@mutmutco/cli 3.63.0 → 3.64.0

package/dist/main.cjs

@@ -38,7 +38,8 @@ __export(index_exports, {
   isOrgRegisteredRepo: () => isOrgRegisteredRepo,
   registryClientDeps: () => registryClientDeps,
   repoSlug: () => repoSlug,
-  shouldMarkWorktreeActivity: () => shouldMarkWorktreeActivity
+  shouldMarkWorktreeActivity: () => shouldMarkWorktreeActivity,
+  suggestCommandPath: () => suggestCommandPath
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -3412,8 +3413,8 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs32 = require("node:fs");
-var import_node_child_process13 = require("node:child_process");
+var import_node_fs33 = require("node:fs");
+var import_node_child_process14 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -3655,6 +3656,7 @@ function didYouMean(input, candidates) {
     const cand = strip(candidate);
     if (!cand) continue;
     if (cand === target) continue;
+    if (cand === `${target}-file` || target === `${cand}-file`) continue;
     const distance = levenshtein(target, cand);
     const prefix = cand.startsWith(target) || target.startsWith(cand);
     const threshold = Math.max(2, Math.ceil(cand.length * 0.4));
@@ -5525,38 +5527,38 @@ function safeWorktreeRemoveCommand(safeCwd, targetPath) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-async function fastForwardCurrentBranch(git) {
+async function fastForwardCurrentBranch(git2) {
   try {
-    const before = (await git(["rev-parse", "HEAD"])).trim();
-    await git(["pull", "--ff-only"]);
-    const after = (await git(["rev-parse", "HEAD"])).trim();
+    const before = (await git2(["rev-parse", "HEAD"])).trim();
+    await git2(["pull", "--ff-only"]);
+    const after = (await git2(["rev-parse", "HEAD"])).trim();
     return { status: before === after ? "up-to-date" : "fast-forwarded" };
   } catch (e) {
     return { status: "failed", error: errorMessage(e) };
   }
 }
-async function returnCheckoutToBase(git, base, mergedBranch, currentBranch2) {
+async function returnCheckoutToBase(git2, base, mergedBranch, currentBranch2) {
   if (currentBranch2 === mergedBranch) {
-    const porcelain = await git(["status", "--porcelain"]).catch(() => void 0);
+    const porcelain = await git2(["status", "--porcelain"]).catch(() => void 0);
     const dirt = porcelain === void 0 ? "tracked-changes" : classifyWorktreeDirt(porcelain);
     if (!isRemovableDirt(dirt)) {
       return { report: { branch: base, switched: false, sync: "skipped", reason: dirt === "untracked-files" ? "untracked-files" : "dirty-worktree" }, canDeleteBranch: false };
     }
     try {
-      await git(["checkout", base]);
+      await git2(["checkout", base]);
     } catch (e) {
       return {
         report: { branch: base, switched: false, sync: "skipped", reason: "checkout-failed", error: errorMessage(e) },
         canDeleteBranch: false
       };
     }
-    const ff2 = await fastForwardCurrentBranch(git);
+    const ff2 = await fastForwardCurrentBranch(git2);
     return { report: { branch: base, switched: true, sync: ff2.status, ...ff2.error ? { error: ff2.error } : {} }, canDeleteBranch: true };
   }
   if (currentBranch2 !== base) {
     return { report: { branch: base, switched: false, sync: "skipped", reason: "not-on-base" }, canDeleteBranch: true };
   }
-  const ff = await fastForwardCurrentBranch(git);
+  const ff = await fastForwardCurrentBranch(git2);
   return { report: { branch: base, switched: false, sync: ff.status, ...ff.error ? { error: ff.error } : {} }, canDeleteBranch: true };
 }
 async function cleanupPrMergeLocalBranch(branch, options) {
@@ -5597,17 +5599,17 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const safeCwd = selectSafeWorktreeCwd([...afterWorktrees, ...beforeWorktrees], wtPath, {
     pathExists: options.pathExists
   });
-  const git = (args) => safeCwd ? options.execGit(["-C", safeCwd, ...args]) : options.execGit(args);
+  const git2 = (args) => safeCwd ? options.execGit(["-C", safeCwd, ...args]) : options.execGit(args);
   const expectedHeadOid = options.expectedHeadOid;
   const verifyReviewedBranchHead = async () => {
     if (!expectedHeadOid) {
-      const remaining = await git(["branch", "--list", branch]).catch(() => "");
+      const remaining = await git2(["branch", "--list", branch]).catch(() => "");
       report.localBranch = branchMissingFromList(branch, remaining) ? { name: branch, status: "already-gone" } : { name: branch, status: "not-attempted", reason: "branch-head-unverified" };
       return false;
     }
-    const currentHead = (await git(["rev-parse", `refs/heads/${branch}`]).catch(() => "") || "").trim();
+    const currentHead = (await git2(["rev-parse", `refs/heads/${branch}`]).catch(() => "") || "").trim();
     if (!currentHead) {
-      const remaining = await git(["branch", "--list", branch]).catch(() => "");
+      const remaining = await git2(["branch", "--list", branch]).catch(() => "");
       report.localBranch = branchMissingFromList(branch, remaining) ? { name: branch, status: "already-gone" } : { name: branch, status: "not-attempted", reason: "branch-head-unverified" };
       return false;
     }
@@ -5642,7 +5644,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       return report;
     }
     const removeDeps = {
-      git,
+      git: git2,
       sleep: options.sleep ?? defaultSleep,
       detachReparsePoints: options.detachReparsePoints,
       // #3064: junction-safe deferred sweep too
@@ -5662,7 +5664,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       chdir: options.chdir
     });
     const outcome = await removeWorktreeWithRecovery(wtPath, {
-      git,
+      git: git2,
       sleep: options.sleep ?? defaultSleep,
       detachReparsePoints: options.detachReparsePoints,
       // #3064: reach the actual pr-merge teardown path
@@ -5713,10 +5715,10 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       return report;
     }
   }
-  const current = (await git(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "") || "").trim();
+  const current = (await git2(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "") || "").trim();
   if (options.returnToBranch && options.returnToBranch !== branch) {
     const { report: checkout, canDeleteBranch } = await returnCheckoutToBase(
-      git,
+      git2,
       options.returnToBranch,
       branch,
       current
@@ -5735,16 +5737,16 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   }
   const reviewedHeadOid = expectedHeadOid;
   try {
-    await git(["update-ref", "-d", `refs/heads/${branch}`, reviewedHeadOid]);
+    await git2(["update-ref", "-d", `refs/heads/${branch}`, reviewedHeadOid]);
     report.localBranch = { name: branch, status: "deleted" };
   } catch (e) {
-    const remaining = await git(["branch", "--list", branch]).catch(() => "");
+    const remaining = await git2(["branch", "--list", branch]).catch(() => "");
     report.localBranch = branchMissingFromList(branch, remaining) ? { name: branch, status: "already-gone" } : { name: branch, status: "failed", error: errorMessage(e) };
   }
   if (report.localBranch.status === "deleted" || report.localBranch.status === "already-gone") {
-    await git(["config", "--local", "--unset-all", PRESERVED_WORKTREE_CONFIG, `^${escapeGitConfigValueRegex(branch)}$`]).catch(() => void 0);
+    await git2(["config", "--local", "--unset-all", PRESERVED_WORKTREE_CONFIG, `^${escapeGitConfigValueRegex(branch)}$`]).catch(() => void 0);
   }
-  if (wtPath) await git(["worktree", "prune"]).catch(() => "");
+  if (wtPath) await git2(["worktree", "prune"]).catch(() => "");
   return report;
 }
 function formatGcPlan(plan, apply) {
@@ -6242,9 +6244,9 @@ function defaultWorktreePath(repoRoot2, branch) {
   const safe = capWorktreeDirName(branch.replace(/[/\\]+/g, "-"));
   return (0, import_node_path10.join)((0, import_node_path10.dirname)(repoRoot2), "mmi-worktrees", (0, import_node_path10.basename)(repoRoot2), safe);
 }
-async function primaryCheckoutRootOf(git) {
+async function primaryCheckoutRootOf(git2) {
   try {
-    const out = (await git(["rev-parse", "--path-format=absolute", "--git-common-dir"])).trim();
+    const out = (await git2(["rev-parse", "--path-format=absolute", "--git-common-dir"])).trim();
     return out ? (0, import_node_path10.dirname)(out) : void 0;
   } catch {
     return void 0;
@@ -6321,7 +6323,7 @@ async function resolveWhoami(deps) {
 }
 function whoamiLine(report, caveat) {
   if (!report.login) return null;
-  const line = `current human: ${report.login} (source: ${report.source}) \u2014 act for this login (e.g. claim --for ${report.login}); do not ask who the user is.`;
+  const line = `current human: ${report.login} (source: ${report.source}) \u2014 act for this login (e.g. mmi-cli board claim <n> --for ${report.login}); do not ask who the user is.`;
   return caveat?.trim() ? `${line} ${caveat.trim()}` : line;
 }
 function authorityLine(report) {
@@ -6363,7 +6365,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path30 = require("node:path");
+var import_node_path31 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -11212,8 +11214,8 @@ function shouldSkipInactiveBoardNode(node, cfg) {
 }
 async function collectBoardItems(cfg, options, deps) {
   const client = deps.client ?? defaultGitHubClient();
-  const git = deps.git ?? defaultGit;
-  const currentRepo = options.repo ?? repoFromRemoteUrl(await git(["remote", "get-url", "origin"])) ?? "";
+  const git2 = deps.git ?? defaultGit;
+  const currentRepo = options.repo ?? repoFromRemoteUrl(await git2(["remote", "get-url", "origin"])) ?? "";
   if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
   const warnings = [];
   const nodes = [];
@@ -11324,8 +11326,8 @@ function findBoardItem(items, selector, board) {
   return found;
 }
 async function resolveCurrentRepo(options, deps) {
-  const git = deps.git ?? defaultGit;
-  const currentRepo = options.repo ?? repoFromRemoteUrl(await git(["remote", "get-url", "origin"])) ?? "";
+  const git2 = deps.git ?? defaultGit;
+  const currentRepo = options.repo ?? repoFromRemoteUrl(await git2(["remote", "get-url", "origin"])) ?? "";
   if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
   return currentRepo;
 }
@@ -11532,8 +11534,8 @@ async function claimBoardIssues(options, deps = {}) {
 async function moveBoardIssues(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
   const client = deps.client ?? defaultGitHubClient();
-  const git = deps.git ?? defaultGit;
-  const currentRepo = options.repo ?? repoFromRemoteUrl(await git(["remote", "get-url", "origin"])) ?? "";
+  const git2 = deps.git ?? defaultGit;
+  const currentRepo = options.repo ?? repoFromRemoteUrl(await git2(["remote", "get-url", "origin"])) ?? "";
   if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
   const selectors = [];
   const seen = /* @__PURE__ */ new Set();
@@ -11617,8 +11619,8 @@ async function moveBoardIssues(options, deps = {}) {
 async function unclaimBoardIssue(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
   const client = deps.client ?? defaultGitHubClient();
-  const git = deps.git ?? defaultGit;
-  const currentRepo = options.repo ?? repoFromRemoteUrl(await git(["remote", "get-url", "origin"])) ?? "";
+  const git2 = deps.git ?? defaultGit;
+  const currentRepo = options.repo ?? repoFromRemoteUrl(await git2(["remote", "get-url", "origin"])) ?? "";
   if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
   const selector = parseIssueSelector(options.selector, currentRepo);
   const { viewer, item } = await fetchIssueProjectItem(client, cfg, selector);
@@ -12450,11 +12452,13 @@ var PRIMARY_GROUPS = [
   ["Orient", ["onboard", "status", "next", "doctor", "whoami", "commands", "explain"]],
   ["Plan and work", ["board", "issue", "worktree", "stage"]],
   ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train"]],
-  ["Setup and support", ["bootstrap", "secrets", "docs"]],
+  // `tests` sits beside `docs` deliberately: both are deterministic, repo-local gates a workflow
+  // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605).
+  ["Setup and support", ["bootstrap", "secrets", "docs", "tests"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
-var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "wave", "report", "skill-lesson"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "wave", "report", "skill-lesson"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
 var topLevelPosition = 0;
@@ -15031,31 +15035,31 @@ var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git = options.git ?? ((args, opts) => (0, import_node_child_process8.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process8.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
-    const out = git(["rev-list", "--no-merges", range]).trim();
+    const out = git2(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
   };
   const isAncestor = (sha, ref) => {
     try {
-      git(["merge-base", "--is-ancestor", sha, ref]);
+      git2(["merge-base", "--is-ancestor", sha, ref]);
       return true;
     } catch {
       return false;
     }
   };
   const patchId = (sha) => {
-    const diff = git(["show", "--no-color", "--pretty=format:", sha]);
+    const diff = git2(["show", "--no-color", "--pretty=format:", sha]);
     if (!diff.trim()) return null;
-    const out = git(["patch-id", "--stable"], { input: diff }).trim();
+    const out = git2(["patch-id", "--stable"], { input: diff }).trim();
     return out ? out.split(" ")[0] : null;
   };
   const changedPaths = (sha) => {
-    const out = git(["show", "--no-color", "--name-only", "--pretty=format:", sha]).trim();
+    const out = git2(["show", "--no-color", "--name-only", "--pretty=format:", sha]).trim();
     return out ? out.split("\n") : [];
   };
   const cherrySources = (sha) => {
-    const message = git(["log", "-1", "--format=%B", sha]);
+    const message = git2(["log", "-1", "--format=%B", sha]);
     return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
   };
   const mainOnly = revList(`${rcRef}..${mainRef}`);
@@ -15070,7 +15074,7 @@ function checkHotfixCoverage(options = {}) {
     }
   };
   const commits = mainOnly.map((sha) => {
-    const subject = git(["log", "-1", "--format=%s", sha]).trim();
+    const subject = git2(["log", "-1", "--format=%s", sha]).trim();
     const paths = changedPaths(sha);
     if (paths.length > 0 && paths.every((p) => manifestPaths.includes(p))) {
       return { sha, subject, coverage: "exempt-distribution" };
@@ -15099,21 +15103,21 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git = options.git ?? ((args, opts) => (0, import_node_child_process8.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process8.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const isAncestor = (sha, ref) => {
     try {
-      git(["merge-base", "--is-ancestor", sha, ref]);
+      git2(["merge-base", "--is-ancestor", sha, ref]);
       return true;
     } catch {
       return false;
     }
   };
   const revList = (range) => {
-    const out = git(["rev-list", "--no-merges", range]).trim();
+    const out = git2(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
   };
   const cherrySources = (sha) => {
-    const message = git(["log", "-1", "--format=%B", sha]);
+    const message = git2(["log", "-1", "--format=%B", sha]);
     return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
   };
   const carried = /* @__PURE__ */ new Set();
@@ -16364,6 +16368,162 @@ function runDocRefs(root, deps = {}) {
   return { ok: findings.length === 0, findings, docCount: Object.keys(docs2).length };
 }
 
+// src/test-policy-core.ts
+var import_node_child_process10 = require("node:child_process");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
+var POLICY_FILE = "test-policy.json";
+var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
+function translate(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+      continue;
+    }
+    if (c === "{") {
+      const close = glob.indexOf("}", i);
+      if (close !== -1) {
+        const alts = glob.slice(i + 1, close).split(",").map((a) => translate(a));
+        out += `(?:${alts.join("|")})`;
+        i = close;
+        continue;
+      }
+    }
+    out += /[.+?^${}()|[\]\\]/.test(c) ? `\\${c}` : c;
+  }
+  return out;
+}
+function globToRegExp(glob) {
+  return new RegExp(`^${translate(glob)}$`);
+}
+function isTestPath(path2) {
+  return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
+}
+function loadPolicy(root, readFile7 = readFileOrNull2) {
+  const raw = readFile7((0, import_node_path17.join)(root, POLICY_FILE));
+  if (raw == null) return { mandatory: [], declared: false };
+  try {
+    return { ...JSON.parse(raw), declared: true };
+  } catch (error) {
+    throw new Error(`${POLICY_FILE} is not valid JSON: ${error.message}`);
+  }
+}
+function readFileOrNull2(path2) {
+  try {
+    return (0, import_node_fs19.readFileSync)(path2, "utf8");
+  } catch {
+    return null;
+  }
+}
+function classify(changed, policy) {
+  const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp(m.glob) }));
+  const mandatoryHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path)));
+  const testChanges = changed.filter((f) => isTestPath(f.path));
+  const addedTests = testChanges.filter((f) => f.status === "A");
+  const protectedBy = new Map((policy.protected ?? []).map((p) => [p.path, p.why ?? ""]));
+  const removedProtected = changed.map((f) => f.status === "D" ? f.path : f.status === "R" || f.status === "C" ? f.from : void 0).filter((p) => typeof p === "string" && protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
+  return { mandatoryHits, testChanges, addedTests, removedProtected };
+}
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs19.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path17.join)(root, p)));
+}
+function evaluate(changed, policy) {
+  const { mandatoryHits, testChanges, addedTests, removedProtected } = classify(changed, policy);
+  const findings = [];
+  if (removedProtected.length > 0) {
+    findings.push({
+      kind: "protected-removed",
+      paths: removedProtected.map((f) => f.path),
+      detail: `PROTECTED TEST FILE(S) REMOVED \u2014 this change deletes or renames away ${removedProtected.length} file(s) test-policy.json protects:
+` + removedProtected.map((f) => `    ${f.path}
+      ${f.why}`).join("\n") + "\n  If you are removing one because it looked unrequired, read the reason above first \u2014 it is\n  the answer to exactly that question. If this removal was asked for, add a commit trailer:\n  Test-Policy-Override: <reason>"
+    });
+  }
+  if (mandatoryHits.length > 0 && testChanges.length === 0) {
+    findings.push({
+      kind: "mandatory-zone-untested",
+      paths: mandatoryHits.map((f) => f.path),
+      detail: `MANDATORY ZONE UNTESTED \u2014 this change touches ${mandatoryHits.length} path(s) in the mandatory zone but changes no test:
+` + mandatoryHits.map((f) => `    ${f.path}`).join("\n") + "\n  These are the paths where a silent failure costs real money, real data, a security breach,\n  or production. Add or update a test that would fail if the guarded property broke."
+    });
+  }
+  if (policy.declared !== false && addedTests.length > 0 && mandatoryHits.length === 0) {
+    findings.push({
+      kind: "unrequested-test-file",
+      paths: addedTests.map((f) => f.path),
+      detail: `UNREQUESTED TEST FILE(S) \u2014 this change adds ${addedTests.length} new test file(s) but touches nothing in the mandatory zone:
+` + addedTests.map((f) => `    ${f.path}`).join("\n") + "\n  Tests are OPT-IN in this estate. Write one only if its absence means catastrophe \u2014 money\n  lost, data destroyed, a security breach, or production down. If a silent failure costs\n  nothing but a re-run, delete the file and move on. If this test was asked for, add a commit\n  trailer: Test-Policy-Override: <reason>"
+    });
+  }
+  return findings;
+}
+function git(args, cwd) {
+  return (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function resolveBase(cwd, explicit) {
+  const candidates = [explicit, process.env.TEST_POLICY_BASE, "origin/development", "origin/main"].filter(Boolean);
+  for (const ref of candidates) {
+    try {
+      return git(["merge-base", "HEAD", ref], cwd).trim();
+    } catch {
+    }
+  }
+  return null;
+}
+function changedFilesSince(base, cwd) {
+  const raw = git(["diff", "--name-status", "-M", `${base}...HEAD`], cwd).trim();
+  if (!raw) return [];
+  return raw.split("\n").map((line) => {
+    const parts = line.split("	");
+    const norm = (p) => p.replace(/\\/g, "/");
+    const row = { status: parts[0][0], path: norm(parts[parts.length - 1]) };
+    if (parts.length > 2) row.from = norm(parts[1]);
+    return row;
+  });
+}
+function runTestPolicy(root, deps = {}) {
+  const policy = deps.policy ?? loadPolicy(root);
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs19.existsSync)(path2));
+  const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
+  const unresolved = unresolvedProtectedEntries(policy, root, exists);
+  if (unresolved.length > 0) {
+    return {
+      ok: false,
+      base: null,
+      changedCount: 0,
+      ...counts,
+      findings: [{
+        kind: "stale-protected-entry",
+        paths: unresolved,
+        detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist:
+` + unresolved.map((p) => `    ${p}`).join("\n") + "\n  An entry naming a missing file reads as protection while protecting nothing.\n  Restore the file, or remove its entry."
+      }]
+    };
+  }
+  const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
+  if (!deps.changed && !base) return { ok: true, findings: [], changedCount: 0, base: null, ...counts };
+  const changed = deps.changed ?? changedFilesSince(base, root);
+  if (changed.length === 0) return { ok: true, findings: [], changedCount: 0, base, ...counts };
+  const override = deps.overrideReason !== void 0 ? deps.overrideReason : OVERRIDE_RE.exec(git(["log", `${base}..HEAD`, "--format=%B"], root))?.[1]?.trim() ?? null;
+  if (override) return { ok: true, findings: [], changedCount: changed.length, base, overriddenBy: override, ...counts };
+  const findings = evaluate(changed, policy);
+  return { ok: findings.length === 0, findings, changedCount: changed.length, base, ...counts };
+}
+
 // src/docs-audit-command.ts
 function serializeOutcome(outcome) {
   switch (outcome.kind) {
@@ -17305,8 +17465,8 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path18 = require("node:path");
 var import_node_os5 = require("node:os");
 
 // src/project-runtime.ts
@@ -17430,18 +17590,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path17.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path18.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path17.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path17.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path18.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path18.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs19.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs19.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs20.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs20.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -17451,9 +17611,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs19.mkdtempSync)((0, import_node_path17.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path17.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs19.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path18.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs20.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -17465,7 +17625,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs19.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs20.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -17555,7 +17715,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs19.readFileSync)((0, import_node_path17.resolve)(o.file), "utf8");
+        body = (0, import_node_fs20.readFileSync)((0, import_node_path18.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -17660,7 +17820,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs19.unlinkSync)((0, import_node_path17.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs20.unlinkSync)((0, import_node_path18.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -17854,7 +18014,7 @@ function checkGithubPools(probe) {
 }
 
 // src/box-commands.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -18057,7 +18217,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs20.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs21.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -18072,7 +18232,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises2 = require("node:fs/promises");
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var import_node_util7 = require("node:util");
 
 // src/schedules.ts
@@ -18512,7 +18672,7 @@ function assembleReconciliation(githubEntries2, readRepos, registry2, activeWork
 }
 
 // src/schedules-commands.ts
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process10.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process11.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -18749,7 +18909,7 @@ function registerSchedulesCommands(program3) {
 
 // src/file-lock.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
@@ -18834,7 +18994,7 @@ async function releaseFileLock(lockPath, guard) {
 }
 async function withFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises3.mkdir)((0, import_node_path18.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn();
@@ -18845,7 +19005,7 @@ async function withFileLock(lockPath, opts, fn) {
 
 // src/schedules-lift-command.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 
 // src/schedules-lift.ts
 var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor", "llm", "output", "breaks", "kill"];
@@ -18951,7 +19111,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises4.readFile)((0, import_node_path19.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises4.readFile)((0, import_node_path20.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -19493,7 +19653,7 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES2 = ["development", "rc", "main"];
@@ -20036,7 +20196,7 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs21.existsSync)(path2) ? (0, import_node_fs21.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs22.existsSync)(path2) ? (0, import_node_fs22.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       requiredGcpApis: (() => {
@@ -20091,12 +20251,12 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs21.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs21.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs22.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs22.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile7 = (p) => (0, import_node_fs21.existsSync)(p) ? (0, import_node_fs21.readFileSync)(p, "utf8") : null;
+    const readFile7 = (p) => (0, import_node_fs22.existsSync)(p) ? (0, import_node_fs22.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const rawVars = {};
     for (const value of cmdOpts.var ?? []) {
@@ -20330,12 +20490,12 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path21 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -20349,8 +20509,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs22.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs23.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -20364,9 +20524,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs22.existsSync)(path2) ? JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs23.existsSync)(path2) ? JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs22.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs23.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -20388,22 +20548,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path20.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path20.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs22.existsSync)(registryPath) || !(0, import_node_fs22.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path21.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path21.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs23.existsSync)(registryPath) || !(0, import_node_fs23.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path20.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path20.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path21.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path21.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path20.dirname)(dir);
+    const parent = (0, import_node_path21.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path20.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path21.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -20579,8 +20739,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs23.existsSync)((0, import_node_path21.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs23.existsSync)((0, import_node_path21.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs24.existsSync)((0, import_node_path22.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs24.existsSync)((0, import_node_path22.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -21012,10 +21172,10 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_promises6 = require("node:fs/promises");
-var import_node_path25 = require("node:path");
-var import_node_child_process11 = require("node:child_process");
+var import_node_path26 = require("node:path");
+var import_node_child_process12 = require("node:child_process");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -21101,7 +21261,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -21152,12 +21312,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises5.mkdir)((0, import_node_path22.dirname)(registryPath), { recursive: true });
+      await (0, import_promises5.mkdir)((0, import_node_path23.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises5.mkdir)((0, import_node_path22.dirname)(registryPath), { recursive: true });
+      await (0, import_promises5.mkdir)((0, import_node_path23.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -21181,8 +21341,8 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
 }
 
 // src/plugin-guard-io.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path24 = require("node:path");
 var import_node_os6 = require("node:os");
 
 // src/plugin-guard.ts
@@ -21315,11 +21475,11 @@ function runHostBin(bin, args, opts) {
 }
 var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs24.readFileSync)(installedPluginsPath2(surface), "utf8"));
+    return JSON.parse((0, import_node_fs25.readFileSync)(installedPluginsPath2(surface), "utf8"));
   } catch {
     return null;
   }
@@ -21327,13 +21487,13 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path23.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path23.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path24.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path24.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path23.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path24.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs24.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs25.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 async function fetchNpmReleasedVersion() {
@@ -21361,7 +21521,7 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs24.existsSync)((0, import_node_path23.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs25.existsSync)((0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -21407,7 +21567,7 @@ async function applyPluginHeal(surface, log, opts) {
   const refSupported = await marketplaceAddRefSupported("claude");
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   log(healBannerLine("claude", "claude", refSupported));
-  const pinsPath = (0, import_node_path23.join)((0, import_node_os6.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
+  const pinsPath = (0, import_node_path24.join)((0, import_node_os6.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]);
   for (const step of steps) {
     if (healStepAborts(step, await runClaudePlugin([...step.args]))) return false;
@@ -21430,7 +21590,7 @@ async function healClaudePluginForDoctor(surface = detectSurface(process.env)) {
 }
 function readKnownMarketplacesFile(path2) {
   try {
-    return (0, import_node_fs24.existsSync)(path2) ? (0, import_node_fs24.readFileSync)(path2, "utf8") : void 0;
+    return (0, import_node_fs25.existsSync)(path2) ? (0, import_node_fs25.readFileSync)(path2, "utf8") : void 0;
   } catch {
     return void 0;
   }
@@ -21441,7 +21601,7 @@ function restoreMarketplacePinsOnDisk(path2, pins) {
   const next = restoreMarketplacePins(after, pins);
   if (next === null) return void 0;
   try {
-    (0, import_node_fs24.writeFileSync)(path2, next, "utf8");
+    (0, import_node_fs25.writeFileSync)(path2, next, "utf8");
   } catch {
     return `could NOT restore ${[...pins.keys()].join(", ")} \u2014 re-pin by hand`;
   }
@@ -21488,9 +21648,9 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
 }
 
 // src/worktree-ownership.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_os7 = require("node:os");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 var OWNERS_FILE = "worktree-owners.json";
 var EVENTS_FILE = "worktree-events.jsonl";
 var WORKTREE_ACTIVITY_WINDOW_MS = 30 * 6e4;
@@ -21587,7 +21747,7 @@ function describeActorShort(actor) {
 }
 function readOwners(primaryRoot) {
   try {
-    return parseWorktreeOwners((0, import_node_fs25.readFileSync)(worktreeOwnersPath(primaryRoot), "utf8"));
+    return parseWorktreeOwners((0, import_node_fs26.readFileSync)(worktreeOwnersPath(primaryRoot), "utf8"));
   } catch {
     return [];
   }
@@ -21595,8 +21755,8 @@ function readOwners(primaryRoot) {
 function writeOwners(primaryRoot, entries) {
   try {
     const path2 = worktreeOwnersPath(primaryRoot);
-    (0, import_node_fs25.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
-    (0, import_node_fs25.writeFileSync)(path2, serializeWorktreeOwners(entries), "utf8");
+    (0, import_node_fs26.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
+    (0, import_node_fs26.writeFileSync)(path2, serializeWorktreeOwners(entries), "utf8");
   } catch {
   }
 }
@@ -21629,8 +21789,8 @@ function dropWorktreeOwner(primaryRoot, path2) {
 function appendWorktreeEvent(primaryRoot, event) {
   try {
     const path2 = worktreeEventsPath(primaryRoot);
-    (0, import_node_fs25.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
-    (0, import_node_fs25.appendFileSync)(path2, `${JSON.stringify({ at: event.at ?? (/* @__PURE__ */ new Date()).toISOString(), ...event })}
+    (0, import_node_fs26.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
+    (0, import_node_fs26.appendFileSync)(path2, `${JSON.stringify({ at: event.at ?? (/* @__PURE__ */ new Date()).toISOString(), ...event })}
 `, "utf8");
   } catch {
   }
@@ -21638,7 +21798,7 @@ function appendWorktreeEvent(primaryRoot, event) {
 function readWorktreeEvents(primaryRoot, limit = 50) {
   let text;
   try {
-    text = (0, import_node_fs25.readFileSync)(worktreeEventsPath(primaryRoot), "utf8");
+    text = (0, import_node_fs26.readFileSync)(worktreeEventsPath(primaryRoot), "utf8");
   } catch {
     return [];
   }
@@ -21788,7 +21948,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path25.dirname)((0, import_node_path25.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path26.dirname)((0, import_node_path26.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -21819,7 +21979,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       const cleanup = await cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs26.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs27.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -21847,7 +22007,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   for (const wt of worktreeDirsToRemove) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs26.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs27.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -21998,7 +22158,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process11.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -22012,13 +22172,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs26.lstatSync)(p);
+      st = (0, import_node_fs27.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs26.readlinkSync)(p);
+      (0, import_node_fs27.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -22026,7 +22186,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs26.readdirSync)(p);
+      return (0, import_node_fs27.readdirSync)(p);
     } catch {
       return [];
     }
@@ -22035,9 +22195,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs26.rmdirSync)(p);
+      (0, import_node_fs27.rmdirSync)(p);
     } catch {
-      (0, import_node_fs26.unlinkSync)(p);
+      (0, import_node_fs27.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises6.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -22070,9 +22230,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs26.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs27.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs26.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs27.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -22279,8 +22439,8 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path27 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -22383,7 +22543,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs27.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path26.join)(root, e.name));
+      return (0, import_node_fs28.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path27.join)(root, e.name));
     } catch {
       return [];
     }
@@ -22530,13 +22690,13 @@ function registerWorktreeCommands(program3) {
       if (PROTECTED_BRANCHES2.has(branch)) {
         return fail(`worktree land: refusing to land protected branch '${branch}'`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
-      const gitFile = (0, import_node_path26.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs27.existsSync)(gitFile) && (0, import_node_fs27.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path27.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs28.existsSync)(gitFile) && (0, import_node_fs28.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path26.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path27.dirname)(commonDir) : wtPath;
       const stageSummary = readStageSummary(wtPath);
       const hasStage = stageSummary != null;
       const steps = landSteps(branch, true, hasStage);
@@ -22688,10 +22848,10 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path26.dirname)((0, import_node_path26.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path27.dirname)((0, import_node_path27.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs27.existsSync)(wtRoot)) {
+  if ((0, import_node_fs28.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
@@ -22714,7 +22874,7 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
 }
 
 // src/issue-commands.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 async function editIssue(client, options, deps = {}) {
@@ -22724,11 +22884,16 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  if (options.title !== void 0) patch.title = options.title;
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs29.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  if (options.titleFile !== void 0) {
+    patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
+  } else if (options.title !== void 0) {
+    patch.title = options.title;
+  }
   if (options.body !== void 0 || options.bodyFile !== void 0) {
     let body;
     if (options.bodyFile) {
-      const td = deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs28.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+      const td = textDeps();
       body = await resolveIssueBody({ body: options.body, bodyFile: options.bodyFile }, td);
     } else {
       body = options.body ?? "";
@@ -23093,7 +23258,7 @@ function registerIssueLifecycleCommands(program3, deps = {}) {
   const issue2 = program3.commands.find((c) => c.name() === "issue");
   if (!issue2) return;
   mutating(
-    issue2.command("edit <ref>").description("edit an issue title/body/labels or reparent it (--parent) \u2014 reparenting is impossible via raw gh").option("--title <title>", "new title").option("--body <body>", "new body (markdown)").option("--body-file <path|->", "read new body from a UTF-8 file, or stdin with -").option("--add-label <label...>", "label(s) to add (repeatable)").option("--remove-label <label...>", "label(s) to remove (repeatable)").option("--parent <ref>", "reparent: link under this parent (#123, owner/repo#123, or URL)").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)"),
+    issue2.command("edit <ref>").description("edit an issue title/body/labels or reparent it (--parent) \u2014 reparenting is impossible via raw gh").option("--title <title>", "new title").option("--title-file <path|->", "read the new title from a UTF-8 file, or stdin with - (a title with backticks or newlines needs this, #3381)").option("--body <body>", "new body (markdown)").option("--body-file <path|->", "read new body from a UTF-8 file, or stdin with -").option("--add-label <label...>", "label(s) to add (repeatable)").option("--remove-label <label...>", "label(s) to remove (repeatable)").option("--parent <ref>", "reparent: link under this parent (#123, owner/repo#123, or URL)").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)"),
     (opts, args) => ({ command: "issue edit", ref: args[0], fields: Object.keys(opts).filter((k) => k !== "repo" && opts[k] !== void 0) })
   ).action(async (ref, o) => {
     try {
@@ -23102,6 +23267,7 @@ function registerIssueLifecycleCommands(program3, deps = {}) {
         ref,
         defaultRepo,
         title: o.title,
+        titleFile: o.titleFile,
         body: o.body,
         bodyFile: o.bodyFile,
         addLabel: o.addLabel,
@@ -23225,7 +23391,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs28.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs29.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -23283,8 +23449,8 @@ ${lines}`);
 }
 
 // src/train-commands.ts
-var import_node_fs29 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_fs30 = require("node:fs");
+var import_node_path28 = require("node:path");
 
 // src/train-status.ts
 function buildTrainStatusReport(input) {
@@ -23324,7 +23490,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path27.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs30.readFileSync)((0, import_node_path28.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -23470,9 +23636,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_os8 = require("node:os");
-var import_node_path28 = require("node:path");
+var import_node_path29 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   let branch = "";
@@ -23649,8 +23815,8 @@ async function collectOnboardStatus() {
   }
   const home = (0, import_node_os8.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path28.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs30.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path28.join)(home, ".claude", "settings.json"), import_node_fs30.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path29.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs31.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path29.join)(home, ".claude", "settings.json"), import_node_fs31.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, nextCommand };
 }
@@ -25010,17 +25176,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep2 = platform2 === "win32" ? "\\" : "/";
-  const join25 = (...parts) => parts.join(sep2);
+  const join26 = (...parts) => parts.join(sep2);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join25(explicit, "hosts.yml");
+  if (explicit) return join26(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join25(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join26(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join25(xdg, "gh", "hosts.yml");
+  if (xdg) return join26(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join25(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join26(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -25070,17 +25236,17 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path29 = require("node:path");
-var import_node_child_process12 = require("node:child_process");
+var import_node_path30 = require("node:path");
+var import_node_child_process13 = require("node:child_process");
 var import_node_util8 = require("node:util");
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process12.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process13.execFile);
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs31.readFileSync)((0, import_node_path29.join)((0, import_node_os9.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs32.readFileSync)((0, import_node_path30.join)((0, import_node_os9.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -25091,7 +25257,7 @@ function installedClaudePluginVersion() {
 }
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process12.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = (0, import_node_child_process13.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -25101,13 +25267,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path29.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path30.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs31.readFileSync)(path2, "utf8");
+    return (0, import_node_fs32.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -25116,7 +25282,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs31.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs32.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -25140,7 +25306,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs31.existsSync)((0, import_node_path29.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs32.existsSync)((0, import_node_path30.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -25175,8 +25341,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs32.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs32.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs33.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs33.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -25184,7 +25350,7 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path30.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path31.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -25335,8 +25501,8 @@ function mmiDoctorDeps(opts = {}) {
         const home = (0, import_node_os10.homedir)();
         return marketplaceRows(
           MMI_MARKETPLACE_NAME,
-          readFileSyncSafe((0, import_node_path30.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs32.readFileSync),
-          readFileSyncSafe((0, import_node_path30.join)(home, ".claude", "settings.json"), import_node_fs32.readFileSync)
+          readFileSyncSafe((0, import_node_path31.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs33.readFileSync),
+          readFileSyncSafe((0, import_node_path31.join)(home, ".claude", "settings.json"), import_node_fs33.readFileSync)
         );
       } catch {
         return [];
@@ -25370,6 +25536,35 @@ function allLongFlags() {
   cachedLongFlags = [...acc];
   return cachedLongFlags;
 }
+var cachedCommandPaths;
+function allCommandPaths() {
+  if (cachedCommandPaths) return cachedCommandPaths;
+  const acc = [];
+  const walk2 = (node, trail) => {
+    if (!isCanonicalSuggestion(node)) return;
+    const here = [...trail, node.name];
+    if (here.length) acc.push(here.join(" "));
+    for (const child2 of node.subcommands) walk2(child2, here);
+  };
+  for (const child2 of buildCommandManifest(program2).tree.subcommands) walk2(child2, []);
+  cachedCommandPaths = acc;
+  return cachedCommandPaths;
+}
+function suggestCommandPath(token, paths) {
+  const all = [...paths];
+  const leafOf = (p) => p.slice(p.lastIndexOf(" ") + 1);
+  const exact = all.filter((p) => leafOf(p) === token);
+  if (exact.length === 1) return exact[0];
+  if (exact.length > 1) return void 0;
+  const leaves = /* @__PURE__ */ new Map();
+  for (const p of all) {
+    const leaf = leafOf(p);
+    leaves.set(leaf, [...leaves.get(leaf) ?? [], p]);
+  }
+  const near = didYouMean(token, leaves.keys());
+  const hits = near ? leaves.get(near) ?? [] : [];
+  return hits.length === 1 ? hits[0] : void 0;
+}
 function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
@@ -25378,6 +25573,7 @@ var PARSE_HINT_SENTINEL = "@@mmi-parse-hint@@";
 var DISCOVERY_HINT = "run `mmi-cli commands` for the agentic-coding map, `mmi-cli explain <command>` for detail, or `mmi-cli commands --json --primary` for machine discovery";
 var STALE_HINT = `(${DISCOVERY_HINT}). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)`;
 var lastParseErrorKind = "other";
+var lastUnknownCommand;
 function classifyParseError(plain) {
   if (/unknown command/i.test(plain)) return "unknown-command";
   if (/unknown option|missing required argument|too many arguments|argument missing/i.test(plain)) {
@@ -25407,6 +25603,10 @@ function commandPath2(cmd) {
   return parts.join(" ");
 }
 function resolveParseHint() {
+  if (lastParseErrorKind === "unknown-command") {
+    const path3 = lastUnknownCommand ? suggestCommandPath(lastUnknownCommand, allCommandPaths()) : void 0;
+    return path3 ? `(did you mean \`mmi-cli ${path3}\`? ${DISCOVERY_HINT})` : STALE_HINT;
+  }
   if (lastParseErrorKind !== "bad-arguments") return STALE_HINT;
   const cmd = resolveCommandFromArgv(program2, process.argv.slice(2));
   if (!cmd) return `(${DISCOVERY_HINT})`;
@@ -25425,6 +25625,7 @@ function envelopeAwareWriteErr(str) {
     return;
   }
   lastParseErrorKind = classifyParseError(plain);
+  lastUnknownCommand = /unknown command '?([\w:-]+)'?/.exec(plain)?.[1];
   const match = /unknown option '([^']+)'/.exec(plain);
   if (match) {
     const flag = match[1];
@@ -25480,19 +25681,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path30.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs32.existsSync)(path2) ? (0, import_node_fs32.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path31.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs33.existsSync)(path2) ? (0, import_node_fs33.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs32.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs33.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs32.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs33.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli org rules gitignore: up to date");
@@ -25618,8 +25819,8 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path30.resolve)(o.root);
-    if (!(0, import_node_fs32.existsSync)(root) || !(0, import_node_fs32.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path31.resolve)(o.root);
+    if (!(0, import_node_fs33.existsSync)(root) || !(0, import_node_fs33.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory(gcRepoRoot, root)) {
       return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
@@ -25661,7 +25862,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve5, reject) => {
-    const child2 = (0, import_node_child_process13.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child2 = (0, import_node_child_process14.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child2.kill();
@@ -25684,7 +25885,7 @@ async function primaryCheckoutRoot(from) {
   return primaryCheckoutRootOf(async (args) => (await execFileP2("git", ["-C", from, ...args], { timeout: GIT_TIMEOUT_MS })).stdout);
 }
 async function unprovenWorktreeReason(wtPath, repoRoot2) {
-  if (!(0, import_node_fs32.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
+  if (!(0, import_node_fs33.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
   const porcelain = (await execFileP2("git", ["-C", repoRoot2, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const registered = parseWorktreePorcelainEntries(porcelain);
   if (!registered.length) {
@@ -25705,26 +25906,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs32.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs33.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs32.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs33.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs32.closeSync)(fd);
+      (0, import_node_fs33.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs32.rmSync)(lockPath, { force: true });
+        (0, import_node_fs33.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs32.mkdirSync)((0, import_node_path30.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs33.mkdirSync)((0, import_node_path31.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs32.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs32.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs33.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs33.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -25932,7 +26133,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -25979,6 +26180,36 @@ docs.command("refs").description("deterministic doc reference gate: every backti
     await failGraceful(e.message);
   }
 });
+var tests = program2.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
+tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, changedCount, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const result = runTestPolicy(root, { base: o.base });
+    if (o.json) {
+      consoleIo.log(JSON.stringify(result, null, 2));
+      if (!result.ok) process.exitCode = 1;
+      return;
+    }
+    if (result.base === null && result.ok) {
+      console.log("tests policy: no comparison base (origin/development or origin/main) \u2014 skipping.");
+      return;
+    }
+    if (result.overriddenBy) {
+      console.log(`tests policy: overridden by commit trailer \u2014 ${result.overriddenBy}`);
+      return;
+    }
+    if (result.ok) {
+      console.log(
+        `tests policy: OK (${result.changedCount} changed file(s); ${result.mandatoryCount} mandatory glob(s), ${result.protectedCount} protected file(s)).`
+      );
+      return;
+    }
+    for (const f of result.findings) console.error(`tests policy: ${f.detail}`);
+    process.exitCode = 1;
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
 var docsAudit = program2.command("docs-audit").description("the docs janitor verdict ledger \u2014 record a dated run verdict, or read the dead-man status back");
 docsAudit.command("record").description("write a dated janitor verdict for one repo to the registry ledger (master-only server-side)").option("--repo <owner/name>", "the repo the verdict is for (default: the current repo)").option("--date <YYYY-MM-DD>", "the ISO day the run examined (default: today)").requiredOption("--sha-range <a..b>", "the git range the janitor read (e.g. <lastVerdictSha>..HEAD)").requiredOption("--outcome <kind>", "clean | refreshed | failed").option("--count <n>", "docs refreshed (required when --outcome refreshed)").option("--reason <text>", "why the run failed (required when --outcome failed)").requiredOption("--checker-vendor <vendor>", "which vendor's model actually ran the check").action(async (o) => {
   try {
@@ -26194,7 +26425,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs32.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs33.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -26850,11 +27081,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path30.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs32.existsSync)(wfDir)) return [];
-  return (0, import_node_fs32.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path31.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs33.existsSync)(wfDir)) return [];
+  return (0, import_node_fs33.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs32.readFileSync)((0, import_node_path30.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs33.readFileSync)((0, import_node_path31.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -26881,16 +27112,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path30.join)(root, path2);
-      return (0, import_node_fs32.existsSync)(fullPath) ? (0, import_node_fs32.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path31.join)(root, path2);
+      return (0, import_node_fs33.existsSync)(fullPath) ? (0, import_node_fs33.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path30.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path31.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs32.existsSync)((0, import_node_path30.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs32.existsSync)((0, import_node_path30.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs33.existsSync)((0, import_node_path31.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs33.existsSync)((0, import_node_path31.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -27167,7 +27398,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs32.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs33.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -27508,10 +27739,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs32.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs32.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs33.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs33.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs32.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs32.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs33.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs33.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -27545,16 +27776,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs32.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs33.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path30.join)(path2, entry.name);
+    const child2 = (0, import_node_path31.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs32.statSync)(child2).size;
+        total += (0, import_node_fs33.statSync)(child2).size;
       } catch {
       }
     }
@@ -27562,25 +27793,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs32.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs33.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(home) {
   const p = installedPluginsPath(home);
-  if (!(0, import_node_fs32.existsSync)(p)) return [];
+  if (!(0, import_node_fs33.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs32.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs33.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(home, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs32.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs32.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs33.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs33.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs32.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs33.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path30.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs32.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path31.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs33.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -27594,10 +27825,10 @@ function stagingApplyFsGuard(home) {
   return {
     referencedPaths: () => readInstalledPluginRefs(home),
     mtimeMs: (name) => {
-      const p = (0, import_node_path30.join)(stagingRoot, name);
-      if (!(0, import_node_fs32.existsSync)(p)) return null;
+      const p = (0, import_node_path31.join)(stagingRoot, name);
+      if (!(0, import_node_fs33.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs32.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs33.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -27613,7 +27844,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs32.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os10.homedir)())) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs33.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os10.homedir)())) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -27676,7 +27907,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     bannerIo.log(worktreeBanner);
   }
   if (isLinkedWorktree(process.cwd())) {
@@ -27701,5 +27932,6 @@ program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGr
   isOrgRegisteredRepo,
   registryClientDeps,
   repoSlug,
-  shouldMarkWorktreeActivity
+  shouldMarkWorktreeActivity,
+  suggestCommandPath
 });