2014 docs/Guides/oauth-provision.md \xA7 New repo.`
+      );
+    }
+    return failGraceful(`org oauth plan: ${message}`);
   }
   const origins = expectedJsOrigins(oc);
   const redirects = expectedRedirectUris(oc);
@@ -25212,11 +25638,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path26.join)(cwd, ".github", "workflows");
+  const wfDir = (0, import_node_path27.join)(cwd, ".github", "workflows");
   if (!(0, import_node_fs30.existsSync)(wfDir)) return [];
   return (0, import_node_fs30.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs30.readFileSync)((0, import_node_path26.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs30.readFileSync)((0, import_node_path27.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -25243,16 +25669,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path26.join)(root, path2);
+      const fullPath = (0, import_node_path27.join)(root, path2);
       return (0, import_node_fs30.existsSync)(fullPath) ? (0, import_node_fs30.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path26.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path27.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs30.existsSync)((0, import_node_path26.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs30.existsSync)((0, import_node_path26.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -25292,8 +25718,10 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     printLine(`pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.`);
   } else if (result.status === "rate-limited") {
     printLine(`pr checks-wait: rate-limited \u2014 ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
-  } else if (result.detail === "ci-budget-kill") {
-    printLine(`pr checks-wait: failure (wall-clock budget kill, NOT a test failure) \u2014 ${result.reason}`);
+  } else if (result.detail === "runner-infra") {
+    printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) \u2014 ${result.reason}`);
+  } else if (result.detail === "stale-head") {
+    printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) \u2014 ${result.reason}`);
   } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
@@ -25883,7 +26311,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path26.join)(path2, entry.name);
+    const child2 = (0, import_node_path27.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -25913,7 +26341,7 @@ function pluginCacheFsDeps(home, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path26.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs30.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path27.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs30.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -25927,7 +26355,7 @@ function stagingApplyFsGuard(home) {
   return {
     referencedPaths: () => readInstalledPluginRefs(home),
     mtimeMs: (name) => {
-      const p = (0, import_node_path26.join)(stagingRoot, name);
+      const p = (0, import_node_path27.join)(stagingRoot, name);
       if (!(0, import_node_fs30.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs30.statSync)(q).mtimeMs);
@@ -25963,6 +26391,8 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
     return;
   }
   spawnDeferredGcSweep();
+  const measured = measuredSessionIo(consoleIo);
+  const bannerIo = measured.io;
   const { parallel, sequential } = buildSessionStartPlan({
     // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
     // when unknown — a missing gh login must not noise or fail the banner.
@@ -26006,14 +26436,16 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       await runDoctorClean({ banner: true }, io, mmiDoctorDeps());
     }
   });
-  await runSessionStart(parallel, sequential, consoleIo);
-  for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
+  await runSessionStart(parallel, sequential, bannerIo);
+  for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
     spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
-    consoleIo.log(worktreeBanner);
+    bannerIo.log(worktreeBanner);
   }
-  appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed" });
+  const payloadChars = measured.chars();
+  recordSessionPayload(process.cwd(), payloadChars);
+  appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed", payloadChars });
 });
 installProcessBackstop();
 consolidateCommandNamespaces(program2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.48.1",
+  "version": "3.50.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",