@mutmutco/cli 3.78.0 → 3.80.0

package/dist/main.cjs

@@ -3580,6 +3580,8 @@ var ERROR_CODES = {
   ERR_CONFLICTING_FLAGS: "ERR_CONFLICTING_FLAGS",
   /** A flag was supplied but its resolved value is empty (e.g. an empty `--title-file` or empty stdin). */
   ERR_EMPTY_INPUT: "ERR_EMPTY_INPUT",
+  /** A supplied value has the right source but an invalid shape (e.g. a title with line breaks). */
+  ERR_INVALID_INPUT: "ERR_INVALID_INPUT",
   /** A flag's value is outside its allowed set (e.g. `--priority nope`). */
   ERR_BAD_ENUM: "ERR_BAD_ENUM",
   /** An unknown flag or subcommand — usually a typo; carries a `did_you_mean`. */
@@ -3612,6 +3614,11 @@ var ERROR_CODE_REFERENCE = [
     meaning: "A flag was supplied but resolved to an empty value (e.g. an empty file or empty stdin).",
     typical_fix: "Provide non-empty content for the flag in `offending_flag` (a file with text, or a real pipe/heredoc for stdin)."
   },
+  {
+    code: ERROR_CODES.ERR_INVALID_INPUT,
+    meaning: "A supplied value has an invalid shape for the flag.",
+    typical_fix: "Correct the value named by `offending_flag` and retry."
+  },
   {
     code: ERROR_CODES.ERR_BAD_ENUM,
     meaning: "A flag value is outside the allowed enum.",
@@ -6425,7 +6432,7 @@ function scanInstallDirs(root, fs2 = realFsProbe) {
   return [factsFor(""), ...children.map(factsFor).filter((f) => f.hasPackageJson)];
 }
 function npmInstallTargets(dirs) {
-  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
+  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install --no-package-lock" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
   return fs2.isFile((0, import_node_path10.join)(root, ".git"));
@@ -9430,6 +9437,132 @@ async function runReleaseResume(deps, options = {}) {
     note: `resumed and completed ${tag} \u2014 the original version was preserved, not re-cut`
   };
 }
+async function runReleaseAbort(deps, options = {}) {
+  if (!options.approved) {
+    throw new Error("release --abort requires --apply after explicit approval; nothing was written");
+  }
+  const ctx = await buildTrainApplyContext(deps);
+  if (!isHubControlRepo(ctx.repo)) {
+    throw new Error("release --abort is limited to mutmutco/MMI-Hub until other release tracks define equivalent publish-absence proof");
+  }
+  await requireCleanTree(deps);
+  if (await currentBranch(deps) !== "main") {
+    throw new Error("release --abort must run from the primary checkout left on main by the failed train; nothing was written");
+  }
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((tag2) => tag2.trim()).filter((tag2) => /^v\d+\.\d+\.\d+$/.test(tag2));
+  const tag = tags[0];
+  if (!tag) throw new Error("release --abort found no final v* tag; nothing was written");
+  const tagSha = await probeRemoteTag(deps, tag);
+  if (!tagSha) throw new Error(`release --abort: ${tag} is not on origin; nothing was written`);
+  const localTagSha = clean2(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
+  const localMainSha = clean2(await deps.run("git", ["rev-parse", "main"]));
+  const originMainSha = clean2(await deps.run("git", ["rev-parse", "origin/main"]));
+  if (localTagSha !== tagSha || localMainSha !== tagSha) {
+    throw new Error(
+      `release --abort: local tag/main do not both identify origin ${tag} (${tagSha.slice(0, 12)}); nothing was written`
+    );
+  }
+  if (!await probeAncestor(deps, "origin/main", tagSha, "release --abort: origin/main ancestry")) {
+    throw new Error(`release --abort: ${tag} does not descend from origin/main; nothing was written`);
+  }
+  const candidateParents = clean2(await deps.run("git", ["rev-list", "--parents", "-n", "1", tagSha])).split(/\s+/);
+  if (candidateParents.length !== 2 || candidateParents[0] !== tagSha) {
+    throw new Error(`release --abort: ${tag} is not a single-parent release bump; nothing was written`);
+  }
+  const candidateBaseSha = candidateParents[1];
+  if (!await probeAncestor(deps, candidateBaseSha, "origin/development", "release --abort: development ancestry")) {
+    throw new Error(`release --abort: current development does not descend from ${tag}'s candidate base; nothing was written`);
+  }
+  if (!await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo)) {
+    throw new Error(`release --abort: ${tag} is released or its unpublished state could not be proven; nothing was written`);
+  }
+  const version = tag.slice(1);
+  try {
+    const published = clean2(await deps.run("npm", ["view", `@mutmutco/cli@${version}`, "version", "--json"]));
+    if (published) {
+      throw new Error(`release --abort: @mutmutco/cli@${version} is already published; ${tag} cannot be reused`);
+    }
+    throw new Error("npm registry returned an empty successful response");
+  } catch (error) {
+    const detail = `${error instanceof Error ? error.message : String(error)} ${String(error.stderr ?? "")}`;
+    if (!/E404|not found|No match found/i.test(detail)) {
+      if (/already published/.test(detail)) throw error;
+      throw new Error(`release --abort: npm publish absence could not be proven (${detail.trim()}); nothing was written`);
+    }
+  }
+  await runGitPush(deps, ["push", "origin", "--delete", tag]);
+  if (await probeRemoteTag(deps, tag)) {
+    throw new Error(`release --abort: origin still reports ${tag} after deletion; local state was preserved`);
+  }
+  await deps.run("git", ["tag", "-d", tag]);
+  await deps.run("git", ["checkout", "development"]);
+  await ffOnlyPull(deps, "development");
+  await deps.run("git", ["branch", "-f", "main", "origin/main"]);
+  const restoredMainSha = clean2(await deps.run("git", ["rev-parse", "main"]));
+  if (restoredMainSha !== originMainSha) {
+    throw new Error(`release --abort removed ${tag}, but local main did not restore to origin/main; inspect before retrying`);
+  }
+  return {
+    command: "release-abort",
+    repo: ctx.repo,
+    tag,
+    tagSha,
+    restoredMainSha,
+    note: `removed the unpublished ${tag} candidate and restored local main; repair development before recutting`
+  };
+}
+async function runReleasePublishRetry(deps, runId, options = {}) {
+  if (!options.approved) {
+    throw new Error("release --retry-publish requires --apply after explicit approval; nothing was written");
+  }
+  if (!Number.isSafeInteger(runId) || runId <= 0) throw new Error(`invalid publish run id ${runId}`);
+  const ctx = await buildTrainApplyContext(deps);
+  if (!isHubControlRepo(ctx.repo)) {
+    throw new Error("release --retry-publish is limited to mutmutco/MMI-Hub");
+  }
+  await requireCleanTree(deps);
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const readRun = async () => {
+    const raw = await deps.run("gh", ["run", "view", String(runId), "--repo", ctx.repo, "--json", "databaseId,workflowName,event,headBranch,headSha,status,conclusion,url"]);
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`publish run ${runId} metadata was not valid JSON`);
+    }
+  };
+  const run = await readRun();
+  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || run.conclusion !== "failure") {
+    throw new Error(`run ${runId} is not a completed failed Hub publish release run; nothing was written`);
+  }
+  const tag = run.headBranch ?? "";
+  const tagSha = run.headSha ?? "";
+  if (!/^v\d+\.\d+\.\d+$/.test(tag) || !/^[0-9a-f]{40}$/.test(tagSha)) {
+    throw new Error(`run ${runId} has invalid release identity (${tag || "(no tag)"} / ${tagSha || "(no sha)"}); nothing was written`);
+  }
+  if (await probeRemoteTag(deps, tag) !== tagSha) {
+    throw new Error(`run ${runId} does not match origin ${tag}; nothing was written`);
+  }
+  await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
+  await deps.run("gh", ["run", "rerun", String(runId), "--repo", ctx.repo, "--failed"]);
+  if (options.watch) {
+    await deps.run("gh", ["run", "watch", String(runId), "--repo", ctx.repo, "--exit-status"]);
+    const completed = await readRun();
+    if (completed.status !== "completed" || completed.conclusion !== "success") {
+      throw new Error(`publish run ${runId} did not finish successfully after retry`);
+    }
+  }
+  return {
+    command: "release-retry-publish",
+    repo: ctx.repo,
+    tag,
+    tagSha,
+    runId,
+    runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
+    status: options.watch ? "success" : "pending",
+    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} failed jobs queued for retry`
+  };
+}
 async function runTrainApplyPipeline(mode, input) {
   const { deps, ctx, command, meta, branchHints, watch, options } = input;
   const directTrack = input.directTrack ?? false;
@@ -12318,6 +12451,18 @@ function formatVaultPointer(p) {
   return lines.join("\n");
 }
 var TIMEOUT_MS = 8e3;
+var VAULT_READ_ATTEMPTS = 2;
+async function fetchVaultRead(deps, url, init) {
+  let lastError;
+  for (let attempt = 0; attempt < VAULT_READ_ATTEMPTS; attempt += 1) {
+    try {
+      return await deps.fetch(url, { ...init, signal: AbortSignal.timeout(TIMEOUT_MS) });
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw lastError;
+}
 var repoOf = (slug) => `${OWNER}/${slug}`;
 var RECALL_REGIONS = ["us-east-1", "us-west-2", "eu-central-1", "ap-northeast-1"];
 var PROVIDER_VERIFY_TIMEOUT_MS = 8e3;
@@ -12405,11 +12550,10 @@ async function fetchSecretValue(deps, key, opts) {
   const repo = await targetRepo(deps, opts);
   const slug = opts.slug?.toLowerCase();
   try {
-    const res = await deps.fetch(`${deps.apiUrl}/secrets/get`, {
+    const res = await fetchVaultRead(deps, `${deps.apiUrl}/secrets/get`, {
       method: "POST",
       headers: await deps.headers({ "content-type": "application/json" }),
-      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} }),
-      signal: AbortSignal.timeout(TIMEOUT_MS)
+      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} })
     });
     if (!res.ok) return null;
     const { value } = await res.json();
@@ -12423,10 +12567,9 @@ async function secretsList(deps, opts) {
   const qs = new URLSearchParams({ repo }).toString();
   let res;
   try {
-    res = await deps.fetch(`${deps.apiUrl}/secrets/list?${qs}`, {
+    res = await fetchVaultRead(deps, `${deps.apiUrl}/secrets/list?${qs}`, {
       method: "GET",
-      headers: await deps.headers(),
-      signal: AbortSignal.timeout(TIMEOUT_MS)
+      headers: await deps.headers()
     });
   } catch (e) {
     deps.err(`secrets list: ${e.message}`);
@@ -13478,12 +13621,17 @@ function secretsUseExitCode(result) {
   return void 0;
 }
 async function fetchSecretForUse(deps, { repo, key, slug }) {
-  const res = await deps.fetch(`${deps.apiUrl}/secrets/get`, {
-    method: "POST",
-    headers: await deps.headers({ "content-type": "application/json" }),
-    body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} }),
-    signal: AbortSignal.timeout(TIMEOUT_MS)
-  });
+  let res;
+  try {
+    res = await fetchVaultRead(deps, `${deps.apiUrl}/secrets/get`, {
+      method: "POST",
+      headers: await deps.headers({ "content-type": "application/json" }),
+      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} })
+    });
+  } catch (error) {
+    deps.err(`secrets use: ${error.message}`);
+    return null;
+  }
   if (!res.ok) {
     const body = await readJsonBody(res);
     if (res.status === 404 && body.code === "secret_not_found") {
@@ -14175,7 +14323,7 @@ function buildPluginGuardLine(state, opts = {}) {
   if (state === "healthy" || state === "not-org") return { exitCode: 0 };
   const recovery = opts.recovery ?? "mmi-cli plugin heal";
   const restartHint = opts.restartHint ?? "restart your agent host / reload plugins";
-  const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its marketplace/cache is unresolved";
+  const reason = state === "no-install" ? "MMI plugin is not installed for this user/session" : "MMI plugin is installed but its delivery/cache is unresolved";
   return {
     line: `[mmi-guard] ${reason}; run ${recovery} and ${restartHint}.`,
     exitCode: 1
@@ -14195,6 +14343,9 @@ function detectSurface(env) {
   if (env.MMI_AGENT_SURFACE === "kimi" || has("KIMI_PLUGIN_ROOT") || has("KIMI_CODE_HOME")) {
     return "kimi";
   }
+  if (env.MMI_AGENT_SURFACE === "kilo" || has("KILO") || Object.keys(env).some((k) => /^(?:KILO|KILOCODE)_/.test(k))) {
+    return "kilo";
+  }
   if (env.MMI_AGENT_SURFACE === "cursor" || has("CURSOR_TRACE_ID") || has("CURSOR_USER") || has("CURSOR_SESSION_ID") || env.CURSOR_AGENT === "1" || has("CURSOR_EXTENSION_HOST_ROLE")) {
     return "cursor";
   }
@@ -14214,6 +14365,8 @@ function surfaceToken(surface) {
       return "codex";
     case "kimi":
       return "kimi";
+    case "kilo":
+      return "kilo";
     case "cursor":
       return "cursor";
     case "opencode":
@@ -14231,10 +14384,12 @@ function reloadAction(surface) {
       return "restart Codex";
     case "kimi":
       return "run /reload (or start a new session) in Kimi Code";
+    case "kilo":
+      return "run /reload (or start a new session) in Kilo Code";
     case "opencode":
       return "restart OpenCode";
     case "cursor":
-      return "restart Cursor (or refresh the Team Marketplace from Dashboard \u2192 Settings \u2192 Plugins)";
+      return "reload the Cursor window";
     case "claude-cli":
     case "shell":
     default:
@@ -14243,6 +14398,7 @@ function reloadAction(surface) {
 }
 var CLAUDE_RECOVERY = `claude plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && claude plugin marketplace remove mutmutco && claude plugin marketplace add mutmutco/MMI-Hub --ref main && claude plugin install mmi@mutmutco`;
 var CODEX_RECOVERY = "codex plugin remove mmi@mutmutco && codex plugin marketplace remove mutmutco && codex plugin marketplace add mutmutco/MMI-Hub --ref main && codex plugin add mmi@mutmutco";
+var CURSOR_RECOVERY = "mmi-cli plugin heal   # installs ~/.cursor/plugins/local/mmi from mutmutco/MMI-Hub";
 var PLUGIN_SURFACE_HEAL = {
   claude: {
     delivery: "plugin-cli",
@@ -14268,6 +14424,24 @@ var PLUGIN_SURFACE_HEAL = {
     ],
     fix: (surface) => `${CODEX_RECOVERY}   # then ${reloadAction(surface)} and review /hooks`,
     updateRecipe: [CODEX_RECOVERY]
+  },
+  cursor: {
+    delivery: "local-checkout",
+    recovery: CURSOR_RECOVERY,
+    healSteps: null,
+    fix: (surface) => `${CURSOR_RECOVERY}   # then ${reloadAction(surface)}`,
+    updateRecipe: [CURSOR_RECOVERY]
+  },
+  kilo: {
+    // kilo-p1: no marketplace step — `kilo plugin <npm>` installs + patches the config in one non-interactive
+    // verb. --global writes ~/.config/kilo/opencode.json; the plugin's server() provisions the skills.
+    delivery: "plugin-cli",
+    recovery: "kilo plugin @mutmutco/kilo-plugin --global",
+    healSteps: [
+      { args: ["plugin", "@mutmutco/kilo-plugin", "--global"], gated: true }
+    ],
+    fix: (surface) => `kilo plugin @mutmutco/kilo-plugin --global   # then ${reloadAction(surface)} to load the plugin and its provisioned skills`,
+    updateRecipe: ["kilo plugin @mutmutco/kilo-plugin --global"]
   }
 };
 function nonClaudeSurfaceHealMessage(surface) {
@@ -14277,7 +14451,13 @@ function nonClaudeSurfaceHealMessage(surface) {
   if (surface === "kimi") {
     return "Kimi Code CLI ships an MMI plugin (kimi-k3). Install or repair it from the Kimi TUI with:\n  /plugins install https://github.com/mutmutco/MMI-Hub\n  Then run /reload (plugin hooks start only after a reload), and TRUST the install when prompted.\n  Update the CLI too: npm i -g @mutmutco/cli";
   }
-  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude, Codex, and Kimi only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
+  if (surface === "kilo") {
+    return "Kilo Code ships an MMI plugin (kilo-p1). Install or repair it with:\n  kilo plugin @mutmutco/kilo-plugin --global\n  Then run /reload (or start a new session) \u2014 the plugin\u2019s first run provisions the skills\n  into ~/.kilo, and the deny gates + redactor only load after a reload.\n  Update the CLI too: npm i -g @mutmutco/cli";
+  }
+  if (surface === "cursor") {
+    return "Cursor ships an MMI plugin (#3920). Install or repair its managed local checkout with:\n  mmi-cli plugin heal\n  Then reload the Cursor window. For one-off CLI use, pass --plugin-dir <MMI-Hub checkout>.\n  Update the CLI too: npm i -g @mutmutco/cli";
+  }
+  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude, Codex, Kimi, Cursor, and Kilo only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
 }
 function healStepAborts(step, ok) {
   return !ok && step.gated;
@@ -14319,6 +14499,8 @@ function runHostBin(bin, args, opts) {
 function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os5.homedir)()) {
   if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path16.join)(home, ".codex");
   if (surface === "kimi") return env.KIMI_CODE_HOME?.trim() || (0, import_node_path16.join)(home, ".kimi-code");
+  if (surface === "kilo") return env.KILO_CONFIG_DIR?.trim() || (0, import_node_path16.join)(home, ".config", "kilo");
+  if (surface === "cursor") return (0, import_node_path16.join)(home, ".cursor");
   return (0, import_node_path16.join)(home, ".claude");
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
@@ -14340,6 +14522,8 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
     ];
   }
   if (surface === "kimi") return [];
+  if (surface === "kilo") return [];
+  if (surface === "cursor") return [];
   return [(0, import_node_path16.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
 function marketplaceClonePresent(surface, home, exists = import_node_fs18.existsSync, env = process.env) {
@@ -14349,11 +14533,13 @@ function runHostBinSync(bin, args) {
   return isWin ? (0, import_node_child_process7.execFileSync)("cmd.exe", ["/c", bin, ...args], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
-    timeout: 15e3
+    timeout: 15e3,
+    windowsHide: true
   }) : (0, import_node_child_process7.execFileSync)(bin, args, {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
-    timeout: 15e3
+    timeout: 15e3,
+    windowsHide: true
   });
 }
 function codexPluginStatus() {
@@ -14417,32 +14603,75 @@ async function fetchNpmReleasedVersion() {
   }
 }
 var NPM_INSTALL_TIMEOUT_MS = 12e4;
-async function npmSelfUpdateCli(target) {
+async function npmSelfUpdateCli(target, onStep) {
   const command = cliUpdateCommand(target);
   try {
+    onStep?.(command);
     await runHostBin("npm", ["install", "-g", `@mutmutco/cli@${target ?? "latest"}`], { timeout: NPM_INSTALL_TIMEOUT_MS });
     return { ok: true, detail: `${command} exited 0` };
   } catch (e) {
     return { ok: false, detail: e.message.trim().slice(0, 200).replace(/\s+/g, " ") };
   }
 }
+function kiloConfigListsPlugin(configRoot, home = (0, import_node_os5.homedir)(), read = (p) => (0, import_node_fs18.readFileSync)(p, "utf8"), exists = import_node_fs18.existsSync) {
+  const candidates = ["kilo.json", "kilo.jsonc", "opencode.json", "opencode.jsonc", "config.json"];
+  for (const dir of [configRoot, (0, import_node_path16.join)(home, ".kilo")]) {
+    for (const file of candidates) {
+      const path2 = (0, import_node_path16.join)(dir, file);
+      if (!exists(path2)) continue;
+      try {
+        const stripped = read(path2).replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
+        const parsed = JSON.parse(stripped);
+        const plugins = Array.isArray(parsed?.plugin) ? parsed.plugin : [];
+        if (plugins.some((p) => {
+          const spec = String(Array.isArray(p) ? p[0] : p);
+          return spec.includes("@mutmutco/kilo-plugin") || spec.includes(".kilo-plugin");
+        })) return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function cursorLocalPluginRoot(env = process.env, home = (0, import_node_os5.homedir)()) {
+  return (0, import_node_path16.join)(surfaceConfigRoot("cursor", env, home), "plugins", "local", "mmi");
+}
+function cursorPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
+  return [
+    ".cursor-plugin/plugin.json",
+    "skills/mmi/SKILL.md",
+    "hooks/cursor-hooks.json",
+    "scripts/hook-run.mjs",
+    "scripts/hook-policy.mjs"
+  ].every((path2) => exists((0, import_node_path16.join)(root, ...path2.split("/"))));
+}
+function kimiPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
+  return [
+    ".kimi-plugin/plugin.json",
+    "skills/mmi/SKILL.md",
+    "scripts/hook-run.mjs"
+  ].every((path2) => exists((0, import_node_path16.join)(root, ...path2.split("/"))));
+}
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
   const root = surfaceConfigRoot(surface);
   const installed = readInstalledPlugins(surface);
   const codexStatus = surface === "codex" ? codexPluginStatus() : void 0;
   return {
     isOrgRepo,
-    installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os5.homedir)()),
+    installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // Kimi's managed plugin directory is its native install record; it has no Claude-style ledger.
+    surface === "kimi" && (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) || // kilo-p1: the install record is the config file itself.
+    surface === "kilo" && kiloConfigListsPlugin(root) || surface === "cursor" && (0, import_node_fs18.existsSync)(cursorLocalPluginRoot()),
+    // Kilo has no marketplace to clone — the config file IS the install record, so this dimension of
+    // the shared guard table is vacuously satisfied.
+    marketplaceClonePresent: surface === "kimi" || surface === "kilo" || surface === "cursor" ? true : marketplaceClonePresent(surface, (0, import_node_os5.homedir)()),
     // Kimi keeps no plugin cache dir — installs are copied to plugins/managed/<id> and run from there.
-    pluginCachePresent: surface === "kimi" ? (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) : surface === "codex" ? Boolean(
+    // Kilo (kilo-p1) keeps no cache dir either: the plugin's server() provisions ~/.kilo behind the
+    // version stamp, so the stamp's presence is the cache signal.
+    pluginCachePresent: surface === "kilo" ? (0, import_node_fs18.existsSync)((0, import_node_path16.join)((0, import_node_os5.homedir)(), ".kilo", ".mmi-kilo-version")) : surface === "kimi" ? kimiPluginTreeHealthy((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) : surface === "cursor" ? cursorPluginTreeHealthy(cursorLocalPluginRoot()) : surface === "codex" ? Boolean(
       codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
     ) : (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
-function activePluginGuardState(isOrgRepo) {
-  return buildPluginGuardDecision(snapshotPluginGuardInput(detectSurface(process.env), isOrgRepo)).state;
-}
 async function runClaudePlugin(args) {
   try {
     await runHostBin("claude", args, { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
@@ -14459,6 +14688,98 @@ async function runCodexPlugin(args) {
     return false;
   }
 }
+async function runKiloPlugin(args) {
+  try {
+    await runHostBin("kilo", args, { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function captureCodexHookLauncher() {
+  const status = codexPluginStatus();
+  if (!status.installed || !status.enabled || !status.version) return void 0;
+  const root = (0, import_node_path16.join)(surfaceConfigRoot("codex"), "plugins", "cache", CODEX_MARKETPLACE, "mmi", status.version);
+  const files = ["mmi-hook", "mmi-hook.exe"].flatMap((name) => {
+    const path2 = (0, import_node_path16.join)(root, "bin", name);
+    try {
+      return [{ name, content: (0, import_node_fs18.readFileSync)(path2) }];
+    } catch {
+      return [];
+    }
+  });
+  return files.length === 2 ? { root, files } : void 0;
+}
+function restoreCodexHookLauncher(snapshot) {
+  if (!snapshot || (0, import_node_fs18.existsSync)((0, import_node_path16.join)(snapshot.root, "scripts", "hook-run.mjs"))) return false;
+  const bin = (0, import_node_path16.join)(snapshot.root, "bin");
+  (0, import_node_fs18.mkdirSync)(bin, { recursive: true });
+  for (const file of snapshot.files) {
+    const path2 = (0, import_node_path16.join)(bin, file.name);
+    (0, import_node_fs18.writeFileSync)(path2, file.content);
+    if (file.name === "mmi-hook") (0, import_node_fs18.chmodSync)(path2, 493);
+  }
+  return true;
+}
+function canonicalCursorRemote(remote) {
+  return /^(?:https?:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:|github\.com[:/])mutmutco\/MMI-Hub(?:\.git)?\/?$/i.test(remote.trim().replace(/\\/g, "/"));
+}
+async function installCursorPluginCheckout(env = process.env) {
+  const configRoot = surfaceConfigRoot("cursor", env);
+  const pluginsRoot = (0, import_node_path16.join)(configRoot, "plugins");
+  const target = (0, import_node_path16.join)(pluginsRoot, "local", "mmi");
+  const source = env.MMI_CURSOR_PLUGIN_SOURCE?.trim();
+  if ((0, import_node_fs18.existsSync)(target) && !source) {
+    try {
+      const { stdout } = await runHostBin("git", ["-C", target, "remote", "get-url", "origin"], { timeout: 15e3 });
+      if (!canonicalCursorRemote(stdout)) {
+        return { ok: false, detail: `refused to replace unrelated Cursor plugin directory at ${target}` };
+      }
+    } catch {
+      return { ok: false, detail: `refused to replace unmanaged Cursor plugin directory at ${target}` };
+    }
+  }
+  (0, import_node_fs18.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "local"), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "staging"), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "quarantine"), { recursive: true });
+  const suffix = `${Date.now()}-${process.pid}`;
+  const staged = (0, import_node_path16.join)(pluginsRoot, "staging", `mmi-${suffix}`);
+  const quarantined = (0, import_node_path16.join)(pluginsRoot, "quarantine", `mmi-${suffix}`);
+  try {
+    if (source) {
+      (0, import_node_fs18.cpSync)(source, staged, {
+        recursive: true,
+        filter: (path2) => !path2.split(/[\\/]/).some((part) => part === ".git" || part === "node_modules")
+      });
+    } else {
+      await runHostBin("gh", ["repo", "clone", "mutmutco/MMI-Hub", staged, "--", "--branch", "main", "--depth", "1"], {
+        timeout: CLAUDE_PLUGIN_TIMEOUT_MS
+      });
+    }
+    if (!cursorPluginTreeHealthy(staged)) {
+      (0, import_node_fs18.rmSync)(staged, { recursive: true, force: true });
+      return { ok: false, detail: "downloaded Cursor plugin is incomplete; existing install was preserved" };
+    }
+    let movedOld = false;
+    if ((0, import_node_fs18.existsSync)(target)) {
+      (0, import_node_fs18.renameSync)(target, quarantined);
+      movedOld = true;
+    }
+    try {
+      (0, import_node_fs18.renameSync)(staged, target);
+    } catch (error) {
+      if (movedOld && !(0, import_node_fs18.existsSync)(target)) (0, import_node_fs18.renameSync)(quarantined, target);
+      throw error;
+    }
+    return {
+      ok: true,
+      detail: movedOld ? `installed canonical Cursor plugin; previous checkout quarantined at ${quarantined}` : `installed canonical Cursor plugin at ${target}`
+    };
+  } catch (error) {
+    if ((0, import_node_fs18.existsSync)(staged)) (0, import_node_fs18.rmSync)(staged, { recursive: true, force: true });
+    return { ok: false, detail: error.message.trim().slice(0, 240).replace(/\s+/g, " ") };
+  }
+}
 async function marketplaceAddRefSupported(bin) {
   try {
     const { stdout, stderr } = await runHostBin(bin, ["plugin", "marketplace", "add", "--help"], {
@@ -14486,49 +14807,79 @@ function pluginReadGrantNote(login = "<your-github-login>") {
 }
 async function applyPluginHeal(surface, log, opts) {
   const token = surfaceToken(surface);
-  if (token !== "claude" && token !== "codex") return false;
-  if (!opts?.force && !PLUGIN_SURFACE_HEAL[token]) return false;
+  if (token !== "claude" && token !== "codex" && token !== "kilo") return false;
   const descriptor = PLUGIN_SURFACE_HEAL[token];
+  if (!descriptor || !descriptor.healSteps) return false;
+  if (token === "kilo") {
+    log("  \u21BB reinstalling the MMI plugin via `kilo plugin` (install \u2192 server() provisions the skills)\u2026");
+    for (const step of descriptor.healSteps) {
+      const ok = await runKiloPlugin([...step.args]);
+      if (healStepAborts(step, ok)) return false;
+    }
+    return true;
+  }
   const tableSteps = descriptor.healSteps;
   if (!tableSteps) return false;
+  const loadedCodexLauncher = token === "codex" ? captureCodexHookLauncher() : void 0;
   const bin = token;
   const refSupported = await marketplaceAddRefSupported(bin);
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   log(healBannerLine(bin, token, refSupported));
   const pinsPath = (0, import_node_path16.join)((0, import_node_os5.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = token === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
-  for (const step of steps) {
-    const ok = token === "claude" ? await runClaudePlugin([...step.args]) : await runCodexPlugin([...step.args]);
-    if (healStepAborts(step, ok)) return false;
+  try {
+    for (const step of steps) {
+      const ok = token === "claude" ? await runClaudePlugin([...step.args]) : await runCodexPlugin([...step.args]);
+      if (healStepAborts(step, ok)) return false;
+    }
+  } finally {
+    if (restoreCodexHookLauncher(loadedCodexLauncher)) {
+      log("  retained the windowless Codex hook bridge for the loaded session; restart removes its need");
+    }
   }
   const restored = token === "claude" ? restoreMarketplacePinsOnDisk(pinsPath, pins) : void 0;
   if (restored) log(`  ${restored}`);
   return true;
 }
-async function healClaudePluginForDoctor(surface = detectSurface(process.env)) {
+async function healClaudePluginForDoctor(surface = detectSurface(process.env), onStep) {
   if (surfaceToken(surface) !== "claude") {
     return { ok: false, detail: `not a Claude surface (${surface}) \u2014 no Hub-shipped plugin to reinstall` };
   }
   const steps = [];
-  const ok = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const ok = await applyPluginHeal(surface, (msg) => {
+    const line = msg.trim();
+    steps.push(line);
+    if (line) onStep?.(line);
+  });
   const pinNote = steps.find((s) => s.startsWith("re-pinned ") || s.includes("re-pin by hand"));
   return {
     ok,
     detail: ok ? `marketplace remove \u2192 add \u2192 install succeeded${pinNote ? `; ${pinNote}` : ""}` : `\`claude plugin\` reinstall failed or was skipped${steps.length ? ` (${steps[steps.length - 1]})` : ""}`
   };
 }
-async function healActivePluginForDoctor(surface = detectSurface(process.env)) {
+async function healActivePluginForDoctor(surface = detectSurface(process.env), onStep) {
   const token = surfaceToken(surface);
-  if (token !== "claude" && token !== "codex") {
+  if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "kilo") {
     return { ok: false, detail: `not a supported plugin surface (${surface})` };
   }
-  if (token === "claude") return healClaudePluginForDoctor(surface);
+  if (token === "claude") return healClaudePluginForDoctor(surface, onStep);
+  if (token === "cursor") return installCursorPluginCheckout();
   const steps = [];
-  const applied = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const applied = await applyPluginHeal(surface, (msg) => {
+    const line = msg.trim();
+    steps.push(line);
+    if (line) onStep?.(line);
+  });
   const snapshot = applied ? snapshotPluginGuardInput(surface, true) : void 0;
   const guardState = snapshot ? buildPluginGuardDecision(snapshot).state : "unresolved";
   const ok = applied && guardState === "healthy";
   const verification = snapshot ? `record=${snapshot.installRecordPresent ? "yes" : "no"}, marketplace=${snapshot.marketplaceClonePresent ? "yes" : "no"}, enabled-cache=${snapshot.pluginCachePresent ? "yes" : "no"}` : "reinstall steps did not complete";
+  if (token === "kilo") {
+    return {
+      ok,
+      detail: ok ? `kilo plugin install succeeded; full guard verified (${verification})` : `\`kilo plugin\` reinstall failed full-guard verification (${verification})${steps.length ? `; ${steps[steps.length - 1]}` : ""}`
+    };
+  }
   return {
     ok,
     detail: ok ? `marketplace remove \u2192 add --ref main \u2192 plugin add succeeded; full guard verified (${verification})` : `\`codex plugin\` reinstall failed full-guard verification (${verification})${steps.length ? `; ${steps[steps.length - 1]}` : ""}`
@@ -14562,14 +14913,14 @@ async function runGuard(readOrigin) {
   const surface = detectSurface(process.env);
   try {
     const token = surfaceToken(surface);
-    if (token !== "claude" && token !== "codex") {
+    if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "kilo") {
       process.exitCode = 0;
       return;
     }
     const isOrgRepo = readOrigin ? await isOrgRepoRoot(readOrigin) : await isOrgRepoRoot();
     const input = snapshotPluginGuardInput(surface, isOrgRepo);
     const { state } = buildPluginGuardDecision(input);
-    const { line, exitCode } = buildPluginGuardLine(state);
+    const { line, exitCode } = buildPluginGuardLine(state, { restartHint: reloadAction(surface) });
     if (line) console.error(line);
     if (token === "codex" && exitCode === 0) {
       const trust = codexHookTrustState();
@@ -14582,6 +14933,10 @@ async function runGuard(readOrigin) {
     if (surfaceToken(surface) === "codex") {
       console.error("[mmi-guard] Could not inspect the active Codex plugin; run `mmi-cli plugin heal`.");
       process.exitCode = 1;
+    } else if (surfaceToken(surface) === "kilo" || surfaceToken(surface) === "cursor") {
+      const host = surfaceToken(surface) === "cursor" ? "Cursor" : "Kilo";
+      console.error(`[mmi-guard] Could not inspect the active ${host} plugin; run \`mmi-cli plugin heal\`.`);
+      process.exitCode = 1;
     } else {
       process.exitCode = 0;
     }
@@ -14589,21 +14944,24 @@ async function runGuard(readOrigin) {
 }
 async function runPluginHeal(surface = detectSurface(process.env)) {
   const token = surfaceToken(surface);
-  if (token !== "claude" && token !== "codex") {
+  if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "kilo") {
     console.log(nonClaudeSurfaceHealMessage(token ?? void 0));
     return;
   }
   const descriptor = PLUGIN_SURFACE_HEAL[token];
-  const applied = await applyPluginHeal(surface, console.log, { force: true });
-  const healed = token === "codex" ? applied && buildPluginGuardDecision(snapshotPluginGuardInput(surface, true)).state === "healthy" : applied;
+  const cursorResult = token === "cursor" ? await installCursorPluginCheckout() : void 0;
+  if (cursorResult) console.log(`  \u21BB ${cursorResult.detail}`);
+  const applied = cursorResult ? cursorResult.ok : await applyPluginHeal(surface, console.log, { force: true });
+  const healed = token !== "claude" ? applied && buildPluginGuardDecision(snapshotPluginGuardInput(surface, true)).state === "healthy" : applied;
   if (healed) {
     const trust = token === "codex" ? " Then run /hooks and review + trust the MMI hooks." : "";
-    console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI commands.${trust}`);
+    const reload = token === "kilo" ? " The plugin provisions the skills on first load." : "";
+    console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI skills and commands.${trust}${reload}`);
   } else {
     process.exitCode = 1;
-    const refSupported = await marketplaceAddRefSupported(token);
-    const recovery = refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
-    const note = refAbsenceNote(token, refSupported);
+    const refSupported = token === "kilo" || token === "cursor" ? false : await marketplaceAddRefSupported(token);
+    const recovery = token === "kilo" || token === "cursor" ? descriptor.recovery : refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
+    const note = token === "kilo" || token === "cursor" ? "" : refAbsenceNote(token, refSupported);
     console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
   ${recovery}${note}${pluginReadGrantNote()}`);
   }
@@ -16126,12 +16484,20 @@ function resolveIssueBody(input, deps) {
     noun: "body"
   });
 }
-function resolveIssueTitle(input, deps) {
-  return resolveTextArg({ value: input.title, file: input.titleFile }, deps, {
+async function resolveIssueTitle(input, deps) {
+  const title = await resolveTextArg({ value: input.title, file: input.titleFile }, deps, {
     value: "--title",
     file: "--title-file",
     noun: "title"
   });
+  const normalized = title.replace(/(?:\r\n|\n|\r)$/, "");
+  if (!normalized.trim()) {
+    throw new TextArgError("--title produced an empty title", ERROR_CODES.ERR_EMPTY_INPUT, "--title");
+  }
+  if (/[\r\n]/.test(normalized)) {
+    throw new TextArgError("--title must be one line; internal line breaks are not allowed", ERROR_CODES.ERR_INVALID_INPUT, "--title");
+  }
+  return normalized;
 }
 
 // src/issue-view-json.ts
@@ -16219,6 +16585,40 @@ var PATH_OVERRIDES = {
   "secrets grant": { category: "admin", discovery: "all-only", help_group: "Operations" },
   "secrets revoke": { category: "admin", discovery: "all-only", help_group: "Operations" }
 };
+var COMMAND_OWNERSHIP = {
+  onboard: { module_owner: "cli/src/discovery-commands.ts", consumer: "agent-session" },
+  status: { module_owner: "cli/src/discovery-commands.ts", consumer: "agent-session" },
+  next: { module_owner: "cli/src/discovery-commands.ts", consumer: "agent-session" },
+  doctor: { module_owner: "cli/src/doctor-clean.ts", consumer: "agent-session" },
+  whoami: { module_owner: "cli/src/whoami.ts", consumer: "agent-session" },
+  commands: { module_owner: "cli/src/command-manifest.ts", consumer: "agent-session" },
+  explain: { module_owner: "cli/src/explain-command.ts", consumer: "agent-session" },
+  board: { module_owner: "cli/src/board-commands.ts", consumer: "agent-workflow" },
+  issue: { module_owner: "cli/src/issue-commands.ts", consumer: "agent-workflow" },
+  worktree: { module_owner: "cli/src/worktree-lifecycle-commands.ts", consumer: "agent-workflow" },
+  stage: { module_owner: "cli/src/stage-commands.ts", consumer: "agent-workflow" },
+  pr: { module_owner: "cli/src/pr-commands.ts", consumer: "agent-workflow" },
+  ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
+  rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
+  release: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
+  hotfix: { module_owner: "cli/src/hotfix-apply.ts", consumer: "release-operator" },
+  train: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
+  bootstrap: { module_owner: "cli/src/bootstrap-commands.ts", consumer: "repo-bootstrap" },
+  secrets: { module_owner: "cli/src/secrets-commands.ts", consumer: "authenticated-operator" },
+  docs: { module_owner: "cli/src/docs-index-command.ts", consumer: "repo-gates" },
+  tests: { module_owner: "cli/src/test-policy-core.ts", consumer: "repo-gates" },
+  wave: { module_owner: "cli/src/wave-land.ts", consumer: "campaign-orchestrator" },
+  report: { module_owner: "cli/src/report.ts", consumer: "campaign-orchestrator" },
+  "skill-lesson": { module_owner: "cli/src/skill-lesson.ts", consumer: "campaign-orchestrator" },
+  org: { module_owner: "cli/src/command-consolidation.ts", consumer: "org-operator" },
+  runtime: { module_owner: "cli/src/command-consolidation.ts", consumer: "runtime-operator" },
+  plugin: { module_owner: "cli/src/plugin-guard-io.ts", consumer: "host-runtime" }
+};
+function commandOwnership(name) {
+  const ownership = COMMAND_OWNERSHIP[name];
+  if (!ownership) throw new Error(`command taxonomy: root "${name}" has no module owner or consumer`);
+  return ownership;
+}
 var DEFAULT_ADMIN_MARKER = "(master-only)";
 var ADMIN_MARKERS = {
   "secrets org-catalog": "(writes master-only)"
@@ -16233,7 +16633,8 @@ function primaryMetadata(name) {
       return {
         category: SUPPORT_PRIMARY.has(name) ? "support" : "core",
         discovery: "primary",
-        help_group: helpGroup
+        help_group: helpGroup,
+        ...commandOwnership(name)
       };
     }
   }
@@ -16248,7 +16649,8 @@ function topLevelMetadata(name) {
   return {
     category: name === "plugin" ? "internal" : "admin",
     discovery: "all-only",
-    help_group: "Operations"
+    help_group: "Operations",
+    ...commandOwnership(name)
   };
 }
 function setCommandMetadata(command, metadata) {
@@ -16265,7 +16667,7 @@ var REQUIRED_OPTION_HELP = {
 };
 function classifyTree(command, path2, inherited, hideFromParent) {
   const override = PATH_OVERRIDES[path2];
-  const metadata = override ?? inherited;
+  const metadata = override ? { ...inherited, ...override } : inherited;
   setCommandMetadata(command, metadata);
   const hideByOverride = override !== void 0 && metadata.discovery === "hidden";
   if ((hideByOverride || hideFromParent) && metadata.discovery !== "primary") {
@@ -16401,7 +16803,9 @@ function buildCommand(cmd, path2) {
   const metadata = commandMetadata(cmd) ?? {
     category: "core",
     discovery: "primary",
-    help_group: "Plan and work"
+    help_group: "Plan and work",
+    module_owner: "unclassified",
+    consumer: "unclassified"
   };
   const out = {
     name: cmd.name(),
@@ -20960,7 +21364,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
         name: e.name,
         executor: e.executor,
         detail: "armed with no SCHEDULE# row",
-        remedy: 'add the eight-field header (docs/schedules.md "The entry template") and re-run the schedules lift so it registers a SCHEDULE# row'
+        remedy: 'add the eight-field header (docs/schedules.md "The entry template") and re-run schedules register so it creates a SCHEDULE# row'
       });
     }
   }
@@ -20973,7 +21377,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
           name: r.id,
           executor: r.executor || live.executor,
           detail: `live cadence \`${live.cadence}\` disagrees with registered \`${r.cadence}\``,
-          remedy: "re-run the schedules lift to refresh the SCHEDULE# row from the current header/cron"
+          remedy: "re-run schedules register to refresh the SCHEDULE# row from the current header/cron"
         });
       }
       continue;
@@ -20985,7 +21389,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
         name: r.id,
         executor: r.executor || "github-actions",
         detail: "registered with no workflow file behind it",
-        remedy: `restore the workflow in ${r.repo} (or, if it was retired on purpose, re-run the schedules lift so the replace prunes the stale SCHEDULE# row)`
+        remedy: `restore the workflow in ${r.repo} (or, if it was retired on purpose, re-run schedules register so the replace prunes the stale SCHEDULE# row)`
       });
     }
   }
@@ -21433,27 +21837,27 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const expectedId = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
-    throw new Error(`schedules lift: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
+    throw new Error(`schedules register: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
   }
   const h = header;
   if (h.schedule !== expectedId) {
-    throw new Error(`schedules lift: ${workflowPath} header \`schedule: ${h.schedule}\` must equal the join key \`${expectedId}\` (<repo>/<workflow-basename>).`);
+    throw new Error(`schedules register: ${workflowPath} header \`schedule: ${h.schedule}\` must equal the join key \`${expectedId}\` (<repo>/<workflow-basename>).`);
   }
   for (const cron of crons) {
     if (!cadenceContainsCron(h.cadence, cron)) {
-      throw new Error(`schedules lift: ${expectedId} cadence \`${h.cadence}\` does not contain the workflow cron \`${cron}\` (whole-token comparison) \u2014 the declared cadence disagrees with the actual schedule.`);
+      throw new Error(`schedules register: ${expectedId} cadence \`${h.cadence}\` does not contain the workflow cron \`${cron}\` (whole-token comparison) \u2014 the declared cadence disagrees with the actual schedule.`);
     }
   }
   if (llmFromHeader(yamlText) === "unknown") {
-    throw new Error(`schedules lift: ${expectedId} header \`llm: ${h.llm}\` does not classify (yes / no / embeddings) \u2014 an unreadable declaration would register a row whose LLM column lies.`);
+    throw new Error(`schedules register: ${expectedId} header \`llm: ${h.llm}\` does not classify (yes / no / embeddings) \u2014 an unreadable declaration would register a row whose LLM column lies.`);
   }
   const target = header.target;
   if (target !== void 0 && !/^mmi-fleet-[A-Za-z0-9_-]{1,130}$/.test(target)) {
-    throw new Error(`schedules lift: ${expectedId} header \`target: ${target}\` must be a bare lambda function name in the reserved fleet namespace \`mmi-fleet-*\` (allowed after the prefix: A-Z a-z 0-9 _ -; total max 140). The dispatcher can only invoke mmi-fleet-* functions.`);
+    throw new Error(`schedules register: ${expectedId} header \`target: ${target}\` must be a bare lambda function name in the reserved fleet namespace \`mmi-fleet-*\` (allowed after the prefix: A-Z a-z 0-9 _ -; total max 140). The dispatcher can only invoke mmi-fleet-* functions.`);
   }
   const model = header.model;
   if (model !== void 0 && !/^[a-z][a-z0-9-]{0,30}$/.test(model)) {
-    throw new Error(`schedules lift: ${expectedId} header \`model: ${model}\` must be a model ROLE KEY (lowercase kebab, max 31 chars \u2014 e.g. janitor, arbiter), never a model id \u2014 ids resolve from the vault at dispatch.`);
+    throw new Error(`schedules register: ${expectedId} header \`model: ${model}\` must be a model ROLE KEY (lowercase kebab, max 31 chars \u2014 e.g. janitor, arbiter), never a model id \u2014 ids resolve from the vault at dispatch.`);
   }
   return {
     id: expectedId,
@@ -21478,7 +21882,7 @@ function scheduleRecordsFromWorkflows(repo, files) {
     const rec = scheduleRecordFromWorkflow(repo, path2, text);
     if (!rec) continue;
     if (seen.has(rec.id)) {
-      throw new Error(`schedules lift: duplicate schedule id \`${rec.id}\` \u2014 two workflow files in ${repo} share one join key (${rec.sourcePath}).`);
+      throw new Error(`schedules register: duplicate schedule id \`${rec.id}\` \u2014 two workflow files in ${repo} share one join key (${rec.sourcePath}).`);
     }
     seen.add(rec.id);
     records.push(rec);
@@ -21530,16 +21934,16 @@ async function runSchedulesLift(opts, deps = {}) {
     const url = await (deps.originUrl ?? (() => gitOut(["remote", "get-url", "origin"])))();
     repo = repoNameFromRemoteUrl(url) ?? void 0;
     if (!repo) {
-      throw new Error("schedules lift: could not resolve the repo name from the origin remote \u2014 pass --repo <name>.");
+      throw new Error("schedules register: could not resolve the repo name from the origin remote \u2014 pass --repo <name>.");
     }
   }
   if (!SCHEDULE_REPO_RE.test(repo)) {
-    throw new SchedulesLiftUsageError(`schedules lift: repo \`${repo}\` is not a bare repo segment (allowed: A-Z a-z 0-9 _ . -; no \`/\` or \`#\`) \u2014 the schedule id is <repo>/<name>, so a separator would form an invalid multi-segment id.`);
+    throw new SchedulesLiftUsageError(`schedules register: repo \`${repo}\` is not a bare repo segment (allowed: A-Z a-z 0-9 _ . -; no \`/\` or \`#\`) \u2014 the schedule id is <repo>/<name>, so a separator would form an invalid multi-segment id.`);
   }
   const dir = opts.dir ?? DEFAULT_WORKFLOWS_DIR;
   const files = await (deps.readFiles ?? readWorkflowFiles)(dir);
   if (!files.length) {
-    throw new Error(`schedules lift: no workflow files under ${dir} \u2014 refusing to post an empty lift (the route prunes; run from the repo checkout or pass --dir).`);
+    throw new Error(`schedules register: no workflow files under ${dir} \u2014 refusing to post an empty registration (the route prunes; run from the repo checkout or pass --dir).`);
   }
   const records = scheduleRecordsFromWorkflows(repo, files);
   const payload = { repo, schedules: records };
@@ -21548,11 +21952,11 @@ async function runSchedulesLift(opts, deps = {}) {
   if (!response.ok) {
     const unreachable = response.unreachable ?? (response.status === 404 ? "route-absent" : void 0);
     if (unreachable) {
-      throw new RegistryUnreachableError(`schedules lift: registry unreachable (${unreachable}) \u2014 ${response.error ?? `HTTP ${response.status}`}`);
+      throw new RegistryUnreachableError(`schedules register: registry unreachable (${unreachable}) \u2014 ${response.error ?? `HTTP ${response.status}`}`);
     }
-    if (response.error) throw new Error(`schedules lift: ${response.error}`);
+    if (response.error) throw new Error(`schedules register: ${response.error}`);
     const detail = response.body?.error ?? "";
-    throw new Error(`schedules lift: HTTP ${response.status}${detail ? ` \u2014 ${detail}` : ""}`);
+    throw new Error(`schedules register: HTTP ${response.status}${detail ? ` \u2014 ${detail}` : ""}`);
   }
   return { repo, records, payload, response };
 }
@@ -21573,8 +21977,8 @@ function withArmingReport(body) {
 }
 function registerSchedulesLiftCommand(program3, deps = {}) {
   const schedules = program3.commands.find((c) => c.name() === "schedules");
-  if (!schedules) throw new Error("schedules lift: registerSchedulesCommands must run first \u2014 the lift attaches to the `schedules` command");
-  jsonParity(schedules.command("register").alias("lift").description(`register this repo's eight-field workflow headers as SCHEDULE# registry rows (C2, #3186; renamed from \`lift\`, #3219) \u2014 a per-repo replace; aborts the whole registration on any header violation; exits 75 when the registry is unreachable (#3187). Registering does NOT arm the clock: the fleet-clock reconciler arms the rows within ${FLEET_CLOCK_RECONCILE_WINDOW}, and the success JSON carries an \`arming\` block saying so (#3281)`).option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to lift (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write")).action(async (o) => {
+  if (!schedules) throw new Error("schedules register: registerSchedulesCommands must run first \u2014 register attaches to the `schedules` command");
+  jsonParity(schedules.command("register").description(`register this repo's eight-field workflow headers as SCHEDULE# registry rows (C2, #3186; renamed from \`lift\`, #3219) \u2014 a per-repo replace; aborts the whole registration on any header violation; exits 75 when the registry is unreachable (#3187). Registering does NOT arm the clock: the fleet-clock reconciler arms the rows within ${FLEET_CLOCK_RECONCILE_WINDOW}, and the success JSON carries an \`arming\` block saying so (#3281)`).option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to register (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write")).action(async (o) => {
     try {
       const result = await runSchedulesLift({ repo: o.repo, dir: o.dir, dryRun: Boolean(o.dryRun) }, deps);
       if (o.dryRun) {
@@ -23624,7 +24028,7 @@ function registerBoardCommands(program3) {
     "Claim already assigns and moves Status to In Progress, so do not also board move it.",
     "Multiple refs are handled as a batch and return per-item results."
   ]);
-  board.command("show <issue>").alias("open").description("print one board item (status, assignees, type, url) with its body and comments").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return the item even if its body/comments fetch fails").action(async (issueRef, o) => {
+  board.command("show <issue>").description("print one board item (status, assignees, type, url) with its body and comments").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return the item even if its body/comments fetch fails").action(async (issueRef, o) => {
     try {
       const item = await showBoardItem({ config: await loadConfigForBoardSelector2(issueRef, o.repo), selector: issueRef, repo: o.repo, allowPartial: o.allowPartial });
       console.log(o.json ? JSON.stringify(item) : renderBoardItem(item));
@@ -26954,21 +27358,790 @@ function renderTally(checks) {
   const healthy = total - checks.filter((c) => !c.ok).length;
   return healthy === total ? `\u2713 all ${total} checks healthy` : `\u2713 ${healthy} of ${total} checks healthy`;
 }
-function renderDoctorText(checks, opts) {
-  const lines = [];
-  const shown = opts.verbose ? checks : checks.filter((c) => !c.ok || c.warn);
-  for (const check of shown) {
-    lines.push(renderCheckLine(check));
-    if (opts.verbose) {
-      for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
+function doctorReportExitCode(checks) {
+  return checks.some((c) => !c.ok && !c.reportOnly) ? 1 : 0;
+}
+
+// ../surfaces.json
+var surfaces_default = {
+  _comment: "Hub-owned agent/developer contract. sharedAgentCore owns policy and capability sources once; agentSurfaces contains only host delivery differences; surfaces inventories and assembles the outward artifacts those adapters reference. See docs/surfaces.schema.json (v7) and docs/surface-delivery-template.md.",
+  schemaVersion: 7,
+  productScope: "agentic-coding",
+  sharedAgentCore: {
+    skills: {
+      ownerPath: "skills",
+      sourceSurfaceId: "mmi-skills"
+    },
+    cli: {
+      ownerPath: "cli",
+      surfaceId: "mmi-cli"
+    },
+    hookPolicy: {
+      launcherPath: "bin/mmi-hook",
+      ownerPath: "scripts/hook-policy.mjs",
+      runnerPath: "scripts/hook-run.mjs",
+      sourceSurfaceId: "mmi-hook-policy",
+      version: 1,
+      windowsLauncherPath: "bin/mmi-hook.exe"
+    },
+    releaseMetadata: {
+      ownerPath: "surfaces.json",
+      bomPath: "distribution-bom.json"
     }
+  },
+  agentSurfaces: [
+    {
+      token: "claude",
+      displayName: "Claude Code",
+      lifecycle: "active",
+      artifactIds: ["mmi-claude-plugin", "mmi-claude-marketplace", "mmi-skills", "mmi-hook-policy", "mmi-hooks", "mmi-cli"],
+      plannedArtifactIds: [],
+      assembly: {
+        mode: "source-tree",
+        rootPath: ".",
+        sync: []
+      },
+      install: {
+        mechanism: "marketplace",
+        locator: "mmi@mutmutco"
+      },
+      upgrade: {
+        mechanism: "reinstall",
+        reload: "session"
+      },
+      skills: {
+        delivery: "plugin",
+        sourceSurfaceId: "mmi-skills",
+        artifactId: "mmi-skills",
+        invocation: {
+          entry: "/mmi:mmi",
+          any: "/mmi:<skill>"
+        }
+      },
+      hooks: {
+        adapterPath: "hooks/hooks.json",
+        sourceSurfaceId: "mmi-hook-policy",
+        gates: [
+          { id: "command-ladder", failure: "closed" },
+          { id: "vault-edit", failure: "closed" },
+          { id: "secret-output", failure: "open" }
+        ],
+        probe: "installed-contract",
+        execution: "command",
+        preToolUse: "enforced",
+        postToolOutput: "rewrite",
+        finalOutput: "unsupported"
+      },
+      cli: {
+        delivery: "bundled",
+        artifactId: "mmi-cli"
+      },
+      ownership: {
+        trust: "host",
+        cache: "host",
+        repair: "mmi-cli"
+      },
+      certification: {
+        hostCommand: "claude",
+        versionArgs: ["--version"]
+      },
+      enforcementCeilings: [
+        "Final assistant text cannot be rewritten by the hook surface.",
+        "Disabled or untrusted hooks enforce nothing."
+      ]
+    },
+    {
+      token: "codex",
+      displayName: "Codex",
+      lifecycle: "active",
+      artifactIds: ["mmi-codex-plugin", "mmi-skills", "mmi-hook-policy", "mmi-cli"],
+      plannedArtifactIds: [],
+      assembly: {
+        mode: "source-tree",
+        rootPath: ".",
+        sync: []
+      },
+      install: {
+        mechanism: "marketplace",
+        locator: "mmi@mutmutco"
+      },
+      upgrade: {
+        mechanism: "marketplace-upgrade",
+        reload: "session"
+      },
+      skills: {
+        delivery: "plugin",
+        sourceSurfaceId: "mmi-skills",
+        artifactId: "mmi-skills",
+        invocation: {
+          entry: "$mmi:mmi",
+          any: "$mmi:<skill>"
+        }
+      },
+      hooks: {
+        adapterPath: "hooks/codex-hooks.json",
+        sourceSurfaceId: "mmi-hook-policy",
+        gates: [
+          { id: "command-ladder", failure: "closed" },
+          { id: "vault-edit", failure: "closed" },
+          { id: "secret-output", failure: "open" }
+        ],
+        probe: "installed-contract",
+        execution: "node-bootstrap",
+        preToolUse: "enforced",
+        postToolOutput: "detect-only",
+        finalOutput: "unsupported"
+      },
+      cli: {
+        delivery: "standalone",
+        artifactId: "mmi-cli"
+      },
+      ownership: {
+        trust: "operator",
+        cache: "host",
+        repair: "mmi-cli"
+      },
+      certification: {
+        hostCommand: "codex",
+        versionArgs: ["--version"]
+      },
+      enforcementCeilings: [
+        "Post-tool hooks can detect secret output but cannot rewrite it.",
+        "Hosted tools and disabled or untrusted hooks bypass local enforcement."
+      ]
+    },
+    {
+      token: "kimi",
+      displayName: "Kimi Code CLI",
+      lifecycle: "active",
+      artifactIds: ["mmi-kimi-plugin", "mmi-skills", "mmi-hook-policy", "mmi-cli"],
+      plannedArtifactIds: [],
+      assembly: {
+        mode: "source-tree",
+        rootPath: ".",
+        sync: []
+      },
+      install: {
+        mechanism: "github-source",
+        locator: "https://github.com/mutmutco/MMI-Hub"
+      },
+      upgrade: {
+        mechanism: "reinstall",
+        reload: "session"
+      },
+      skills: {
+        delivery: "plugin",
+        sourceSurfaceId: "mmi-skills",
+        artifactId: "mmi-skills",
+        invocation: {
+          entry: "/skill:mmi",
+          any: "/skill:<skill>"
+        }
+      },
+      hooks: {
+        adapterPath: ".kimi-plugin/plugin.json",
+        sourceSurfaceId: "mmi-hook-policy",
+        gates: [
+          { id: "command-ladder", failure: "closed" },
+          { id: "vault-edit", failure: "closed" },
+          { id: "secret-output", failure: "open" }
+        ],
+        probe: "installed-contract",
+        execution: "inline-manifest",
+        preToolUse: "enforced",
+        postToolOutput: "detect-only",
+        finalOutput: "unsupported"
+      },
+      cli: {
+        delivery: "standalone",
+        artifactId: "mmi-cli"
+      },
+      ownership: {
+        trust: "host",
+        cache: "host",
+        repair: "operator"
+      },
+      certification: {
+        hostCommand: "kimi",
+        versionArgs: ["--version"]
+      },
+      enforcementCeilings: [
+        "Post-tool hooks are observation-only and cannot rewrite secret output.",
+        "Hook errors, timeouts, disabled plugins, and untrusted plugins enforce nothing."
+      ]
+    },
+    {
+      token: "cursor",
+      displayName: "Cursor",
+      lifecycle: "active",
+      artifactIds: ["mmi-cursor-plugin", "mmi-skills", "mmi-hook-policy", "mmi-cli"],
+      plannedArtifactIds: [],
+      assembly: {
+        mode: "source-tree",
+        rootPath: ".",
+        sync: []
+      },
+      install: {
+        mechanism: "github-source",
+        locator: "~/.cursor/plugins/local/mmi"
+      },
+      upgrade: {
+        mechanism: "reinstall",
+        reload: "workspace"
+      },
+      skills: {
+        delivery: "plugin",
+        sourceSurfaceId: "mmi-skills",
+        artifactId: "mmi-skills",
+        invocation: {
+          entry: "/mmi",
+          any: "/<skill>"
+        }
+      },
+      hooks: {
+        adapterPath: "hooks/cursor-hooks.json",
+        sourceSurfaceId: "mmi-hook-policy",
+        gates: [
+          { id: "command-ladder", failure: "closed" },
+          { id: "vault-edit", failure: "closed" },
+          { id: "secret-output", failure: "open" }
+        ],
+        probe: "installed-contract",
+        execution: "command",
+        preToolUse: "enforced",
+        postToolOutput: "detect-only",
+        finalOutput: "unsupported"
+      },
+      cli: {
+        delivery: "standalone",
+        artifactId: "mmi-cli"
+      },
+      ownership: {
+        trust: "host",
+        cache: "mmi-cli",
+        repair: "mmi-cli"
+      },
+      certification: {
+        hostCommand: "cursor-agent",
+        versionArgs: ["--version"]
+      },
+      enforcementCeilings: [
+        "Cursor can replace MCP results only; it cannot rewrite ordinary tool output after execution, though MMI still detects secret-shaped output.",
+        "Final assistant output is outside Cursor hook control.",
+        "Cloud agents do not run sessionStart or sessionEnd hooks, and disabled plugins or untrusted workspaces enforce nothing."
+      ]
+    },
+    {
+      token: "kilo",
+      displayName: "Kilo Code",
+      lifecycle: "active",
+      artifactIds: ["mmi-kilo-plugin", "mmi-kilo-skills", "mmi-hook-policy", "mmi-cli"],
+      plannedArtifactIds: [],
+      assembly: {
+        mode: "package-directory",
+        rootPath: ".kilo-plugin",
+        sync: [
+          {
+            mode: "directories",
+            sourcePath: "skills",
+            targetPath: ".kilo-plugin/skills",
+            excludeNamePrefixes: ["_"]
+          },
+          {
+            mode: "files",
+            sourcePath: "scripts",
+            targetPath: ".kilo-plugin/scripts",
+            include: [
+              "pretooluse-shell-gates.mjs",
+              "vault-edit-gate.mjs",
+              "secret-redact.mjs",
+              "deny-gate-crash.mjs",
+              "secret-echo-lint.mjs",
+              "env-write-lint.mjs",
+              "command-ladder-gate.mjs",
+              "command-ladder-core.mjs",
+              "validate-hook.mjs",
+              "hook-io.mjs",
+              "hook-trace.mjs",
+              "edit-tool-paths.mjs",
+              "throttle-core.mjs",
+              "hook-policy.mjs",
+              "hook-run.mjs"
+            ]
+          }
+        ]
+      },
+      install: {
+        mechanism: "npm",
+        locator: "@mutmutco/kilo-plugin"
+      },
+      upgrade: {
+        mechanism: "package-manager",
+        reload: "session"
+      },
+      skills: {
+        delivery: "provisioned",
+        sourceSurfaceId: "mmi-skills",
+        artifactId: "mmi-kilo-skills",
+        invocation: {
+          entry: "mmi skill via the skill tool",
+          any: "skill tool"
+        }
+      },
+      hooks: {
+        adapterPath: ".kilo-plugin/server.mjs",
+        sourceSurfaceId: "mmi-hook-policy",
+        gates: [
+          { id: "command-ladder", failure: "closed" },
+          { id: "vault-edit", failure: "closed" },
+          { id: "secret-output", failure: "open" }
+        ],
+        probe: "installed-contract",
+        execution: "in-process",
+        preToolUse: "enforced",
+        postToolOutput: "rewrite",
+        finalOutput: "rewrite"
+      },
+      cli: {
+        delivery: "standalone",
+        artifactId: "mmi-cli"
+      },
+      ownership: {
+        trust: "host",
+        cache: "host",
+        repair: "mmi-cli"
+      },
+      certification: {
+        hostCommand: "kilo",
+        versionArgs: ["--version"]
+      },
+      enforcementCeilings: [
+        "Some read, write, and web-fetch tool outputs are not rewriteable by the host.",
+        "Provisioned skills and agents become discoverable only after a fresh session."
+      ]
+    }
+  ],
+  surfaces: [
+    {
+      id: "mmi-skills",
+      classification: "capability",
+      kind: "skills",
+      ownerPath: "skills",
+      deliveryPath: "skills",
+      delivery: "plugin-install",
+      applicability: "plugin-enabled agent surfaces",
+      versionCoordinated: false,
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: ["skills"]
+      },
+      verify: [
+        {
+          command: "node",
+          args: ["scripts/check-skill-payload.mjs", "--contract"],
+          expected: "skill payload check: ok"
+        }
+      ],
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-claude-plugin",
+      classification: "packaging",
+      kind: "plugin",
+      ownerPath: ".claude-plugin/plugin.json",
+      deliveryPath: ".claude-plugin/plugin.json",
+      delivery: "release",
+      applicability: "Claude Code plugin marketplace",
+      versionCoordinated: true,
+      surfaceToken: "claude",
+      versionPaths: [
+        { path: ".claude-plugin/plugin.json", pointer: "version" }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [".claude-plugin/plugin.json", "skills", "hooks", "scripts", "bin"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-codex-plugin",
+      classification: "packaging",
+      kind: "plugin",
+      ownerPath: ".codex-plugin/plugin.json",
+      deliveryPath: ".codex-plugin/plugin.json",
+      delivery: "release",
+      applicability: "Codex plugin marketplace; carries the MMI lifecycle hooks via hooks/codex-hooks.json (#3563)",
+      versionCoordinated: true,
+      surfaceToken: "codex",
+      versionPaths: [
+        { path: ".codex-plugin/plugin.json", pointer: "version" }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [".codex-plugin/plugin.json", "skills", "hooks/codex-hooks.json", "scripts", "bin"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-kimi-plugin",
+      classification: "packaging",
+      kind: "plugin",
+      ownerPath: ".kimi-plugin/plugin.json",
+      deliveryPath: ".kimi-plugin/plugin.json",
+      delivery: "release",
+      applicability: "Kimi Code CLI plugin install (GitHub source); inline event mapping invokes the shared hook runner",
+      versionCoordinated: true,
+      surfaceToken: "kimi",
+      versionPaths: [
+        { path: ".kimi-plugin/plugin.json", pointer: "version" }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [".kimi-plugin/plugin.json", "skills", "scripts", "bin"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-cursor-plugin",
+      classification: "packaging",
+      kind: "plugin",
+      ownerPath: ".cursor-plugin/plugin.json",
+      deliveryPath: "~/.cursor/plugins/local/mmi",
+      delivery: "local-copy",
+      applicability: "Cursor IDE and Cursor Agent CLI; local plugin checkout managed by mmi-cli",
+      versionCoordinated: true,
+      surfaceToken: "cursor",
+      versionPaths: [
+        { path: ".cursor-plugin/plugin.json", pointer: "version" }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [".cursor-plugin/plugin.json", "skills", "hooks/cursor-hooks.json", "scripts", "bin"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-kilo-plugin",
+      classification: "packaging",
+      kind: "plugin",
+      ownerPath: ".kilo-plugin/package.json",
+      deliveryPath: ".kilo-plugin/package.json",
+      delivery: "npm",
+      applicability: "Kilo Code extension + Kilo CLI; npm package @mutmutco/kilo-plugin (kilo-p1), installed via `kilo plugin @mutmutco/kilo-plugin`",
+      versionCoordinated: true,
+      surfaceToken: "kilo",
+      versionPaths: [
+        { path: ".kilo-plugin/package.json", pointer: "version" }
+      ],
+      additionalPaths: [
+        ".kilo-plugin/server.mjs",
+        ".kilo-plugin/skills",
+        ".kilo-plugin/scripts"
+      ],
+      artifactIdentity: {
+        kind: "npm-pack",
+        packagePath: ".kilo-plugin"
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-kilo-skills",
+      classification: "capability",
+      kind: "skills",
+      ownerPath: "skills",
+      deliveryPath: "skills",
+      delivery: "plugin-install",
+      applicability: "Kilo Code (via @mutmutco/kilo-plugin provisioning to ~/.kilo/skills)",
+      versionCoordinated: false,
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [".kilo-plugin/skills"]
+      },
+      surfaceToken: "kilo",
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-claude-marketplace",
+      classification: "delivery",
+      kind: "marketplace",
+      ownerPath: ".claude-plugin/marketplace.json",
+      deliveryPath: ".claude-plugin/marketplace.json",
+      delivery: "release",
+      applicability: "Claude Code plugin marketplace",
+      versionCoordinated: true,
+      surfaceToken: "claude",
+      versionPaths: [
+        { path: ".claude-plugin/marketplace.json", pointer: "plugins.0.version" },
+        { path: ".claude-plugin/marketplace.json", pointer: "plugins.0.displayName", template: "MMI {version}" }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [".claude-plugin/marketplace.json"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-cli",
+      classification: "capability",
+      kind: "cli",
+      ownerPath: "cli/package.json",
+      deliveryPath: "cli/package.json",
+      delivery: "npm",
+      applicability: "editor-agnostic agent surfaces",
+      versionCoordinated: true,
+      versionPaths: [
+        { path: "cli/package.json", pointer: "version" }
+      ],
+      additionalPaths: ["cli/dist"],
+      artifactIdentity: {
+        kind: "npm-pack",
+        packagePath: "cli"
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-cli-lock",
+      classification: "packaging",
+      kind: "package-lock",
+      ownerPath: "cli/package-lock.json",
+      deliveryPath: "cli/package-lock.json",
+      delivery: "npm",
+      applicability: "editor-agnostic agent surfaces",
+      versionCoordinated: true,
+      versionPaths: [
+        { path: "cli/package-lock.json", pointer: "version" },
+        { path: "cli/package-lock.json", pointer: "packages.$root.version" }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: ["cli/package-lock.json"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-cli-dist",
+      classification: "packaging",
+      kind: "bundle",
+      ownerPath: "cli/dist/index.cjs",
+      deliveryPath: "cli/dist/index.cjs",
+      delivery: "npm",
+      applicability: "editor-agnostic agent surfaces",
+      versionCoordinated: true,
+      versionPaths: [
+        { path: "cli/package.json", pointer: "version" }
+      ],
+      additionalPaths: ["cli/dist/main.cjs"],
+      prepare: [
+        {
+          command: "npm",
+          args: ["--prefix", "cli", "run", "build"],
+          inputs: ["cli/src", "cli/build.mjs", "cli/package.json", "cli/README.md", "cli/tsconfig.json"],
+          outputs: ["cli/dist/index.cjs", "cli/dist/main.cjs"]
+        }
+      ],
+      verify: [
+        {
+          command: "node",
+          args: ["cli/dist/index.cjs", "--version"],
+          expected: "{version}"
+        }
+      ],
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: ["cli/dist"]
+      },
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-hook-policy",
+      classification: "guard",
+      kind: "hooks",
+      ownerPath: "scripts/hook-policy.mjs",
+      deliveryPath: "scripts/hook-policy.mjs",
+      delivery: "plugin-install",
+      applicability: "all five active hook-capable agent surfaces",
+      versionCoordinated: false,
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: [
+          "scripts/hook-policy.mjs",
+          "scripts/hook-run.mjs",
+          "scripts/pretooluse-shell-gates.mjs",
+          "scripts/vault-edit-gate.mjs",
+          "scripts/secret-redact.mjs",
+          "scripts/deny-gate-crash.mjs",
+          "scripts/hook-io.mjs",
+          "scripts/hook-trace.mjs",
+          "bin/mmi-hook",
+          "bin/mmi-hook.exe",
+          "native/windows-hook-launcher.c",
+          "scripts/build-windows-hook-launcher.ps1",
+          "scripts/probe-windows-hook-window.ps1"
+        ]
+      },
+      verify: [
+        {
+          command: "node",
+          args: ["scripts/check-hook-contract.mjs"],
+          expected: "hook contract: 5 active adapters proven, 12 repositories covered"
+        }
+      ],
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-hooks",
+      classification: "guard",
+      kind: "hooks",
+      ownerPath: "hooks/hooks.json",
+      deliveryPath: "hooks/hooks.json",
+      delivery: "plugin",
+      applicability: "Claude hook-enabled agents",
+      versionCoordinated: false,
+      artifactIdentity: {
+        kind: "sha256-tree",
+        paths: ["hooks", "scripts"]
+      },
+      surfaceToken: "claude",
+      publishVisibility: "public"
+    },
+    {
+      id: "mmi-github-app",
+      classification: "integration",
+      kind: "github-app",
+      ownerPath: "infra/src/github-app.ts",
+      deliveryPath: "infra/dist/handler.js",
+      delivery: "lambda",
+      applicability: "org automation and authorization",
+      versionCoordinated: true,
+      versionPaths: [
+        { path: "infra/package.json", pointer: "version" }
+      ],
+      publishVisibility: "n/a",
+      deployedVersionSource: "http-header:x-hub-version"
+    },
+    {
+      id: "mmi-slack-notify",
+      classification: "integration",
+      kind: "notification",
+      ownerPath: "scripts/slack-post.mjs",
+      deliveryPath: "scripts/slack-post.mjs",
+      delivery: "github-actions",
+      applicability: "master DM notifications only; chatops out by default",
+      versionCoordinated: false,
+      publishVisibility: "n/a"
+    }
+  ]
+};
+
+// src/surface-doctor.ts
+var TOKENS = /* @__PURE__ */ new Set(["claude", "codex", "kimi", "cursor", "kilo"]);
+function isActiveToken(value) {
+  return TOKENS.has(value);
+}
+var DOCTOR_SURFACES = Object.freeze(
+  (surfaces_default.agentSurfaces ?? []).filter((surface) => surface.lifecycle === "active" && isActiveToken(surface.token)).map((surface) => Object.freeze({
+    token: surface.token,
+    displayName: surface.displayName,
+    artifactIds: Object.freeze([...surface.artifactIds]),
+    installMechanism: surface.install.mechanism,
+    installLocator: surface.install.locator,
+    upgradeMechanism: surface.upgrade.mechanism,
+    reload: surface.upgrade.reload,
+    repairOwner: surface.ownership.repair === "mmi-cli" ? "mmi-cli" : "operator",
+    trustOwner: surface.ownership.trust === "operator" ? "operator" : "host"
+  }))
+);
+function doctorSurface(token) {
+  const descriptor = DOCTOR_SURFACES.find((surface) => surface.token === token);
+  if (!descriptor) throw new Error(`surface registry has no active doctor descriptor for ${token}`);
+  return descriptor;
+}
+function diagnoseSurface(evidence) {
+  const base = {
+    descriptor: evidence.descriptor,
+    ...evidence.installedVersion ? { installedVersion: evidence.installedVersion } : {},
+    ...evidence.releasedVersion ? { releasedVersion: evidence.releasedVersion } : {}
+  };
+  if (!evidence.applicable) return { ...base, state: "skipped" };
+  if (evidence.repair?.attempted && !evidence.repair.ok) {
+    return { ...base, state: "repair-failed", repairDetail: evidence.repair.detail };
   }
-  lines.push(renderTally(checks));
-  if (opts.restartPending) lines.push(RESTART_LINE);
-  return lines.join("\n");
+  if (evidence.repair?.attempted && evidence.repair.ok) {
+    return { ...base, state: "clean", repairDetail: evidence.repair.detail };
+  }
+  if (!evidence.installRecordPresent) return { ...base, state: "missing" };
+  if (!evidence.deliveryPresent || !evidence.payloadPresent || evidence.manifest === "missing") {
+    return { ...base, state: "partial" };
+  }
+  if (evidence.manifest === "invalid") return { ...base, state: "corrupt" };
+  if (!evidence.releasedVersion) return { ...base, state: "freshness-unknown" };
+  if (evidence.installedVersion && evidence.releasedVersion && compareVersions(evidence.installedVersion, evidence.releasedVersion) < 0) {
+    return { ...base, state: "stale" };
+  }
+  return { ...base, state: "clean" };
 }
-function doctorReportExitCode(checks) {
-  return checks.some((c) => !c.ok && !c.reportOnly) ? 1 : 0;
+function reloadInstruction(descriptor) {
+  const verb = descriptor.reload === "workspace" ? "reload" : "restart";
+  return `${verb} ${descriptor.displayName}`;
+}
+function planSurfaceRepair(diagnosis) {
+  if (diagnosis.state === "clean" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
+  const descriptor = diagnosis.descriptor;
+  if (descriptor.repairOwner !== "mmi-cli") {
+    return {
+      supported: false,
+      owner: "operator",
+      changes: [],
+      instruction: `repair is unsupported by mmi-cli; reinstall via ${descriptor.installMechanism} (${descriptor.installLocator}), then ${reloadInstruction(descriptor)}`
+    };
+  }
+  return {
+    supported: true,
+    owner: "mmi-cli",
+    command: "mmi-cli plugin heal",
+    changes: ["replace the active MMI plugin installation", `reload via ${descriptor.reload}`],
+    instruction: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`), then ${reloadInstruction(descriptor)}`
+  };
+}
+function buildSurfaceDoctorCheck(diagnosis) {
+  const { descriptor, state } = diagnosis;
+  const plan = planSurfaceRepair(diagnosis);
+  const versions = diagnosis.installedVersion && diagnosis.releasedVersion ? compareVersions(diagnosis.installedVersion, diagnosis.releasedVersion) === 0 ? diagnosis.installedVersion : `${diagnosis.installedVersion} \u2192 ${diagnosis.releasedVersion}` : diagnosis.installedVersion;
+  const detailByState = {
+    skipped: "skipped \u2014 host not active",
+    clean: diagnosis.repairDetail ? `clean \u2014 repaired and verified (${diagnosis.repairDetail})` : `clean${versions ? ` \u2014 ${versions}` : ""}`,
+    "freshness-unknown": `${diagnosis.installedVersion ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
+    stale: `stale${versions ? ` \u2014 ${versions}` : ""}`,
+    missing: "missing \u2014 no install record",
+    corrupt: "corrupt \u2014 installed manifest is unreadable",
+    partial: "partial \u2014 one or more delivery artifacts are absent",
+    "repair-failed": `repair failed${diagnosis.repairDetail ? ` \u2014 ${diagnosis.repairDetail}` : ""}`
+  };
+  return {
+    id: `${descriptor.token}-plugin`,
+    surface: descriptor.token,
+    state,
+    ok: state === "clean" || state === "skipped",
+    ...state === "freshness-unknown" ? { reportOnly: true } : {},
+    label: `${descriptor.displayName} plugin`,
+    detail: detailByState[state],
+    ...plan ? { fix: plan.instruction } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
+    verbose: [
+      // The three numbers the legacy builder used to print. They belong here now that this is the only
+      // plugin row, and a report that names a state without naming the versions behind it is not evidence.
+      `installed: ${diagnosis.installedVersion ?? "(none)"}`,
+      `released:  ${diagnosis.releasedVersion ?? "(not checked \u2014 offline or --fast)"}`,
+      `state: ${state}`,
+      `registry surface: ${descriptor.token}`,
+      `install: ${descriptor.installMechanism} (${descriptor.installLocator})`,
+      `repair owner: ${descriptor.repairOwner}`,
+      `artifacts: ${descriptor.artifactIds.join(", ")}`,
+      ...diagnosis.repairDetail ? [`heal: ${diagnosis.repairDetail}`] : []
+    ]
+  };
+}
+function surfaceRestartAction(descriptor) {
+  return reloadInstruction(descriptor);
 }
 
 // src/doctor-clean.ts
@@ -27061,75 +28234,23 @@ function checkWorktreeRoots(probe) {
     verbose: evidence
   };
 }
-function pluginHealTrigger(probe) {
-  if (probe.guardState === "no-install" || probe.guardState === "unresolved") return "unresolved";
-  const behind = Boolean(probe.installed && probe.released) && compareVersions(probe.installed, probe.released) < 0;
-  return behind ? "behind" : null;
-}
-function checkClaudePlugin(probe) {
-  const { installed, released, guardState } = probe;
-  const codex = probe.surface === "codex";
-  const id = codex ? "codex-plugin" : "claude-plugin";
-  const label = codex ? "Codex plugin" : "Claude plugin";
-  const restart = codex ? "restart Codex" : "restart Claude";
-  const evidence = [
-    `installed: ${installed ?? "(none)"}`,
-    // #3485 item 7: when the value was reused from the banner's once-a-day cache, say so and say how old.
-    `released:  ${released ?? "(not checked \u2014 offline or --fast)"}${released && probe.releasedNote ? ` ${probe.releasedNote}` : ""}`,
-    `resolvable: ${guardState}`
-  ];
-  const trigger = pluginHealTrigger(probe);
-  if (trigger === "unresolved") {
-    return {
-      id,
-      ok: false,
-      label,
-      detail: guardState === "no-install" ? "not installed" : "unresolved (marketplace/cache missing)",
-      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall the MMI marketplace + plugin, then ${restart}`,
-      verbose: evidence
-    };
-  }
-  if (trigger === "behind") {
-    return {
-      id,
-      ok: false,
-      label,
-      detail: `${installed} \u2192 ${released}`,
-      // Name the CLI verb that actually fixes it, like every other red row — `/plugin` is the manual
-      // fallback, not the first resort (#3282).
-      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall it, then ${restart}`,
-      verbose: evidence
-    };
-  }
-  if (!released) {
-    return {
-      id,
-      ok: false,
-      reportOnly: true,
-      label,
-      detail: `${installed ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
-      fix: "check it directly: `npm view @mutmutco/cli version`, then `mmi-cli plugin heal` if behind",
-      verbose: evidence
-    };
-  }
-  return { id, ok: true, label, ...installed ? { detail: installed } : {}, verbose: evidence };
-}
-function checkCodexHookTrust(probe) {
+function checkCodexHookTrust(probe, displayName = "Codex") {
   if (!probe?.applicable) return null;
   const evidence = [
     `stored approval rows: ${probe.trustedCount}/${probe.requiredCount}`,
     "current command hashes: verify interactively in /hooks"
   ];
+  const label = `${displayName} hook trust`;
   if (probe.trusted) {
-    return { id: "codex-hook-trust", ok: true, label: "Codex hook trust", detail: "trusted", verbose: evidence };
+    return { id: "codex-hook-trust", ok: true, label, detail: "trusted", verbose: evidence };
   }
   return {
     id: "codex-hook-trust",
     ok: true,
     warn: true,
-    label: "Codex hook trust",
+    label,
     detail: probe.requiredCount > 0 ? `${probe.trustedCount}/${probe.requiredCount} approval rows present \u2014 current hashes unverified` : "hook bundle could not be verified",
-    fix: probe.requiredCount > 0 ? "Codex does not allow silent hook approval; run `/hooks`, review the MMI commands, and trust them" : "run `mmi-cli plugin heal`, restart Codex, then review and trust MMI under `/hooks`",
+    fix: probe.requiredCount > 0 ? `${displayName} does not allow silent hook approval; run \`/hooks\`, review the MMI commands, and trust them` : `run \`mmi-cli plugin heal\`, restart ${displayName}, then review and trust MMI under \`/hooks\``,
     verbose: evidence
   };
 }
@@ -27354,6 +28475,12 @@ function gcReapable(plan) {
 async function runDoctorClean(opts, io, deps) {
   const applyEnv = Boolean(opts.apply) || Boolean(opts.preflight);
   const applyRepo = Boolean(opts.apply) && opts.repoWrites !== false;
+  const lane = {
+    banner: Boolean(opts.banner),
+    fast: Boolean(opts.fast),
+    preflight: Boolean(opts.preflight),
+    full: !opts.fast && !opts.banner && !opts.preflight
+  };
   const probeReleased = !opts.fast || Boolean(opts.self);
   const probeAws = !opts.fast && !opts.banner;
   const [login, isOrgRepo, released, callerArn, reach] = await Promise.all([
@@ -27368,91 +28495,69 @@ async function runDoctorClean(opts, io, deps) {
     opts.banner || opts.preflight || opts.fast && !opts.self ? Promise.resolve(void 0) : deps.githubRepoReach?.() ?? Promise.resolve(void 0)
   ]);
   const ghInstalled2 = login ? true : await deps.ghInstalled();
-  const installed = deps.installedPluginVersion();
-  const pluginSurface = deps.pluginSurface?.() ?? "claude-cli";
-  const codexSurface = pluginSurface === "codex";
+  const registryEvidence = deps.surfaceEvidence(isOrgRepo);
+  const restartAction = registryEvidence ? surfaceRestartAction(registryEvidence.descriptor) : "restart the agent host";
   const checks = [];
   let restartPending = false;
-  checks.push(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.githubPools) {
-    checks.push(...checkGithubPools(await deps.githubPools()));
-  }
-  const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
-  if (aws) checks.push(aws);
-  checks.push(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
-  if (isOrgRepo) {
-    const current = deps.readGitignore();
-    const gi = planGitignore(current);
-    const giEvidence = [
-      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
-      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
-    ];
-    if (gi.ok) {
-      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
-    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
-      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
-      restartPending = true;
-    } else {
-      checks.push({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
-    }
-  }
-  const releasedNote = deps.releasedVersionNote?.();
-  const pluginProbe = {
-    installed,
-    released,
-    guardState: deps.pluginGuardState(isOrgRepo),
-    releasedNote,
-    surface: pluginSurface
+  const streamed = /* @__PURE__ */ new Set();
+  const worthPrinting = (c) => Boolean(opts.verbose) || !c.ok || Boolean(c.warn);
+  const emitNow = (check) => {
+    checks.push(check);
+    if (opts.json || !worthPrinting(check)) return;
+    streamed.add(check);
+    io.log(renderCheckLine(check));
+    if (opts.verbose) for (const evidence of check.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
+  };
+  const healIntent = (line) => {
+    if (!opts.json) io.log(`\u21BB ${line}`);
   };
-  const healTrigger = pluginHealTrigger(pluginProbe);
+  const healStep = (message) => {
+    if (!opts.json) io.log(`${VERBOSE_INDENT}${message.trim()}`);
+  };
+  const releasedNote = deps.releasedVersionNote?.();
   let pluginHealed = false;
-  if (applyEnv && deps.healPlugin && healTrigger) {
-    const heal = await deps.healPlugin();
-    pluginHealed = heal.ok;
-    const measured = healTrigger === "behind" ? `${installed} \u2192 ${released}` : "unresolved install";
-    const healEvidence = [
-      `installed: ${installed ?? "(none)"}`,
-      `released:  ${released ?? "(not checked \u2014 offline or --fast)"}`,
-      `resolvable: ${pluginProbe.guardState}`,
-      `heal: ${heal.detail}`
-    ];
-    checks.push(heal.ok ? {
-      id: codexSurface ? "codex-plugin" : "claude-plugin",
-      ok: true,
-      label: codexSurface ? "Codex plugin" : "Claude plugin",
-      detail: `${measured} \u2014 reinstalled via the MMI marketplace (remove \u2192 add \u2192 ${codexSurface ? "add" : "install"})${codexSurface ? "; review trust in /hooks" : ""}`,
-      verbose: healEvidence
-    } : {
-      id: codexSurface ? "codex-plugin" : "claude-plugin",
-      ok: false,
-      label: codexSurface ? "Codex plugin" : "Claude plugin",
-      detail: measured,
-      // #3489: a heal skipped because another doctor holds the env-heal lock is a real ✗ — this run did
-      // not fix what it found — but it is not this invocation's to clear. The other process is doing it;
-      // waiting is the correct response and a re-run finds it healed. A heal that RAN and failed is a
-      // genuine gap and still gates.
-      ...heal.skipped ? { reportOnly: true } : {},
-      fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes` : `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then ${codexSurface ? "restart Codex" : "restart Claude"}`,
-      verbose: healEvidence
-    });
-    if (!heal.skipped) restartPending = true;
-  } else {
-    const plugin = checkClaudePlugin(pluginProbe);
-    if (plugin) {
-      checks.push(plugin);
-      if (!plugin.ok) restartPending = true;
+  async function runPluginRow() {
+    if (!registryEvidence) return;
+    const diagnosis = diagnoseSurface({ ...registryEvidence, releasedVersion: released });
+    const repair = planSurfaceRepair(diagnosis);
+    if (applyEnv && deps.healPlugin && repair?.supported) {
+      const { descriptor } = registryEvidence;
+      healIntent(`${descriptor.displayName} plugin \u2014 healing via ${descriptor.installMechanism} (${descriptor.installLocator})`);
+      const heal = await deps.healPlugin(healStep);
+      pluginHealed = heal.ok;
+      const row = buildSurfaceDoctorCheck(diagnoseSurface({
+        ...registryEvidence,
+        releasedVersion: released,
+        repair: { attempted: true, ok: heal.ok, detail: heal.detail }
+      }));
+      if (heal.skipped) {
+        row.reportOnly = true;
+        row.fix = `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes`;
+      }
+      emitNow(row);
+      if (!heal.skipped) restartPending = true;
+    } else if (diagnosis.state !== "skipped") {
+      const row = buildSurfaceDoctorCheck(diagnosis);
+      emitNow(row);
+      if (!row.ok && repair?.supported) restartPending = true;
+    }
+    if (registryEvidence.descriptor.trustOwner === "operator" && (registryEvidence.guardState === "healthy" || pluginHealed)) {
+      const trust = checkCodexHookTrust(deps.pluginTrustState?.(), registryEvidence.descriptor.displayName);
+      if (trust) emitNow(trust);
+    }
+  }
+  async function runCliRow() {
+    const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
+    const cliReport = buildVersionLagReport(cliInput);
+    if (!(applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm")) {
+      const cli = checkCliVersion(cliInput, releasedNote);
+      if (cli) emitNow(cli);
+      return;
     }
-  }
-  if (codexSurface && (pluginProbe.guardState === "healthy" || pluginHealed)) {
-    const trust = checkCodexHookTrust(deps.pluginTrustState?.());
-    if (trust) checks.push(trust);
-  }
-  const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
-  const cliReport = buildVersionLagReport(cliInput);
-  if (applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
-    const heal = await deps.updateCli(cliReport.releasedVersion);
+    healIntent(`mmi-cli \u2014 self-updating ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion} via npm install -g`);
+    const heal = await deps.updateCli(cliReport.releasedVersion, healStep);
     const healEvidence = [`running:  ${cliReport.currentVersion}`, `published: ${cliReport.releasedVersion}`, `heal: ${heal.detail}`];
-    checks.push(heal.ok ? {
+    emitNow(heal.ok ? {
       id: "cli-version",
       ok: true,
       label: "mmi-cli",
@@ -27468,17 +28573,47 @@ async function runDoctorClean(opts, io, deps) {
       fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is updating it now; re-run once it finishes` : `self-update failed (${heal.detail}) \u2014 run \`${cliUpdateCommand(cliReport.releasedVersion)}\``,
       verbose: healEvidence
     });
-  } else {
-    const cli = checkCliVersion(cliInput, releasedNote);
-    if (cli) checks.push(cli);
   }
-  checks.push(checkPluginCache(deps.pluginCache()));
-  if (deps.sessionPayload) {
+  async function runGithubAuthRow() {
+    emitNow(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
+  }
+  async function runGithubPoolsRows() {
+    for (const pool of checkGithubPools(await deps.githubPools())) emitNow(pool);
+  }
+  async function runAwsRow() {
+    const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
+    if (aws) emitNow(aws);
+  }
+  async function runRepoWorktreesRow() {
+    emitNow(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
+  }
+  async function runGitignoreRow() {
+    const current = deps.readGitignore();
+    const gi = planGitignore(current);
+    const giEvidence = [
+      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
+      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
+    ];
+    if (gi.ok) {
+      emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
+    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
+      emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
+      restartPending = true;
+    } else {
+      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
+    }
+  }
+  async function runPluginCacheRow() {
+    emitNow(checkPluginCache(deps.pluginCache()));
+  }
+  async function runSessionPayloadRow() {
     const payload = checkSessionPayload(deps.sessionPayload());
-    if (payload) checks.push(payload);
+    if (payload) emitNow(payload);
+  }
+  async function runMarketplaceRows() {
+    for (const row of deps.marketplaceRows()) emitNow(row);
   }
-  if (deps.marketplaceRows) checks.push(...deps.marketplaceRows());
-  if (!opts.fast && !opts.banner && !opts.preflight) {
+  async function runSchedulesRow() {
     const probe = await deps.schedulesNotebook().catch((e) => ({
       armed: 0,
       live: 0,
@@ -27487,32 +28622,32 @@ async function runDoctorClean(opts, io, deps) {
       drift: []
     }));
     const sched = checkSchedules(probe);
-    if (sched) checks.push(sched);
+    if (sched) emitNow(sched);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.redactorLiveness) {
+  async function runRedactorRow() {
     const redactor = checkRedactorLiveness(deps.redactorLiveness());
-    if (redactor) checks.push(redactor);
+    if (redactor) emitNow(redactor);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.docsAudit) {
+  async function runDocsAuditRow() {
     const probe = await deps.docsAudit().catch((e) => ({
       armed: true,
       ok: false,
       detail: `docs-audit probe failed \u2014 ${e.message}`
     }));
     const docsAudit2 = checkDocsAudit(probe);
-    if (docsAudit2) checks.push(docsAudit2);
+    if (docsAudit2) emitNow(docsAudit2);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.worktreeRoots) {
+  async function runWorktreeRootsRow() {
     const probe = await deps.worktreeRoots().catch(() => void 0);
     const roots = checkWorktreeRoots(probe);
-    if (roots) checks.push(roots);
+    if (roots) emitNow(roots);
   }
-  if (isOrgRepo && !opts.fast && !opts.banner && !opts.preflight) {
+  async function runTrainSyncRow() {
     try {
-      checks.push(checkTrainSync(await deps.syncTrain()));
+      emitNow(checkTrainSync(await deps.syncTrain()));
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
-      checks.push({
+      emitNow({
         ok: false,
         id: "train-branches",
         label: "train branches",
@@ -27520,6 +28655,8 @@ async function runDoctorClean(opts, io, deps) {
         verbose: [`sync threw: ${message}`, "no train branch was fast-forwarded this run"]
       });
     }
+  }
+  async function runHousekeeperRows() {
     const repoRoot2 = await deps.repoRoot();
     try {
       const plan = await deps.gcPlan("origin", 200);
@@ -27530,7 +28667,7 @@ async function runDoctorClean(opts, io, deps) {
         if (r.removedBranches.length || r.removedRemoteBranches.length) detailParts.push(`${r.removedBranches.length + r.removedRemoteBranches.length} merged branches`);
         if (r.removedWorktreeDirs.length) detailParts.push(`${r.removedWorktreeDirs.length} dead worktrees`);
         if (r.removedTrackingRefs.length) detailParts.push(`${r.removedTrackingRefs.length} stale refs`);
-        checks.push({
+        emitNow({
           id: "branches-worktrees",
           ok: true,
           label: "branches / worktrees",
@@ -27553,7 +28690,7 @@ async function runDoctorClean(opts, io, deps) {
           ...plan.trackingRefs.map((r) => `stale tracking ref: ${r.ref}`),
           ...plan.worktreeDirs.map((w) => `dead worktree: ${w.path} (${w.reason})`)
         ];
-        checks.push(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
+        emitNow(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
           id: "branches-worktrees",
           ok: false,
           label: "branches / worktrees",
@@ -27571,35 +28708,65 @@ async function runDoctorClean(opts, io, deps) {
     if (applyRepo && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
-      checks.push({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
+      emitNow({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
       if (pruned) restartPending = true;
     } else {
-      checks.push(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
-    }
-  }
+      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
+    }
+  }
+  const table = [
+    // Heals first: the slowest work starts at second zero, and a stale mmi-cli is the binary every row
+    // below is being measured with (#3954).
+    { id: "plugin", when: true, run: runPluginRow },
+    { id: "cli-version", when: true, run: runCliRow },
+    { id: "github-auth", when: true, run: runGithubAuthRow },
+    { id: "github-pools", when: lane.full, run: runGithubPoolsRows },
+    { id: "aws-identity", when: true, run: runAwsRow },
+    { id: "repo-worktrees", when: true, run: runRepoWorktreesRow },
+    { id: "gitignore-block", when: isOrgRepo, run: runGitignoreRow },
+    { id: "plugin-cache", when: true, run: runPluginCacheRow },
+    { id: "sessionstart-payload", when: true, run: runSessionPayloadRow },
+    { id: "marketplace", when: true, run: runMarketplaceRows },
+    { id: "schedules", when: lane.full, run: runSchedulesRow },
+    { id: "redactor-liveness", when: lane.full, run: runRedactorRow },
+    { id: "docs-audit", when: lane.full, run: runDocsAuditRow },
+    { id: "worktree-roots", when: lane.full, run: runWorktreeRootsRow },
+    // The two most expensive things in this file — a real `git fetch` plus train-branch fast-forward,
+    // and a `gh`-backed gc sweep with a 20s timeout — so org repos on the full lane only (#3485).
+    { id: "train-branches", when: isOrgRepo && lane.full, run: runTrainSyncRow },
+    { id: "housekeeper", when: isOrgRepo && lane.full, run: runHousekeeperRows }
+  ];
+  for (const entry of table) if (entry.when) await entry.run();
   const exitCode = doctorReportExitCode(checks);
   if (opts.json) {
     const payload = opts.verbose ? checks : checks.map(({ verbose: _evidence, ...check }) => check);
     io.log(JSON.stringify({
       checks: payload,
       restartPending,
-      ...restartPending ? { restartAction: codexSurface ? "restart Codex" : "restart Claude" } : {},
+      ...restartPending ? { restartAction } : {},
       exitCode
     }, null, 2));
     return exitCode;
   }
   if (opts.banner) {
-    const actionable = checks.filter((c) => !c.ok || c.warn);
+    const actionable = checks.filter((c) => (!c.ok || c.warn) && !streamed.has(c));
     for (const c of actionable) {
       io.log(renderReport([c], { restartPending: false }));
       if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
     }
-    if (restartPending) io.log(codexSurface ? "\u21BB Restart Codex to finish." : RESTART_LINE);
+    if (restartPending) io.log(`\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.`);
     return 0;
   }
-  const rendered = renderDoctorText(checks, { verbose: Boolean(opts.verbose), restartPending: restartPending && !codexSurface });
-  io.log(restartPending && codexSurface ? `${rendered}
-\u21BB Restart Codex to finish.` : rendered);
+  const rest = checks.filter((c) => !streamed.has(c));
+  const shown = opts.verbose ? rest : rest.filter((c) => !c.ok || c.warn);
+  const lines = [];
+  for (const check of shown) {
+    lines.push(renderCheckLine(check));
+    if (opts.verbose) for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
+  }
+  lines.push(renderTally(checks));
+  if (restartPending) lines.push(`\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.`);
+  io.log(lines.join("\n"));
   return exitCode;
 }
 
@@ -27701,17 +28868,43 @@ function installedClaudePluginVersion() {
     return void 0;
   }
 }
-function installedActivePluginVersion(surface = detectSurface(process.env)) {
-  if (surface !== "codex") return installedClaudePluginVersion();
+function manifestVersion(path2) {
+  try {
+    const manifest = JSON.parse((0, import_node_fs33.readFileSync)(path2, "utf8"));
+    return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function installedSurfacePluginVersion(surface) {
+  const token = surfaceToken(surface);
+  if (token === "kilo") {
+    try {
+      const stamp = (0, import_node_fs33.readFileSync)((0, import_node_path32.join)((0, import_node_os12.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      return stamp || void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  if (token === "cursor") {
+    return manifestVersion((0, import_node_path32.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+  }
+  if (token === "kimi") {
+    return manifestVersion((0, import_node_path32.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+  }
+  if (token === "claude") return installedClaudePluginVersion();
+  if (token !== "codex") return void 0;
   try {
     const raw = process.platform === "win32" ? (0, import_node_child_process14.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: 15e3
+      timeout: 15e3,
+      windowsHide: true
     }) : (0, import_node_child_process14.execFileSync)("codex", ["plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: 15e3
+      timeout: 15e3,
+      windowsHide: true
     });
     const parsed = JSON.parse(raw);
     const plugin = parsed.installed?.find((entry) => entry.pluginId === MMI_PLUGIN_ID2 && entry.installed === true && entry.enabled === true);
@@ -27720,6 +28913,9 @@ function installedActivePluginVersion(surface = detectSurface(process.env)) {
     return void 0;
   }
 }
+function installedActivePluginVersion(surface = detectSurface(process.env)) {
+  return installedSurfacePluginVersion(surface);
+}
 function worktreeRootSync() {
   try {
     const out = (0, import_node_child_process14.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -27857,6 +29053,29 @@ function mmiDoctorDeps(opts = {}) {
   const throttled = opts.throttleReleasedRead ? throttledReleasedVersion() : void 0;
   let notebook;
   const notebookOnce = () => notebook ??= fetchNotebook();
+  let surfaceEvidence;
+  let surfaceEvidenceRead = false;
+  const surfaceEvidenceOnce = (isOrgRepo) => {
+    if (surfaceEvidenceRead) return surfaceEvidence;
+    surfaceEvidenceRead = true;
+    const runtimeSurface = detectSurface(process.env);
+    const token = surfaceToken(runtimeSurface);
+    if (!token || token === "opencode") return void 0;
+    const descriptor = doctorSurface(token);
+    const snapshot = snapshotPluginGuardInput(runtimeSurface, isOrgRepo);
+    const installedVersion = installedSurfacePluginVersion(runtimeSurface);
+    surfaceEvidence = {
+      descriptor,
+      applicable: isOrgRepo || snapshot.installRecordPresent || snapshot.pluginCachePresent,
+      installRecordPresent: snapshot.installRecordPresent,
+      deliveryPresent: snapshot.marketplaceClonePresent,
+      payloadPresent: snapshot.pluginCachePresent,
+      manifest: installedVersion ? "valid" : snapshot.installRecordPresent ? "invalid" : "missing",
+      guardState: buildPluginGuardDecision(snapshot).state,
+      ...installedVersion ? { installedVersion } : {}
+    };
+    return surfaceEvidence;
+  };
   const docsJanitorArmedAt = async (repo) => {
     const wanted = docsJanitorScheduleId(repo);
     const { entries } = await notebookOnce();
@@ -27868,9 +29087,7 @@ function mmiDoctorDeps(opts = {}) {
     githubRepoReach: githubRepoReachProbe,
     awsCallerArn,
     isOrgRepo: () => isOrgRepoRoot(),
-    installedPluginVersion: installedActivePluginVersion,
-    pluginGuardState: activePluginGuardState,
-    pluginSurface: () => detectSurface(process.env),
+    surfaceEvidence: surfaceEvidenceOnce,
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
@@ -27879,12 +29096,13 @@ function mmiDoctorDeps(opts = {}) {
     // marketplace clone + plugin cache) and neither is idempotent under concurrency. They share ONE lock
     // rather than one each, because they are not independent: the plugin heal reinstalls a bundle that
     // carries a CLI shim, so a concurrent npm global install races the same PATH surface.
-    updateCli: (target) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target)),
+    updateCli: (target, onStep) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target, onStep)),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
-    healPlugin: () => {
+    healPlugin: (onStep) => {
       const surface = detectSurface(process.env);
-      return withEnvHealLock(`${surface === "codex" ? "Codex" : "Claude"} plugin reinstall`, () => healActivePluginForDoctor(surface));
+      const host = surfaceEvidenceOnce(true)?.descriptor.displayName ?? surface;
+      return withEnvHealLock(`${host} plugin reinstall`, () => healActivePluginForDoctor(surface, onStep));
     },
     currentCliVersion: resolveClientVersion,
     readGitignore,
@@ -29344,13 +30562,25 @@ function surfaceWaived() {
 }
 var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
 withExamples(mutating(
-  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks or newlines needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one \u2014 for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
-  // --dry-run/--validate-only plan: validate --type + --priority (mirrors the action — a bad enum fails
-  // ERR_BAD_ENUM, a missing priority defaults to medium) then echo the resolved create intent. Refs
-  // (`--parent`) and title-source are validated by the action on a real run.
+  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one \u2014 for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
+  // --dry-run/--validate-only plan: resolve the same title source and validate the same type, priority,
+  // and surface contract as the real action. A plan that echoes the title-file PATH instead of its value
+  // is not a plan of the mutation that will run (#3914).
   async (opts) => {
     const type = resolveCreateType(opts.type, "issue create", opts.label);
     const priority = resolveCreatePriority(opts.priority, "issue create");
+    let title;
+    try {
+      title = await resolveIssueTitle(
+        { title: opts.title, titleFile: opts.titleFile },
+        { readFile: import_promises10.readFile, readStdin }
+      );
+    } catch (e) {
+      return fail(
+        `issue create: ${e.message}`,
+        e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0
+      );
+    }
     const planLabels = opts.label ?? [];
     const clash = conflictingSurfaceInputs(opts.surface, planLabels);
     if (clash) fail(clash.message, clash.payload);
@@ -29368,7 +30598,7 @@ withExamples(mutating(
     return {
       command: "issue create",
       type,
-      title: opts.title ?? opts.titleFile,
+      title,
       priority,
       repo: opts.repo,
       ...surface ? { surface } : {}
@@ -30271,6 +31501,12 @@ function renderReleaseResume(r) {
   if (r.rcAlignment) lines.push(`  rc: ${r.rcAlignment.note}`);
   return lines.join("\n");
 }
+function renderReleaseAbort(r) {
+  return `mmi-cli release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+}
+function renderReleasePublishRetry(r) {
+  return `mmi-cli release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
+}
 function renderRcandResume(r) {
   return `mmi-cli rcand --resume: promoted ${r.repo} \u2192 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
 }
@@ -30315,9 +31551,11 @@ async function resolveRcandPlanTargets() {
 for (const commandName of ["rcand", "release"]) {
   const trainCmd = program2.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)");
   const RELEASE_ONLY_FLAGS = [
-    { flags: "--announce-summary-file <path>", description: "agent-curated summary lines for the Hub Slack announcement (#883)" },
+    { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line Hub Slack summary; required for a new MMI-Hub --apply (#883/#3901)" },
     { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
-    { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" }
+    { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
+    { flags: "--abort", description: "with --apply, delete only a proven unpublished failed Hub tag and restore local main for a clean recut (#3944)" },
+    { flags: "--retry-publish <run-id>", description: "with --apply, retry failed jobs of one proven Hub publish release run (#3949)" }
   ];
   for (const f of RELEASE_ONLY_FLAGS) {
     if (commandName === "release") {
@@ -30341,6 +31579,45 @@ for (const commandName of ["rcand", "release"]) {
     if (o.announceSummaryFile && commandName !== "release") {
       return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no Hub Slack announcement. Run: mmi-cli release --announce-summary-file <path>`);
     }
+    if (o.abort && commandName !== "release") {
+      return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished Hub release tag. Run: mmi-cli release --abort --apply`);
+    }
+    if (o.retryPublish && commandName !== "release") {
+      return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli release --retry-publish <run-id> --apply --watch`);
+    }
+    if (o.retryPublish) {
+      if (o.resume || o.abort) return fail("release: --retry-publish cannot be combined with --resume or --abort");
+      if (!o.apply) return fail("release: --retry-publish requires --apply after explicit approval; nothing was written");
+      if (o.announceSummaryFile || o.ack || o.dev) return fail("release: --retry-publish accepts only --apply, --watch, --repo and --json");
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli release --retry-publish ${o.retryPublish} --apply${o.watch ? " --watch" : ""}`);
+        if (!guard.ok) return fail(`release: ${guard.message}`);
+      }
+      const runId = Number.parseInt(o.retryPublish, 10);
+      try {
+        const result = await runReleasePublishRetry(trainApplyDeps(), runId, { approved: true, watch: o.watch });
+        return printLine(o.json ? JSON.stringify(result, null, 2) : renderReleasePublishRetry(result));
+      } catch (e) {
+        return failGraceful(`release --retry-publish: ${e.message}`);
+      }
+    }
+    if (o.abort) {
+      if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
+      if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");
+      if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+        return fail("release: --abort accepts only --apply, --repo and --json; promotion flags cannot be combined with rollback");
+      }
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), "mmi-cli release --abort --apply");
+        if (!guard.ok) return fail(`release: ${guard.message}`);
+      }
+      try {
+        const result = await runReleaseAbort(trainApplyDeps(), { approved: true });
+        return printLine(o.json ? JSON.stringify(result, null, 2) : renderReleaseAbort(result));
+      } catch (e) {
+        return failGraceful(`release --abort: ${e.message}`);
+      }
+    }
     if (o.resume) {
       if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive \u2014 --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
       try {
@@ -30362,6 +31639,24 @@ for (const commandName of ["rcand", "release"]) {
       const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), rerun);
       if (!guard.ok) return fail(`${commandName}: ${guard.message}`);
     }
+    if (o.apply && commandName === "release" && (await resolveRepo())?.toLowerCase() === ANNOUNCE_REPO.toLowerCase()) {
+      if (!o.announceSummaryFile) {
+        return fail(
+          "release: a new MMI-Hub release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same release command"
+        );
+      }
+      let summaryLines;
+      try {
+        summaryLines = summaryFileLines(await (0, import_promises10.readFile)(o.announceSummaryFile, "utf8"));
+      } catch (e) {
+        return fail(`release: could not read --announce-summary-file ${o.announceSummaryFile}: ${e.message}`);
+      }
+      if (summaryLines.length < 3 || summaryLines.length > 6) {
+        return fail(
+          `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${summaryLines.length})`
+        );
+      }
+    }
     if (o.apply) {
       try {
         const ack = (o.ack ?? "").split(",").map((s) => s.trim()).filter(Boolean);