@mutmutco/cli 3.49.0 → 3.51.0

package/dist/main.cjs

@@ -4478,6 +4478,52 @@ async function runSessionStart(parallel, sequential, io) {
   for (const lines of buffered) flush(lines, io);
   for (const step of sequential) flush(await runBufferedStep(step), io);
 }
+var SESSION_PAYLOAD_CAP_CHARS = 1e4;
+var SESSION_PAYLOAD_BUDGET_CHARS = 8e3;
+function sessionPayloadStatus(chars) {
+  if (chars > SESSION_PAYLOAD_CAP_CHARS) return "red";
+  if (chars > SESSION_PAYLOAD_BUDGET_CHARS) return "amber";
+  return "ok";
+}
+function measuredSessionIo(io) {
+  let chars = 0;
+  return {
+    io: {
+      log: (text) => {
+        chars += text.length + 1;
+        io.log(text);
+      },
+      err: (text) => io.err(text)
+    },
+    chars: () => chars
+  };
+}
+function sessionPayloadStatePath(cwd) {
+  return repoRuntimeStatePath(cwd, "session-payload.json");
+}
+function recordSessionPayload(cwd, chars, now = /* @__PURE__ */ new Date()) {
+  try {
+    const path2 = sessionPayloadStatePath(cwd);
+    (0, import_node_fs8.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
+    const record = { chars, status: sessionPayloadStatus(chars), at: now.toISOString() };
+    (0, import_node_fs8.writeFileSync)(path2, `${JSON.stringify(record)}
+`, "utf8");
+  } catch {
+  }
+}
+function readSessionPayload(cwd) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(sessionPayloadStatePath(cwd), "utf8"));
+    if (typeof parsed?.chars !== "number" || !Number.isFinite(parsed.chars)) return void 0;
+    return {
+      chars: parsed.chars,
+      status: sessionPayloadStatus(parsed.chars),
+      at: typeof parsed.at === "string" ? parsed.at : ""
+    };
+  } catch {
+    return void 0;
+  }
+}
 function buildSessionStartPlan(verbs) {
   return {
     parallel: [
@@ -5375,7 +5421,33 @@ function resolveSafeSiblingWorktreeCleanupTarget(worktreePath, siblingRoot, deps
 }
 function siblingMmiWorktreesRoot(repoRoot2) {
   const parent = (0, import_node_path7.dirname)(repoRoot2);
-  return (0, import_node_path7.basename)(parent).toLowerCase() === "mmi-worktrees" ? parent : (0, import_node_path7.join)(parent, "mmi-worktrees");
+  if ((0, import_node_path7.basename)(parent).toLowerCase() === "mmi-worktrees") return parent;
+  const grandparent = (0, import_node_path7.dirname)(parent);
+  if ((0, import_node_path7.basename)(grandparent).toLowerCase() === "mmi-worktrees") return grandparent;
+  return (0, import_node_path7.join)(parent, "mmi-worktrees");
+}
+function worktreeScanDirs(root, repoRoot2, listDirs, isRepoCheckout) {
+  const projectsDir = (0, import_node_path7.dirname)(root);
+  const ownName = (0, import_node_path7.basename)(repoRoot2).toLowerCase();
+  const flat = [];
+  let ownContainer = null;
+  for (const dir of listDirs(root)) {
+    const name = (0, import_node_path7.basename)(dir);
+    if (isRepoCheckout((0, import_node_path7.join)(projectsDir, name))) {
+      if (name.toLowerCase() === ownName) ownContainer = dir;
+      continue;
+    }
+    flat.push(dir);
+  }
+  return ownContainer ? [...flat, ...listDirs(ownContainer)] : flat;
+}
+function explicitRepoWorktreesRoot(root, repoRoot2, rootDirs) {
+  const repoName = (0, import_node_path7.basename)(repoRoot2);
+  const repoDir = rootDirs.find((name) => name.toLowerCase() === repoName.toLowerCase());
+  return repoDir ? (0, import_node_path7.join)(root, repoDir) : root;
+}
+function strayWorktreeRootPaths(container, names, authoritativeRoot) {
+  return names.filter((name) => /worktrees/i.test(name)).map((name) => (0, import_node_path7.join)(container, name)).filter((path2) => !samePath(path2, authoritativeRoot));
 }
 function classifySiblingWorktreeDir(entry) {
   if (!entry.ownedByCurrentRepo) {
@@ -6235,6 +6307,7 @@ var import_node_child_process5 = require("node:child_process");
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
+var ORG_INFRA_SLUG = "_org";
 var KEY_RE = /^(?:[a-z][a-z0-9-]*\/)?[A-Za-z][A-Za-z0-9_]*$/;
 function isValidSecretKey(key) {
   if (!key || key.length > 256) return false;
@@ -6445,7 +6518,7 @@ no vault credentials visible`;
     ...lines,
     "",
     "+ = usable now. Consume keyless: `mmi-cli secrets use <KEY> -- <cmd>` (inject, never printed); validate: `mmi-cli secrets verify <KEY>`. No command prints a raw value (#2844).",
-    "  Cross-slug (org-infra): `mmi-cli secrets use GLOBAL_API_KEY --slug cloudflare -- <cmd>` consumes it keyless (master-gated)."
+    `  Org-infra (#3463): \`--slug\` is ALWAYS \`${ORG_INFRA_SLUG}\`; the provider is the key's FIRST SEGMENT \u2014 \`mmi-cli secrets use cloudflare/GLOBAL_API_KEY --slug ${ORG_INFRA_SLUG} -- <cmd>\` (master-gated).`
   ].join("\n");
 }
 async function secretsCapabilities(deps, opts) {
@@ -6487,6 +6560,81 @@ async function secretsCapabilities(deps, opts) {
   }
   deps.log(formatCapabilities(report));
 }
+var PROBE_TIMEOUT_MS = 4e3;
+async function probeCapabilities(deps, repo) {
+  try {
+    const qs = new URLSearchParams({ repo }).toString();
+    const res = await deps.fetch(`${deps.apiUrl}/secrets/capabilities?${qs}`, {
+      method: "GET",
+      headers: await deps.headers(),
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+    });
+    if (!res.ok) return void 0;
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+function secretKeyLeaf(key) {
+  const slash = key.lastIndexOf("/");
+  return slash === -1 ? key : key.slice(slash + 1);
+}
+function resolveNotFoundGuidance(input) {
+  const { key, repo, slug, report } = input;
+  const tried = secretParamName(slug ?? "<repo-slug>", key);
+  const isMaster = report?.role === "master";
+  const mnemonic = `Org-infra shape: \`--slug\` is ALWAYS \`${ORG_INFRA_SLUG}\`; the provider is the key's FIRST SEGMENT (e.g. \`cloudflare/API_TOKEN --slug ${ORG_INFRA_SLUG}\`).`;
+  const escalate = (target) => target && target.slug === ORG_INFRA_SLUG ? `Approved escalation: mmi-cli secrets request ${key} --repo ${repo} --reason "org-infra grant for ${target.scope} (key ${target.key}, slug ${ORG_INFRA_SLUG}) \u2014 <why it is needed>"` : `Approved escalation: mmi-cli secrets request ${key} --repo ${repo} --reason "<why it is needed>"`;
+  const leaf = secretKeyLeaf(key);
+  const sameLeaf = (report?.capabilities ?? []).filter(
+    (c) => secretKeyLeaf(c.key) === leaf && !(c.slug === slug && c.key === key)
+  );
+  const exact = sameLeaf.filter((c) => slug ? c.key === `${slug}/${leaf}` : false);
+  const unambiguous = exact.length === 1 ? exact : sameLeaf.length === 1 ? sameLeaf : [];
+  const usable = unambiguous.find((c) => c.accessible);
+  if (usable) {
+    return {
+      reachable: true,
+      lines: [
+        `Secret ${key} was not found at ${tried}.`,
+        `It lives at ${usable.scope} and you can already consume it \u2014 no request needed:`,
+        `  mmi-cli secrets use ${usable.key} --slug ${usable.slug} -- <cmd>`,
+        mnemonic
+      ]
+    };
+  }
+  if (!unambiguous.length && sameLeaf.length > 1) {
+    const lines2 = [
+      `Secret ${key} was not found at ${tried}.`,
+      `${sameLeaf.length} different keys are named ${leaf} \u2014 pick the one you meant, this command cannot:`,
+      ...sameLeaf.map((c) => `  ${c.accessible ? "+" : " "} mmi-cli secrets use ${c.key} --slug ${c.slug} -- <cmd>   (${c.scope})`),
+      mnemonic
+    ];
+    if (!isMaster) lines2.push(escalate(sameLeaf.find((c) => !c.accessible)));
+    return { reachable: false, lines: lines2 };
+  }
+  if (unambiguous.length) {
+    const other = unambiguous[0];
+    const lines2 = [
+      `Secret ${key} was not found at ${tried}.`,
+      `A key named ${leaf} exists at ${other.scope}, but it is not granted to you (this is an ACCESS gap, not a missing key).`
+    ];
+    if (isMaster) lines2.push("You are master \u2014 grant yourself directly: `mmi-cli secrets grant <repo> <login> <provider>/<KEY>`.");
+    else lines2.push(escalate(other));
+    return { reachable: false, lines: lines2 };
+  }
+  const lines = [
+    `Secret ${key} was not found at ${tried}, and no key named ${leaf} is visible to you.`,
+    `Locate it by intent first: \`mmi-cli secrets find "<what it is for>"\` \u2014 it returns the exact keyless-use command.`,
+    mnemonic
+  ];
+  if (isMaster) {
+    lines.push("You are master: if it truly does not exist yet, create it with `mmi-cli secrets set` rather than requesting a grant from yourself.");
+  } else {
+    lines.push(escalate());
+  }
+  return { reachable: false, lines };
+}
 async function fetchCatalog(deps, label, repo, extra) {
   const qs = new URLSearchParams({ repo, ...extra }).toString();
   let res;
@@ -6783,6 +6931,16 @@ async function secretsRequest(deps, key, opts) {
     return false;
   }
   const repo = await targetRepo(deps, opts);
+  const requester = await probeCapabilities(deps, repo);
+  if (requester?.role === "master") {
+    deps.err(`secrets request: you are master on ${repo} \u2014 a request would file an issue and notify yourself.`);
+    const candidates = (requester.capabilities ?? []).filter((c) => secretKeyLeaf(c.key) === secretKeyLeaf(key) && c.accessible);
+    const reachable = candidates.length === 1 ? candidates[0] : void 0;
+    if (reachable) deps.err(`${key} is already reachable: \`mmi-cli secrets use ${reachable.key} --slug ${reachable.slug} -- <cmd>\``);
+    else if (candidates.length > 1) deps.err(`${candidates.length} keys are named ${secretKeyLeaf(key)} \u2014 pick one with \`mmi-cli secrets find "<what it is for>"\`.`);
+    else deps.err(`Grant directly with \`mmi-cli secrets grant <repo> <login> <provider>/<KEY>\`, or create it with \`mmi-cli secrets set\` if it does not exist yet.`);
+    return false;
+  }
   const res = await deps.fetch(`${deps.apiUrl}/secrets/request`, {
     method: "POST",
     headers: await deps.headers({ "content-type": "application/json" }),
@@ -7151,8 +7309,8 @@ async function secretsUse(deps, key, opts) {
   if (!res.ok) {
     const body = await readJsonBody(res);
     if (res.status === 404 && body.code === "secret_not_found") {
-      deps.err(`Secret ${key} was not found.`);
-      deps.err(`Approved escalation: mmi-cli secrets request ${key} --repo ${repo} --reason "<why it is needed>"`);
+      const guidance = resolveNotFoundGuidance({ key, repo, slug, report: await probeCapabilities(deps, repo) });
+      for (const line of guidance.lines) deps.err(line);
       return false;
     }
     deps.err(
@@ -7377,18 +7535,37 @@ async function preservedBranches() {
     return [];
   }
 }
-async function siblingWorktreeDirs() {
+async function siblingWorktreeDirs(explicitRoot) {
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const siblingRoot = siblingMmiWorktreesRoot(repoRoot2);
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path8.dirname)((0, import_node_path8.dirname)(worktreeGitRoot)) : repoRoot2;
+  try {
+    const dirs = explicitRoot ? listDirsIn(resolveExplicitScanRoot(explicitRoot, primaryRepoRoot)) : worktreeScanDirs(siblingMmiWorktreesRoot(primaryRepoRoot), primaryRepoRoot, listDirsIn, isRepoCheckoutDir);
+    return dirs.map((dir) => inspectSiblingWorktreeDir(dir, worktreeGitRoot)).filter((entry) => Boolean(entry));
+  } catch {
+    return [];
+  }
+}
+function listDirsIn(dir) {
   try {
-    const entries = (0, import_node_fs10.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path8.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    return (0, import_node_fs10.readdirSync)(dir, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => (0, import_node_path8.join)(dir, ent.name));
   } catch {
     return [];
   }
 }
-async function gcPlan(remote, limit) {
+function isRepoCheckoutDir(dir) {
+  return (0, import_node_fs10.existsSync)((0, import_node_path8.join)(dir, ".git"));
+}
+function resolveExplicitScanRoot(explicitRoot, repoRoot2) {
+  let rootDirs;
+  try {
+    rootDirs = (0, import_node_fs10.readdirSync)(explicitRoot, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
+  } catch {
+    return explicitRoot;
+  }
+  return explicitRepoWorktreesRoot(explicitRoot, repoRoot2, rootDirs);
+}
+async function gcPlan(remote, limit, opts = {}) {
   const [branches, heads, current, stale, prs, worktrees, siblingDirs, preserved] = await Promise.all([
     gitOut(["branch", "--format=%(refname:short)"]),
     localBranchHeads(),
@@ -7398,7 +7575,7 @@ async function gcPlan(remote, limit) {
     }),
     ghPrs(limit),
     worktreeBranches(),
-    siblingWorktreeDirs(),
+    siblingWorktreeDirs(opts.root),
     preservedBranches()
   ]);
   return buildGcPlan({
@@ -7413,6 +7590,62 @@ async function gcPlan(remote, limit) {
     preservedBranches: preserved
   });
 }
+var STRAY_ROOT_WALK_BUDGET_MS = 4e3;
+function measureWorktreeRoot(root, deadline) {
+  let dirs = 0;
+  let bytes = 0;
+  let partial = false;
+  const stack = [root];
+  let depth0 = true;
+  while (stack.length) {
+    if (Date.now() > deadline) {
+      partial = true;
+      break;
+    }
+    const current = stack.pop();
+    let entries;
+    try {
+      entries = (0, import_node_fs10.readdirSync)(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const ent of entries) {
+      const child2 = (0, import_node_path8.join)(current, ent.name);
+      if (ent.isDirectory()) {
+        if (depth0) dirs++;
+        let isLink = false;
+        try {
+          (0, import_node_fs10.readlinkSync)(child2);
+          isLink = true;
+        } catch {
+        }
+        if (!isLink) stack.push(child2);
+      } else if (ent.isFile()) {
+        try {
+          bytes += (0, import_node_fs10.statSync)(child2).size;
+        } catch {
+        }
+      }
+    }
+    depth0 = false;
+  }
+  return partial ? { dirs, bytes, partial } : { dirs, bytes };
+}
+function worktreeRootsProbe(repoRoot2) {
+  const authoritative = siblingMmiWorktreesRoot(repoRoot2);
+  const container = (0, import_node_path8.dirname)(authoritative);
+  let names;
+  try {
+    names = (0, import_node_fs10.readdirSync)(container, { withFileTypes: true }).filter((ent) => ent.isDirectory()).map((ent) => ent.name);
+  } catch {
+    return { authoritative, stray: [] };
+  }
+  const deadline = Date.now() + STRAY_ROOT_WALK_BUDGET_MS;
+  return {
+    authoritative,
+    stray: strayWorktreeRootPaths(container, names, authoritative).map((path2) => ({ path: path2, ...measureWorktreeRoot(path2, deadline) }))
+  };
+}
 
 // src/repo-resolve.ts
 function slugOf(repoOrSlug) {
@@ -8889,7 +9122,7 @@ async function provisionWorktree(worktreeRoot, deps) {
 }
 function defaultWorktreePath(repoRoot2, branch) {
   const safe = branch.replace(/[/\\]+/g, "-");
-  return (0, import_node_path11.join)((0, import_node_path11.dirname)(repoRoot2), "mmi-worktrees", safe);
+  return (0, import_node_path11.join)((0, import_node_path11.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path11.basename)(repoRoot2), safe);
 }
 async function primaryCheckoutRootOf(git) {
   try {
@@ -9000,7 +9233,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path26 = require("node:path");
+var import_node_path27 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -9453,7 +9686,7 @@ var MANAGED_GITIGNORE_LINES = [
   // and `.cursor/rules/` because a repo may want its rules tracked despite the wall.
   ".codex/",
   ".agents/",
-  // #2321 doctrine: the canonical worktree home is the SIBLING `../mmi-worktrees/<branch>` (outside the tree,
+  // #2321 doctrine: the canonical worktree home is the SIBLING `../mmi-worktrees/<RepoName>/<branch>` (outside the tree,
   // via `mmi-cli worktree create`), so a repo-local `.worktrees/` is NOT un-ignored org-wide — `mmi-cli
   // doctor` flags one explicitly instead (buildRepoLocalWorktreeCheck) rather than baking the fallback path
   // into every repo's .gitignore.
@@ -11793,6 +12026,10 @@ var PATH_OVERRIDES = {
   "secrets grant": { category: "admin", discovery: "all-only", help_group: "Operations" },
   "secrets revoke": { category: "admin", discovery: "all-only", help_group: "Operations" }
 };
+var DEFAULT_ADMIN_MARKER = "(master-only)";
+var ADMIN_MARKERS = {
+  "secrets org-catalog": "(writes master-only)"
+};
 var HIDDEN_OPTIONS = {
   "worktree create": ["--base"],
   "org project set": ["--set"]
@@ -11837,9 +12074,15 @@ function classifyTree(command, path2, inherited, hideFromParent) {
   const override = PATH_OVERRIDES[path2];
   const metadata = override ?? inherited;
   setCommandMetadata(command, metadata);
-  if ((override !== void 0 || hideFromParent) && metadata.discovery !== "primary") {
+  const hideByOverride = override !== void 0 && metadata.discovery === "hidden";
+  if ((hideByOverride || hideFromParent) && metadata.discovery !== "primary") {
     command._hidden = true;
   }
+  if (override !== void 0 && metadata.discovery === "all-only" && metadata.category === "admin" && !command.summary()) {
+    const marker = ADMIN_MARKERS[path2] ?? DEFAULT_ADMIN_MARKER;
+    const described = command.description();
+    command.summary(described ? `${marker} ${described}` : marker);
+  }
   for (const option of command.options) {
     if ((HIDDEN_OPTIONS[path2] ?? []).includes(option.long ?? option.short ?? "")) option.hideHelp();
   }
@@ -17487,9 +17730,9 @@ function extractWorkflowCrons(yamlText) {
 function workflowEntry(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   if (!crons.length) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
   return {
-    name: `${repo}/${basename3.replace(/\.ya?ml$/, "")}`,
+    name: `${repo}/${basename4.replace(/\.ya?ml$/, "")}`,
     cadence: crons.join(" + "),
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
@@ -17521,16 +17764,30 @@ function awsRuleEntries(payload) {
   }
   return entries;
 }
+function lambdaTargetFromArn(arn) {
+  const marker = ":function:";
+  const i = arn.indexOf(marker);
+  if (i < 0) return { functionName: arn.split(":").pop() ?? "" };
+  const rest = arn.slice(i + marker.length);
+  const q = rest.indexOf(":");
+  if (q < 0) return { functionName: rest };
+  return { functionName: rest.slice(0, q), qualifier: rest.slice(q + 1) };
+}
 function awsScheduleEntry(payload) {
   if (!payload || typeof payload !== "object") return null;
   const { Name, ScheduleExpression, State, Target, Description } = payload;
   if (typeof Name !== "string" || typeof ScheduleExpression !== "string") return null;
   if (State !== "ENABLED" || isJervResource(Name)) return null;
   let target = "";
+  let qualifier;
   let scheduleId;
   if (Target && typeof Target === "object") {
     const { Arn, Input } = Target;
-    if (typeof Arn === "string") target = Arn.split(":").pop() ?? "";
+    if (typeof Arn === "string") {
+      const parsed = lambdaTargetFromArn(Arn);
+      target = parsed.functionName;
+      qualifier = parsed.qualifier;
+    }
     if (typeof Input === "string") {
       try {
         const parsed = JSON.parse(Input);
@@ -17539,13 +17796,15 @@ function awsScheduleEntry(payload) {
       }
     }
   }
+  const sourceBase = `aws scheduler schedule ${Name} (eu-central-1)`;
+  const source = qualifier && target ? `${sourceBase} \u2192 ${target}:${qualifier}` : sourceBase;
   return {
     name: Name,
     cadence: ScheduleExpression,
     executor: target ? `aws-scheduler \u2192 ${target}` : "aws-scheduler",
     llm: readLlmDeclaration(typeof Description === "string" ? Description : void 0),
     resolved: "live",
-    source: `aws scheduler schedule ${Name} (eu-central-1)`,
+    source,
     ...scheduleId ? { scheduleId } : {}
   };
 }
@@ -17701,7 +17960,7 @@ function strayCronDrifts(workflows) {
 function unlauncheredLlmDrift(entry) {
   if (entry.llm !== "yes") return null;
   if (isHarbourLlmLauncher(entry.executor)) return null;
-  if (entry.executor.startsWith("aws-scheduler") && entry.executor.includes("mmi-hub-schedule-dispatcher")) return null;
+  if (entry.executor === "aws-scheduler \u2192 mmi-hub-schedule-dispatcher") return null;
   const allowed = [...HARBOUR_LLM_LAUNCHERS].join(", ");
   return {
     class: "unlaunchered-llm",
@@ -17794,8 +18053,8 @@ async function repoWorkflowEntries(client, repo) {
       );
       if (typeof contents?.content !== "string" || contents.encoding !== "base64") continue;
       const text = Buffer.from(contents.content, "base64").toString("utf8");
-      const basename3 = wf.path.split("/").pop() ?? wf.path;
-      const name = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+      const basename4 = wf.path.split("/").pop() ?? wf.path;
+      const name = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
       workflows.push({ name, yamlText: text });
       const entry = workflowEntry(repo, wf.path, text);
       if (entry) entries.push(entry);
@@ -18018,8 +18277,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
   if (!crons.length && !header.schedule) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
-  const expectedId = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
     throw new Error(`schedules lift: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
@@ -18207,7 +18466,9 @@ function planInfraTunnel(hostname, upstream) {
   ].join("\n");
   const steps = [
     "Install cloudflared on the box (or run locally for dev-only tunnels).",
-    "Fetch CF account creds (master-gated): mmi-cli secrets use --slug cloudflare API_TOKEN -- <cmd>",
+    // #3463: `--slug <provider> <KEY>` is the retired shape and resolves to nothing. Org-infra is one
+    // slug (`_org`) with the provider as the key's first segment.
+    "Fetch CF account creds (master-gated): mmi-cli secrets use cloudflare/API_TOKEN --slug _org -- <cmd>",
     "Create tunnel: cloudflared tunnel create " + tunnelName,
     "Route DNS: cloudflared tunnel route dns " + tunnelName + " " + host,
     "Write config (below) to /etc/cloudflared/config.yml and run: cloudflared tunnel run " + tunnelName,
@@ -18232,7 +18493,7 @@ function formatInfraTunnelPlan(plan) {
 function registerEdgeCommands(program3) {
   const edge = program3.command("edge").description("infra-service edge helpers (non-tenant loopback services)");
   const tunnel = edge.command("tunnel").description("Cloudflare Tunnel planning for loopback infra services");
-  tunnel.command("plan").description("print a cloudflared tunnel plan (no API calls \u2014 use with secrets use --slug cloudflare)").requiredOption("--hostname <host>", "public hostname (e.g. open-meteo.tools.mutatismutandis.co)").requiredOption("--upstream <url>", "loopback origin (e.g. http://127.0.0.1:8080)").option("--json", "machine-readable output").action((o) => {
+  tunnel.command("plan").description("print a cloudflared tunnel plan (no API calls \u2014 pair with `secrets use cloudflare/API_TOKEN --slug _org`)").requiredOption("--hostname <host>", "public hostname (e.g. open-meteo.tools.mutatismutandis.co)").requiredOption("--upstream <url>", "loopback origin (e.g. http://127.0.0.1:8080)").option("--json", "machine-readable output").action((o) => {
     try {
       const plan = planInfraTunnel(o.hostname, o.upstream);
       if (o.json) {
@@ -20129,6 +20390,7 @@ function registerBoardCommands(program3) {
 // src/merge-cleanup.ts
 var import_node_fs24 = require("node:fs");
 var import_promises5 = require("node:fs/promises");
+var import_node_path22 = require("node:path");
 var import_node_child_process11 = require("node:child_process");
 
 // src/board-advance.ts
@@ -20438,7 +20700,7 @@ function assertPrMergeHousekeepingClean(startingPath, context, options = {}) {
   if (verdict.blocked) throw new Error(verdict.reason);
   return housekeeping;
 }
-async function applyGcPlan(plan, remote) {
+async function applyGcPlan(plan, remote, opts = {}) {
   const result = { removedBranches: [], removedRemoteBranches: [], removedTrackingRefs: [], removedWorktreeDirs: [], failed: [], pruned: false };
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
@@ -20472,8 +20734,9 @@ async function applyGcPlan(plan, remote) {
   result.failed.push(...branchTracking.failed);
   const removeDeps = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
-  const siblingRoot = siblingMmiWorktreesRoot(repoRoot2);
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path22.dirname)((0, import_node_path22.dirname)(worktreeGitRoot)) : repoRoot2;
+  const siblingRoot = opts.root ? resolveExplicitScanRoot(opts.root, primaryRepoRoot) : siblingMmiWorktreesRoot(primaryRepoRoot);
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
@@ -20906,7 +21169,7 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 
 // src/worktree-lifecycle-commands.ts
 var import_node_fs25 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -21009,7 +21272,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path22.join)(root, e.name));
+      return (0, import_node_fs25.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path23.join)(root, e.name));
     } catch {
       return [];
     }
@@ -21065,13 +21328,13 @@ function registerWorktreeCommands(program3) {
       if (PROTECTED_BRANCHES2.has(branch)) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
-      const gitFile = (0, import_node_path22.join)(wtPath, ".git");
+      const gitFile = (0, import_node_path23.join)(wtPath, ".git");
       const isLinked = (0, import_node_fs25.existsSync)(gitFile) && (0, import_node_fs25.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path22.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path23.dirname)(commonDir) : wtPath;
       const stageSummary = readStageSummary(wtPath);
       const hasStage = stageSummary != null;
       const steps = landSteps(branch, true, hasStage);
@@ -21181,10 +21444,15 @@ async function gatherWorktreeContext() {
     const s = readStageSummary(wt.path);
     if (s) stages.push({ path: wt.path, port: s.port });
   }
-  const wtRoot = siblingMmiWorktreesRoot(repoRoot2);
+  const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path23.dirname)((0, import_node_path23.dirname)(worktreeGitRoot)) : repoRoot2;
+  const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
   if ((0, import_node_fs25.existsSync)(wtRoot)) {
-    orphanDirs = scanOrphanDirs(wtRoot, await currentRepoWorktreeGitRoot(repoRoot2));
+    orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
+      ...defaultOrphanDirScanDeps,
+      listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
+    });
   }
   return { worktrees, localBranches, currentBranch: currentBranch2, openPrBranches, closedBranches, stages, orphanDirs };
 }
@@ -21773,11 +22041,11 @@ ${lines}`);
 
 // src/train-commands.ts
 var import_node_fs28 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/plugin-guard-io.ts
 var import_node_fs27 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
@@ -21907,7 +22175,7 @@ function runHostBin(bin, args, opts) {
 }
 var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
@@ -21919,11 +22187,11 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path23.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path23.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path24.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path24.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path23.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path24.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
 function marketplaceClonePresent(surface, home, exists = import_node_fs27.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
@@ -21953,7 +22221,7 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs27.existsSync)((0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -22088,7 +22356,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path24.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -23231,6 +23499,28 @@ function checkRepoWorktrees(probe) {
     ]
   };
 }
+function formatBytes(bytes, partial) {
+  const prefix = partial ? "\u2265" : "";
+  return bytes >= 1e9 ? `${prefix}${(bytes / 1e9).toFixed(2)} GB` : `${prefix}${(bytes / 1e6).toFixed(1)} MB`;
+}
+function checkWorktreeRoots(probe) {
+  if (!probe) return null;
+  const evidence = [
+    `scanned by worktree gc/list: ${probe.authoritative}`,
+    ...probe.stray.length ? probe.stray.map((s) => `unreachable by any gc: ${s.path} \u2014 ${s.dirs} dir(s), ${formatBytes(s.bytes, s.partial)}`) : ["no other *worktrees* directory beside this repo"]
+  ];
+  if (!probe.stray.length) return { ok: true, label: "worktree roots", verbose: evidence };
+  const named = probe.stray.map((s) => `${s.path} (${s.dirs} dir(s), ${formatBytes(s.bytes, s.partial)})`).join("; ");
+  const cutShort = probe.stray.some((s) => s.partial) ? " (a \u2265 figure is a floor \u2014 the size walk hit its time budget, so the real total is larger)" : "";
+  return {
+    ok: false,
+    label: "worktree roots",
+    // The fix is a review, never a delete: `gc --root` still refuses anything it cannot classify as dead,
+    // and doctor itself — with or without --apply — never touches these directories.
+    fix: `${probe.stray.length} worktrees root(s) outside ${probe.authoritative} \u2014 ${named}; no gc scans them. Review, then sweep deliberately from the owning repo with \`mmi-cli worktree gc --root <path> --apply\` (report-only here: doctor never deletes these)${cutShort}`,
+    verbose: evidence
+  };
+}
 function pluginHealTrigger(probe) {
   if (probe.guardState === "no-install" || probe.guardState === "unresolved") return "unresolved";
   const behind = Boolean(probe.installed && probe.released) && compareVersions(probe.installed, probe.released) < 0;
@@ -23368,6 +23658,45 @@ function checkDocsAudit(probe) {
   }
   return { ok: true, label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
 }
+function checkSessionPayload(probe) {
+  if (!probe) return null;
+  const { chars } = probe;
+  const evidence = [
+    `last emitted: ${chars} characters${probe.at ? ` (${probe.at})` : ""}`,
+    `budget ${SESSION_PAYLOAD_BUDGET_CHARS}, Claude Code cap ${SESSION_PAYLOAD_CAP_CHARS}`,
+    // Named in the evidence because the units are the whole trap: the cap is documented in characters
+    // while the runtime's overflow message reports bytes, and they diverge on the non-ASCII the doctrine
+    // blocks preserve. A reader comparing this number to a byte figure is comparing two different things.
+    "measured in CHARACTERS (the documented unit of the cap), never bytes"
+  ];
+  const status = sessionPayloadStatus(chars);
+  if (status === "red") {
+    return {
+      ok: false,
+      label: "SessionStart payload",
+      fix: `${chars} characters exceeds the ${SESSION_PAYLOAD_CAP_CHARS}-character additionalContext cap \u2014 Claude Code truncates it to a ~2,000-character preview with no error, so agents are starting on partial doctrine; cut a block from the session-start banner`,
+      verbose: evidence
+    };
+  }
+  if (status === "amber") {
+    return {
+      ok: true,
+      // warn: the banner lane must print this too. Without it the banner's failing-only filter made the
+      // amber tier dead code on the one lane that runs every session — drift past the budget was
+      // invisible until it became a truncation. Still ✓, still never moves the exit code.
+      warn: true,
+      label: "SessionStart payload",
+      detail: `amber \u2014 ${chars} characters, over the ${SESSION_PAYLOAD_BUDGET_CHARS}-character budget and ${SESSION_PAYLOAD_CAP_CHARS - chars} from the hard cap`,
+      verbose: evidence
+    };
+  }
+  return {
+    ok: true,
+    label: "SessionStart payload",
+    detail: `${chars} of ${SESSION_PAYLOAD_BUDGET_CHARS} budgeted characters`,
+    verbose: evidence
+  };
+}
 function planGitignore(current) {
   const { content, changed } = upsertManagedGitignoreBlock(current);
   return changed ? { ok: false, content } : { ok: true };
@@ -23377,6 +23706,7 @@ function gcReapable(plan) {
 }
 async function runDoctorClean(opts, io, deps) {
   const apply = Boolean(opts.apply);
+  const applyRepo = apply && opts.repoWrites !== false;
   const [login, isOrgRepo, released, callerArn, reach] = await Promise.all([
     deps.githubLogin(),
     deps.isOrgRepo(),
@@ -23408,7 +23738,7 @@ async function runDoctorClean(opts, io, deps) {
     ];
     if (gi.ok) {
       checks.push({ ok: true, label: "gitignore block", verbose: giEvidence });
-    } else if (apply && gi.content && deps.writeGitignore(gi.content)) {
+    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
       checks.push({ ok: true, label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
       restartPending = true;
     } else {
@@ -23463,6 +23793,10 @@ async function runDoctorClean(opts, io, deps) {
     checks.push(checkCliVersion(cliInput));
   }
   checks.push(checkPluginCache(deps.pluginCache()));
+  if (deps.sessionPayload) {
+    const payload = checkSessionPayload(deps.sessionPayload());
+    if (payload) checks.push(payload);
+  }
   if (!opts.fast && !opts.banner && !opts.preflight) {
     const probe = await deps.schedulesNotebook().catch((e) => ({
       armed: 0,
@@ -23483,6 +23817,11 @@ async function runDoctorClean(opts, io, deps) {
     const docsAudit2 = checkDocsAudit(probe);
     if (docsAudit2) checks.push(docsAudit2);
   }
+  if (!opts.fast && !opts.banner && !opts.preflight && deps.worktreeRoots) {
+    const probe = await deps.worktreeRoots().catch(() => void 0);
+    const roots = checkWorktreeRoots(probe);
+    if (roots) checks.push(roots);
+  }
   if (isOrgRepo && !opts.fast && !opts.banner) {
     try {
       checks.push(checkTrainSync(await deps.syncTrain()));
@@ -23498,7 +23837,7 @@ async function runDoctorClean(opts, io, deps) {
     const repoRoot2 = await deps.repoRoot();
     try {
       const plan = await deps.gcPlan("origin", 200);
-      if (apply) {
+      if (applyRepo) {
         const r = await deps.applyGcPlan(plan, "origin");
         const reaped = r.removedBranches.length + r.removedRemoteBranches.length + r.removedWorktreeDirs.length + r.removedTrackingRefs.length;
         const detailParts = [];
@@ -23538,7 +23877,7 @@ async function runDoctorClean(opts, io, deps) {
     }
     const scratch = deps.executeScratchGc(repoRoot2, { apply: false });
     const scratchEvidence = scratch.plan.safeAuto.length ? scratch.plan.safeAuto.map((c) => `aged: ${c.path} (${c.reason})`) : ["nothing aged"];
-    if (apply && scratch.plan.safeAuto.length > 0) {
+    if (applyRepo && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
       checks.push({ ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
@@ -23554,7 +23893,7 @@ async function runDoctorClean(opts, io, deps) {
     return exitCode;
   }
   if (opts.banner) {
-    const actionable = checks.filter((c) => !c.ok);
+    const actionable = checks.filter((c) => !c.ok || c.warn);
     for (const c of actionable) {
       io.log(renderReport([c], { restartPending: false }));
       if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
@@ -23647,7 +23986,7 @@ function ghAccountCaveat(announcedLogin, accounts) {
 // src/doctor-io.ts
 var import_node_fs29 = require("node:fs");
 var import_node_os7 = require("node:os");
-var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
 var import_node_child_process12 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process12.execFile);
@@ -23655,7 +23994,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs29.readFileSync)((0, import_node_path25.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs29.readFileSync)((0, import_node_path26.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -23676,7 +24015,7 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path25.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path26.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
@@ -23715,7 +24054,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs29.existsSync)((0, import_node_path25.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -23838,7 +24177,14 @@ function mmiDoctorDeps() {
       const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
       const status = docsAuditStatus(await readDocsAuditFetch(repo), { repo, today });
       return { armed: status.state !== "not-armed", ok: status.ok, detail: status.line };
-    }
+    },
+    // #3471: the competing-worktrees-roots probe. Full doctor only (the gather skips it on
+    // fast/banner/preflight), and READ-ONLY by construction — it stats, it never removes. Nothing here is
+    // wired to a reaper, in either mode.
+    worktreeRoots: async () => worktreeRootsProbe(await repoRoot()),
+    // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
+    // A local record read — cheap enough for every lane, including the banner.
+    sessionPayload: () => readSessionPayload(process.cwd())
   };
 }
 async function requireFreshTrainCli(commandName) {
@@ -23963,7 +24309,7 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path26.join)(process.cwd(), ".gitignore");
+  const path2 = (0, import_node_path27.join)(process.cwd(), ".gitignore");
   const current = (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -24085,12 +24431,12 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
     process.exit(process.exitCode ?? 0);
   });
 });
-gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
+gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").option("--root <path>", "sweep an explicitly named worktrees root instead of the authoritative ../mmi-worktrees (#3471) \u2014 descends into this repo container when present; ownership, dead-dir, and content guards still apply").action(async (o) => {
   if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
-      const root = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
-      const run = executeScratchGc(root, { apply: Boolean(o.apply) });
+      const root2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
+      const run = executeScratchGc(root2, { apply: Boolean(o.apply) });
       if (o.json) return console.log(JSON.stringify({ dryRun: !o.apply, ...run }, null, 2));
       return console.log(formatScratchGcPlan(run.plan, Boolean(o.apply), run.applied));
     } catch (e) {
@@ -24099,8 +24445,19 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   }
   const limit = Number.parseInt(o.limit, 10);
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
+  let root;
+  if (o.root !== void 0) {
+    root = (0, import_node_path27.resolve)(o.root);
+    if (!(0, import_node_fs30.existsSync)(root) || !(0, import_node_fs30.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
+    if (isPathUnderDirectory(gcRepoRoot, root)) {
+      return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
+    }
+  }
   try {
-    const plan = await gcPlan(o.remote, limit);
+    const plan = await gcPlan(o.remote, limit, { root });
+    if (root && !o.json) console.log(`worktree gc: scanning the explicitly named root ${root} for worktrees proven to belong to this repo
+`);
     if (o.apply && !o.json) console.log(formatGcPlan(plan, true));
     let applyResult;
     if (o.apply) {
@@ -24111,10 +24468,10 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
         // git fsmonitor daemon from inheriting this sweep's stdio pipe and wedging the git call on Windows.
         worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-c", "core.fsmonitor=false", ...args], { timeout: GIT_TIMEOUT_MS })).stdout)
       ).catch(() => void 0);
-      applyResult = await applyGcPlan(plan, o.remote);
+      applyResult = await applyGcPlan(plan, o.remote, { root });
     }
     if (o.json) {
-      console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, plan, applyResult }, null, 2));
+      console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, ...root ? { root } : {}, plan, applyResult }, null, 2));
     } else if (!o.apply) {
       console.log(formatGcPlan(plan, false));
     } else {
@@ -24179,7 +24536,7 @@ function acquireWorktreeSetupLock(worktreeRoot) {
     };
   };
   try {
-    (0, import_node_fs30.mkdirSync)((0, import_node_path26.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs30.mkdirSync)((0, import_node_path27.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
@@ -24194,7 +24551,7 @@ function acquireWorktreeSetupLock(worktreeRoot) {
 }
 var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
 withExamples(mutating(
-  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch> \u2014 authoritative; worktree gc/list scan only this root)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
+  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<RepoName>/<branch> \u2014 authoritative; the <RepoName> segment is what makes ownership provable from the path, #3471. gc/list read this root in BOTH the nested and the legacy flat shape)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
   worktreeCreatePlan
 ).action(async (target, o, cmd) => {
   try {
@@ -25282,11 +25639,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path26.join)(cwd, ".github", "workflows");
+  const wfDir = (0, import_node_path27.join)(cwd, ".github", "workflows");
   if (!(0, import_node_fs30.existsSync)(wfDir)) return [];
   return (0, import_node_fs30.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs30.readFileSync)((0, import_node_path26.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs30.readFileSync)((0, import_node_path27.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -25313,16 +25670,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path26.join)(root, path2);
+      const fullPath = (0, import_node_path27.join)(root, path2);
       return (0, import_node_fs30.existsSync)(fullPath) ? (0, import_node_fs30.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path26.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path27.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs30.existsSync)((0, import_node_path26.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs30.existsSync)((0, import_node_path26.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -25929,10 +26286,10 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
     consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
   }
-  const noRepoWrites = opts.repoWrites === false;
   process.exitCode = await runDoctorClean(
     {
-      apply: Boolean(opts.apply) && !noRepoWrites,
+      apply: Boolean(opts.apply),
+      repoWrites: opts.repoWrites,
       banner: opts.banner,
       preflight: opts.preflight,
       fast: opts.fast || opts.self,
@@ -25955,7 +26312,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path26.join)(path2, entry.name);
+    const child2 = (0, import_node_path27.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -25985,7 +26342,7 @@ function pluginCacheFsDeps(home, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs30.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path26.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs30.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path27.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs30.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -25999,7 +26356,7 @@ function stagingApplyFsGuard(home) {
   return {
     referencedPaths: () => readInstalledPluginRefs(home),
     mtimeMs: (name) => {
-      const p = (0, import_node_path26.join)(stagingRoot, name);
+      const p = (0, import_node_path27.join)(stagingRoot, name);
       if (!(0, import_node_fs30.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs30.statSync)(q).mtimeMs);
@@ -26035,6 +26392,8 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
     return;
   }
   spawnDeferredGcSweep();
+  const measured = measuredSessionIo(consoleIo);
+  const bannerIo = measured.io;
   const { parallel, sequential } = buildSessionStartPlan({
     // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
     // when unknown — a missing gh login must not noise or fail the banner.
@@ -26078,14 +26437,16 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       await runDoctorClean({ banner: true }, io, mmiDoctorDeps());
     }
   });
-  await runSessionStart(parallel, sequential, consoleIo);
-  for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
+  await runSessionStart(parallel, sequential, bannerIo);
+  for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
     spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
-    consoleIo.log(worktreeBanner);
+    bannerIo.log(worktreeBanner);
   }
-  appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed" });
+  const payloadChars = measured.chars();
+  recordSessionPayload(process.cwd(), payloadChars);
+  appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed", payloadChars });
 });
 installProcessBackstop();
 consolidateCommandNamespaces(program2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.49.0",
+  "version": "3.51.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",