@mutmutco/cli 3.8.0 → 3.10.0

package/dist/main.cjs

@@ -3408,7 +3408,7 @@ var program = new Command();
 
 // src/index.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs19 = require("node:fs");
+var import_node_fs20 = require("node:fs");
 
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
@@ -4524,7 +4524,12 @@ function buildSessionStartPlan(verbs) {
       { name: "board slice", run: verbs.boardSlice }
     ],
     sequential: [
-      // Doctor runs last so it sees the final tree.
+      // local train sync (#2582): fast-forward local development/main/rc to origin BEFORE doctor + before
+      // the agent works, so a checkout never lags behind a release someone pushed to origin (and the
+      // deferred main -> development alignment merge lands locally). Sequential + fail-soft: it runs one
+      // bounded `git fetch` + ff, silent unless a branch actually moved, and never blocks the banner.
+      { name: "train sync", run: verbs.syncTrain },
+      // Doctor runs last so it sees the final (synced) tree.
       { name: "doctor", run: verbs.doctor }
     ]
   };
@@ -4566,6 +4571,103 @@ function scratchGcLines(cwd, env = process.env, now = Date.now()) {
   }
 }
 
+// src/git-clean-tree.ts
+function isAgentScratchPath(path2) {
+  const normalized = path2.replace(/\\/g, "/").trim();
+  return /^tmp_[^/]+$/.test(normalized);
+}
+function porcelainHasBlockingChanges(porcelain) {
+  return porcelain.split("\n").some((line) => {
+    const trimmed = line.trim();
+    if (!trimmed) return false;
+    const path2 = trimmed.slice(3).split(" -> ")[0]?.trim() ?? "";
+    return path2 !== "" && !isAgentScratchPath(path2);
+  });
+}
+
+// src/local-train-sync.ts
+var TRAIN_BRANCHES = ["development", "main", "rc"];
+function clean(out) {
+  return out.trim();
+}
+async function revParse(run, ref) {
+  try {
+    return clean(await run("git", ["rev-parse", "--verify", "--quiet", ref]));
+  } catch {
+    return "";
+  }
+}
+async function isFastForward(run, ancestor, descendant) {
+  try {
+    await run("git", ["merge-base", "--is-ancestor", ancestor, descendant]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function syncOneBranch(run, branch, currentBranch2, warn) {
+  const localSha = await revParse(run, `refs/heads/${branch}`);
+  if (!localSha) {
+    return { branch, status: "skipped", reason: "no-local-branch", note: `${branch}: no local branch \u2014 skipped` };
+  }
+  const remoteSha = await revParse(run, `refs/remotes/origin/${branch}`);
+  if (!remoteSha) {
+    return { branch, status: "skipped", reason: "no-remote-branch", note: `${branch}: no origin/${branch} \u2014 skipped` };
+  }
+  if (localSha === remoteSha) {
+    return { branch, status: "already-current", note: `${branch}: already at origin/${branch}` };
+  }
+  if (!await isFastForward(run, localSha, remoteSha)) {
+    const note = `${branch}: local diverged from origin/${branch} \u2014 left untouched (never force)`;
+    warn?.(note);
+    return { branch, status: "skipped", reason: "diverged", note };
+  }
+  try {
+    if (branch === currentBranch2) {
+      const porcelain = await run("git", ["status", "--porcelain"]);
+      if (porcelainHasBlockingChanges(porcelain)) {
+        return { branch, status: "skipped", reason: "current-dirty", note: `${branch}: checked out with local changes \u2014 skipped (commit/stash, then rerun)` };
+      }
+      await run("git", ["merge", "--ff-only", `origin/${branch}`]);
+    } else {
+      await run("git", ["fetch", "origin", `${branch}:${branch}`]);
+    }
+    return { branch, status: "synced", note: `${branch}: fast-forwarded to origin/${branch}` };
+  } catch (e) {
+    const note = `${branch}: fast-forward failed \u2014 ${e instanceof Error ? e.message : String(e)}`;
+    warn?.(note);
+    return { branch, status: "skipped", reason: "ff-failed", note };
+  }
+}
+async function syncLocalTrainBranches(run, options = {}) {
+  const branches = options.branches ?? TRAIN_BRANCHES;
+  const doFetch = options.fetch ?? true;
+  const fetchRun = options.fetchRun ?? ((args) => run("git", args));
+  if (doFetch) {
+    try {
+      await fetchRun(["fetch", "origin"]);
+    } catch (e) {
+      options.warn?.(`local-train-sync: git fetch origin failed \u2014 syncing against cached refs (${e instanceof Error ? e.message : String(e)})`);
+    }
+  }
+  let currentBranch2 = "";
+  try {
+    currentBranch2 = clean(await run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+  } catch {
+    currentBranch2 = "";
+  }
+  const results = [];
+  for (const branch of branches) {
+    results.push(await syncOneBranch(run, branch, currentBranch2, options.warn));
+  }
+  return { branches: results, changed: results.some((r) => r.status === "synced") };
+}
+function localTrainSyncBannerLine(result) {
+  const moved = result.branches.filter((b) => b.status === "synced").map((b) => b.branch);
+  if (moved.length === 0) return "";
+  return `synced local ${moved.join(", ")} \u2192 origin`;
+}
+
 // src/board.ts
 var import_node_child_process5 = require("node:child_process");
 var import_node_util5 = require("node:util");
@@ -5868,7 +5970,7 @@ function whoamiLine(report) {
 }
 
 // src/index.ts
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -6148,6 +6250,9 @@ var MANAGED_GITIGNORE_LINES = [
   // doctor` flags one explicitly instead (buildRepoLocalWorktreeCheck) rather than baking the fallback path
   // into every repo's .gitignore.
   ".aws-sam/",
+  // jerv-cli lease markers — the ephemeral per-worktree lease ledger `jerv-cli lease open` writes into a
+  // worktree root; never tracked (it lives only for the life of the worktree). Hub#2586.
+  ".jerv-lease.json",
   "/*.png",
   // Runtime secrets/config are vault-only (AGENTS.md "Privileged ops") — never commit a local .env. The
   // .env.example reference file stays tracked.
@@ -9689,20 +9794,6 @@ async function runStageLiveDown(deps, t) {
   };
 }
 
-// src/git-clean-tree.ts
-function isAgentScratchPath(path2) {
-  const normalized = path2.replace(/\\/g, "/").trim();
-  return /^tmp_[^/]+$/.test(normalized);
-}
-function porcelainHasBlockingChanges(porcelain) {
-  return porcelain.split("\n").some((line) => {
-    const trimmed = line.trim();
-    if (!trimmed) return false;
-    const path2 = trimmed.slice(3).split(" -> ")[0]?.trim() ?? "";
-    return path2 !== "" && !isAgentScratchPath(path2);
-  });
-}
-
 // src/tenant-control-parse.ts
 var OUTPUT_BEGIN = "mmi-control-output-begin";
 var OUTPUT_END = "mmi-control-output-end";
@@ -9743,13 +9834,26 @@ function resolveDeployModel2(meta, repo) {
   if (isDeployModel(m)) return m;
   return resolveDeployModel(meta, repo);
 }
-function clean(out) {
+function clean2(out) {
   return out.trim();
 }
 function requireValue(value, label) {
   if (!value) throw new Error(`${label} could not be resolved`);
   return value;
 }
+function surfaceTrainSubprocessFailure(e, file, args) {
+  if (!(e instanceof Error)) return e;
+  const err = e;
+  const stderr = typeof err.stderr === "string" ? err.stderr.trim() : "";
+  const stdout = typeof err.stdout === "string" ? err.stdout.trim() : "";
+  const cmd = `${file} ${args.join(" ")}`.trim();
+  if (!stderr && !stdout) {
+    err.message = `${cmd} failed with no stderr output (exit ${err.code ?? "?"}) \u2014 likely a transient subprocess/network error. [${err.message}]`;
+  } else if (/^Command failed/i.test(err.message) && stderr) {
+    err.message = `${cmd} failed: ${stderr}`;
+  }
+  return err;
+}
 function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun) {
   if (cwdRepo && cwdRepo.toLowerCase() === applyRepo.toLowerCase()) return { ok: true };
   const where = cwdRepo ? `this checkout is ${cwdRepo}` : "this checkout could not be identified";
@@ -9813,18 +9917,18 @@ async function verifyPublishedRelease(deps, repo, tag, expectedTarget, expectedS
   if (release.targetCommitish !== expectedTarget) {
     throw new Error(`Release ${tag} targetCommitish is ${String(release.targetCommitish || "(missing)")}, expected ${expectedTarget}`);
   }
-  const tagSha = requireValue(clean(await deps.run("git", ["rev-parse", `${tag}^{commit}`])), "release tag sha");
+  const tagSha = requireValue(clean2(await deps.run("git", ["rev-parse", `${tag}^{commit}`])), "release tag sha");
   if (tagSha !== expectedSha) {
     throw new Error(`Release ${tag} tag points at ${tagSha}, expected ${expectedSha}`);
   }
-  const branchOut = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
+  const branchOut = clean2(await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
   const branchSha = requireValue(branchOut.split(/\s+/)[0] ?? "", `origin/${expectedTarget} sha`);
   if (branchSha !== expectedSha) {
     throw new Error(`origin/${expectedTarget} points at ${branchSha}, expected ${expectedSha}`);
   }
 }
 async function ffOnlyPull(deps, branch) {
-  await deps.run("git", ["pull", "--ff-only", "origin", branch]);
+  await runGitRemoteRead(deps, ["pull", "--ff-only", "origin", branch]);
 }
 var RELEASE_TOLERATED_PATHS = [".gitignore"];
 var MERGE_TREE_PREFLIGHT_ATTEMPTS = 3;
@@ -9878,7 +9982,7 @@ function ensurePositiveCount(out, emptyMessage) {
   if (count <= 0) throw new Error(emptyMessage);
 }
 async function remoteBranchExists(deps, branch) {
-  const out = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const out = clean2(await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/heads/${branch}`]));
   return out.length > 0;
 }
 async function loadReleaseTrackBranchHints(deps) {
@@ -9890,10 +9994,10 @@ async function loadReleaseTrackBranchHints(deps) {
   return { hasDevelopmentBranch, hasMainBranch, hasRcBranch };
 }
 async function buildTrainApplyContext(deps) {
-  const repo = requireValue(clean(await deps.run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])), "repo");
+  const repo = requireValue(clean2(await deps.run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])), "repo");
   const [owner, name] = repo.split("/");
   if (!owner || !name) throw new Error(`repo must be owner/name, got ${repo}`);
-  const login = requireValue(clean(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
+  const login = requireValue(clean2(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
   const verdict = await deps.trainAuthority(repo);
   if (!verdict.ok) throw new Error(`${commandAuthorityLabel(owner)}: train authority could not be verified (${verdict.error})`);
   if (!verdict.train) {
@@ -9914,11 +10018,11 @@ async function requireCleanTree(deps) {
   if (porcelainHasBlockingChanges(status)) throw new Error("working tree must be clean before train apply");
 }
 async function requireBranch(deps, branch) {
-  const current = clean(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+  const current = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
   if (current !== branch) throw new Error(`must run from ${branch}, currently on ${current || "(unknown)"}`);
 }
 async function currentBranch(deps) {
-  return clean(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"])) || "(unknown)";
+  return clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"])) || "(unknown)";
 }
 async function restoreCheckoutAfterRelease(deps, startBranch) {
   const status = await deps.run("git", ["status", "--porcelain"]);
@@ -9961,17 +10065,17 @@ async function restoreCheckoutAfterRelease(deps, startBranch) {
   }
 }
 async function withCheckoutRestoredAfterRelease(deps, result, startBranch) {
-  return {
-    ...result,
-    checkout: await restoreCheckoutAfterRelease(deps, startBranch)
-  };
+  const checkout = await restoreCheckoutAfterRelease(deps, startBranch);
+  const branches = TRAIN_BRANCHES.filter((b) => b !== startBranch);
+  const localSync = await syncLocalTrainBranches(deps.run, { branches, fetch: false, warn: deps.warn }).catch(() => void 0);
+  return { ...result, checkout, ...localSync ? { localSync } : {} };
 }
 function normGitPath(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
 async function releaseRcBranchLock(deps) {
   const porcelain = await deps.run("git", ["worktree", "list", "--porcelain"]);
-  const cwd = normGitPath(clean(await deps.run("git", ["rev-parse", "--show-toplevel"])));
+  const cwd = normGitPath(clean2(await deps.run("git", ["rev-parse", "--show-toplevel"])));
   for (const wt of parseWorktreePorcelain(porcelain)) {
     if (wt.branch !== "rc") continue;
     if (normGitPath(wt.path) === cwd) continue;
@@ -10038,6 +10142,32 @@ var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
+var GIT_NETWORK_ATTEMPTS = 3;
+var GIT_NETWORK_RETRY_DELAY_MS = 1e3;
+function isPersistentGitPushFailure(e) {
+  const msg = `${e instanceof Error ? e.message : String(e)} ${String(e.stderr ?? "")}`;
+  return /non-fast-forward|\[rejected\]|failed to push|protected branch|hook declined|permission denied|could not read Username|authentication failed|Authentication failed|403 Forbidden|GH006|GH013/i.test(msg);
+}
+async function runGitWithRetry(deps, args, shouldRetry) {
+  const sleep = resolveSleep(deps);
+  let lastError;
+  for (let attempt = 1; attempt <= GIT_NETWORK_ATTEMPTS; attempt++) {
+    try {
+      return await deps.run("git", args);
+    } catch (e) {
+      lastError = e;
+      if (attempt >= GIT_NETWORK_ATTEMPTS || !shouldRetry(e)) throw e;
+      await sleep(GIT_NETWORK_RETRY_DELAY_MS * attempt);
+    }
+  }
+  throw lastError;
+}
+function runGitRemoteRead(deps, args) {
+  return runGitWithRetry(deps, args, () => true);
+}
+function runGitPush(deps, args) {
+  return runGitWithRetry(deps, args, (e) => !isPersistentGitPushFailure(e));
+}
 var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion,startedAt:.started_at}]";
 var TRAIN_COMMIT_STATUS_JQ = "[.statuses[]|{context:.context,state:.state}]";
 var TRAIN_PROTECTION_CONTEXTS_JQ = "[.contexts[]]";
@@ -10161,7 +10291,7 @@ async function discoverRequiredCheckContexts(deps, ctx, branch) {
   return [...contexts];
 }
 async function findOpenAlignmentPr(deps, ctx) {
-  const out = clean(await deps.run("gh", ["pr", "list", "--repo", ctx.repo, "--base", "development", "--head", "main", "--state", "open", "--json", "number,url"]));
+  const out = clean2(await deps.run("gh", ["pr", "list", "--repo", ctx.repo, "--base", "development", "--head", "main", "--state", "open", "--json", "number,url"]));
   if (!out) return void 0;
   const rows = JSON.parse(out);
   const row = rows.find((r) => typeof r.number === "number" && typeof r.url === "string");
@@ -10189,14 +10319,14 @@ async function rollDevelopmentForward(deps, ctx, tag) {
       note: `alignment PR already open: ${existing.url} \u2014 land it with \`mmi-cli pr merge ${existing.number} --auto --merge\``
     };
   }
-  const ahead = clean(await deps.run("git", ["rev-list", "--count", "origin/development..main"]));
+  const ahead = clean2(await deps.run("git", ["rev-list", "--count", "origin/development..main"]));
   if (ahead === "0") {
     return { status: "aligned", note: "development already contains the released main; nothing to roll forward" };
   }
   const body = `Carries the ${tag} release (including the version fold) from \`main\` back to \`development\`.
 
 \`development\` requires status checks, so the release train opens this alignment PR instead of a direct push of the un-checked merge commit (#1143). Land it with a **true merge** \u2014 \`mmi-cli pr merge <n> --auto --merge\` (not squash) so the merge parentage survives and the misalignment guard stays satisfied. \`--auto\` waits out the checks this PR triggers, which otherwise block an immediate merge right after the release.`;
-  const url = clean(await deps.run("gh", ["pr", "create", "--repo", ctx.repo, "--base", "development", "--head", "main", "--title", `chore(release): align development to ${tag}`, "--body", body]));
+  const url = clean2(await deps.run("gh", ["pr", "create", "--repo", ctx.repo, "--base", "development", "--head", "main", "--title", `chore(release): align development to ${tag}`, "--body", body]));
   const number = parsePrNumber(url);
   return {
     status: "pr-pending",
@@ -10312,12 +10442,15 @@ Recovery sequence:
 Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
   );
 }
-async function ensureTagPushed(deps, tag, sha) {
-  const remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]);
-  const remoteSha = clean(remoteOut).split(/\s+/)[0] || "";
+async function probeRemoteTag(deps, tag) {
+  const remoteOut = await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/tags/${tag}`]);
+  return clean2(remoteOut).split(/\s+/)[0] || "";
+}
+async function ensureTagPushed(deps, tag, sha, probed) {
+  const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
   let localSha = "";
   try {
-    localSha = clean(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
+    localSha = clean2(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
   } catch {
   }
   if (remoteSha) {
@@ -10335,12 +10468,15 @@ async function ensureTagPushed(deps, tag, sha) {
     throw new Error(`local tag ${tag} already points at ${localSha}, not the intended ${sha} \u2014 delete the stale local tag (git tag -d ${tag}) and rerun`);
   }
   if (!localSha) await deps.run("git", ["tag", tag, sha]);
-  await deps.run("git", ["push", "origin", tag]);
+  await runGitPush(deps, ["push", "origin", tag]);
   return { note: `tag ${tag} pushed at ${sha.slice(0, 7)}`, pushed: true };
 }
-async function resolveRcResumeTag(deps, base, sha) {
-  const out = await deps.run("git", ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
-  const onSha = clean(out).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)).filter(([refSha]) => refSha === sha).map(([, ref]) => ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "")).filter((ref) => new RegExp(`^${base.replace(/\./g, "\\.")}-rc\\.\\d+$`).test(ref));
+function probeRcResumeTags(deps, base) {
+  return runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
+}
+async function resolveRcResumeTag(deps, base, sha, probed) {
+  const out = probed ?? await runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
+  const onSha = clean2(out).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)).filter(([refSha]) => refSha === sha).map(([, ref]) => ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "")).filter((ref) => new RegExp(`^${base.replace(/\./g, "\\.")}-rc\\.\\d+$`).test(ref));
   const unique = [...new Set(onSha)];
   if (unique.length === 0) return { tag: null };
   const rcNum = (t) => Number.parseInt(t.replace(/^.*-rc\./, ""), 10);
@@ -10536,7 +10672,7 @@ async function preflightMergeToMain(deps, deployModel, remoteRef, blockingPrefix
 async function executeMergeToMain(deps, sourceRef, mergeLabel, tolerated, predicted, preFold) {
   await deps.run("git", ["checkout", "main"]);
   await ffOnlyPull(deps, "main");
-  preFold.mainSha = clean(await deps.run("git", ["rev-parse", "main"]));
+  preFold.mainSha = clean2(await deps.run("git", ["rev-parse", "main"]));
   if (predicted.length === 0) {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
   } else {
@@ -10547,8 +10683,8 @@ async function probeFoldFailureState(deps) {
   const branch = await currentBranch(deps);
   const mergeInProgress = await deps.run("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).then(() => true).catch(() => false);
   const dirty = porcelainHasBlockingChanges(await deps.run("git", ["status", "--porcelain"]).catch(() => ""));
-  const mainSha = await deps.run("git", ["rev-parse", "main"]).then(clean).catch(() => "");
-  const originMainSha = await deps.run("git", ["rev-parse", "origin/main"]).then(clean).catch(() => "");
+  const mainSha = await deps.run("git", ["rev-parse", "main"]).then(clean2).catch(() => "");
+  const originMainSha = await deps.run("git", ["rev-parse", "origin/main"]).then(clean2).catch(() => "");
   const originIsAncestorOfMain = Boolean(mainSha) && Boolean(originMainSha) ? await deps.run("git", ["merge-base", "--is-ancestor", "origin/main", "main"]).then(() => true).catch(() => false) : false;
   return { branch, mergeInProgress, dirty, mainSha, originMainSha, originIsAncestorOfMain };
 }
@@ -10590,6 +10726,49 @@ Recovery sequence:
 ${steps.join("\n")}`
   );
 }
+async function recoverFailedRcand(deps, cause, preRcSha) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  const branch = await currentBranch(deps).catch(() => "");
+  const mergeInProgress = await deps.run("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).then(() => true).catch(() => false);
+  if (mergeInProgress) {
+    try {
+      await deps.run("git", ["merge", "--abort"]);
+    } catch (e) {
+      return new Error(
+        `${causeMessage}
+
+rcand failed with an in-progress merge on ${branch || "(unknown branch)"}; automatic \`git merge --abort\` failed: ${e instanceof Error ? e.message : String(e)}. Nothing was pushed to origin.
+Recovery sequence:
+  1. git merge --abort
+  2. git checkout development
+  3. git branch -f rc origin/rc`
+      );
+    }
+  }
+  const rcSha = await deps.run("git", ["rev-parse", "rc"]).then(clean2).catch(() => "");
+  const rcDescends = Boolean(preRcSha) && Boolean(rcSha) ? await deps.run("git", ["merge-base", "--is-ancestor", preRcSha, "rc"]).then(() => true).catch(() => false) : false;
+  if (branch === "rc" && rcDescends) {
+    try {
+      await deps.run("git", ["reset", "--hard", preRcSha]);
+      await deps.run("git", ["checkout", "development"]);
+      return new Error(
+        `${causeMessage}
+
+rcand failed after \`git checkout rc\`; local rc was reset to its pre-merge state (${shaLabel(preRcSha)}) and the checkout returned to development. Nothing was pushed to origin. Rerun \`mmi-cli rcand --apply\`.`
+      );
+    } catch {
+    }
+  }
+  return new Error(
+    `${causeMessage}
+
+rcand failed leaving the checkout on ${branch || "(unknown)"} (pre-merge rc=${preRcSha ? shaLabel(preRcSha) : "not captured"}). Nothing was pushed to origin.
+Recovery sequence:
+  1. git checkout development
+  2. git branch -f rc origin/rc   # discard the unpushed local rc merge
+  3. mmi-cli rcand --apply`
+  );
+}
 async function recoverFailedFold(deps, cause, startBranch, preFoldMainSha) {
   const causeMessage = cause instanceof Error ? cause.message : String(cause);
   const probe = await probeFoldFailureState(deps);
@@ -10641,8 +10820,13 @@ async function runFoldStage(deps, startBranch, preFold, fn) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
   }
 }
-async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
-  const tagPush = await ensureTagPushed(deps, tag, releaseSha);
+async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe) {
+  let tagPush;
+  try {
+    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe);
+  } catch (e) {
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+  }
   const tagPushSince = (deps.now ?? Date.now)();
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
   let checks;
@@ -10651,8 +10835,8 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   } catch (e) {
     throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
   }
-  await deps.run("git", ["push", "origin", "main"]);
-  const releaseUrl = clean(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  await runGitPush(deps, ["push", "origin", "main"]);
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
@@ -10690,16 +10874,26 @@ async function runTrainApplyPipeline(mode, input) {
       "nothing to promote: origin/development is not ahead of origin/rc"
     );
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
-    const releaseBase = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
+    const releaseBase = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
     await releaseRcBranchLock(deps);
+    const rcTagProbe = await probeRcResumeTags(deps, releaseBase);
     await deps.run("git", ["checkout", "rc"]);
     await ffOnlyPull(deps, "rc");
-    await deps.run("git", ["merge", "development", "--no-edit"]);
-    const rcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
-    const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
-    const tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+    const preRcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "pre-merge rc sha");
+    let rcSha;
+    let resume;
+    let tag2;
+    let tagPush;
+    try {
+      await deps.run("git", ["merge", "development", "--no-edit"]);
+      rcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
+      resume = await resolveRcResumeTag(deps, releaseBase, rcSha, rcTagProbe);
+      tag2 = resume.tag ?? requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+      tagPush = await ensureTagPushed(deps, tag2, rcSha);
+    } catch (e) {
+      throw await recoverFailedRcand(deps, e, preRcSha);
+    }
     const resumeNote = resume.tag ? resume.note : void 0;
-    const tagPush = await ensureTagPushed(deps, tag2, rcSha);
     const tagPushSince = (deps.now ?? Date.now)();
     const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
     let checks2;
@@ -10709,7 +10903,7 @@ async function runTrainApplyPipeline(mode, input) {
       throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
     }
     const autoRunSince = (deps.now ?? Date.now)();
-    await deps.run("git", ["push", "origin", "rc"]);
+    await runGitPush(deps, ["push", "origin", "rc"]);
     const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
     return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus };
   }
@@ -10732,8 +10926,8 @@ async function runTrainApplyPipeline(mode, input) {
       "nothing to release: origin/development is not ahead of origin/main"
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
-    const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
-    const rcShaAtRelease = !directTrack && hasRcBranch ? clean(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
+    const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
+    const rcShaAtRelease = !directTrack && hasRcBranch ? clean2(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
     const { foldPaths: foldPaths2, tolerated: tolerated2, predicted: predicted2 } = await preflightMergeToMain(
       deps,
       deployModel2,
@@ -10741,14 +10935,15 @@ async function runTrainApplyPipeline(mode, input) {
       "development -> main merge would conflict on untolerated path(s)",
       "The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release."
     );
+    const tagProbe2 = { remoteSha: await probeRemoteTag(deps, tag2) };
     const preFold2 = {};
     const { versionFold: versionFold2, releaseSha: releaseSha2 } = await runFoldStage(deps, "development", preFold2, async () => {
       await executeMergeToMain(deps, "development", "development -> main", tolerated2, predicted2, preFold2);
       const versionFold3 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
-      const releaseSha3 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
+      const releaseSha3 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
       return { versionFold: versionFold3, releaseSha: releaseSha3 };
     });
-    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2);
+    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2, "development", preFold2, tagProbe2);
     const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
     if (directTrack) {
       return {
@@ -10823,16 +11018,17 @@ async function runTrainApplyPipeline(mode, input) {
       `hotfix-coverage: ${coverage.uncovered.length} main-only commit(s) not proven in origin/rc \u2014 the candidate would revert a prod hotfix: ${list}. Re-cut /rcand from development, or have the authorized human verify the content is in the candidate and rerun release with --ack <sha>[,<sha>\u2026].`
     );
   }
-  const releasedRcSha = clean(await deps.run("git", ["rev-parse", "origin/rc"]));
+  const releasedRcSha = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
+  const tag = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
+  const tagProbe = { remoteSha: await probeRemoteTag(deps, tag) };
   const preFold = {};
-  const { tag, versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
+  const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
     await executeMergeToMain(deps, "rc", "rc -> main", tolerated, predicted, preFold);
-    const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
-    const versionFold2 = await foldReleaseVersion(deps, deployModel, tag2, foldPaths);
-    const releaseSha2 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
-    return { tag: tag2, versionFold: versionFold2, releaseSha: releaseSha2 };
+    const versionFold2 = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
+    const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
+    return { versionFold: versionFold2, releaseSha: releaseSha2 };
   });
-  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha);
+  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, "rc", preFold, tagProbe);
   const retirement = await retireRcRuntime(deps, ctx, deployModel, d.deployStatus, releasedRcSha);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   const rcAlignment = await pushRcAlignment(deps);
@@ -10866,7 +11062,7 @@ async function runTrainApply(command, deps, options = {}) {
   const watch = options.watch ?? false;
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
-  await deps.run("git", ["fetch", "origin"]);
+  await runGitRemoteRead(deps, ["fetch", "origin"]);
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
@@ -10948,7 +11144,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
   }
   try {
     await deps.run("git", ["fetch", "origin", "rc"]);
-    const rcNow = clean(await deps.run("git", ["rev-parse", "origin/rc"]));
+    const rcNow = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
     if (rcNow !== releasedRcSha) {
       return {
         status: "skipped",
@@ -10979,7 +11175,7 @@ async function runTenantRedeploy(deps, options) {
   const repo = options.repo;
   const [owner, name] = repo.split("/");
   if (!owner || !name) throw new Error(`repo must be owner/name, got ${repo}`);
-  const login = requireValue(clean(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
+  const login = requireValue(clean2(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
   const verdict = await deps.trainAuthority(repo);
   if (!verdict.ok) throw new Error(`${commandAuthorityLabel(owner)}: train authority could not be verified (${verdict.error})`);
   if (!verdict.train) throw new Error(`${commandAuthorityLabel(owner)}: @${login} is ${verdict.role} \u2014 no train authority on ${repo}`);
@@ -11219,7 +11415,7 @@ var HOTFIX_RUN_FIND_ATTEMPTS = 10;
 var HOTFIX_RUN_FIND_DELAY_MS = 15e3;
 var HOTFIX_VERIFY_ATTEMPTS = 5;
 var HOTFIX_VERIFY_RETRY_MS = 6e3;
-function clean2(out) {
+function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
@@ -11277,7 +11473,7 @@ async function resolveHotfixSource(deps, ctx, from) {
     if (!sha2) throw new Error(`PR #${num} has no merge commit recorded \u2014 name the commit SHA explicitly`);
     return { sha: sha2, label: `PR #${num} (${sha2.slice(0, 7)})` };
   }
-  const sha = clean2(await deps.run("git", ["rev-parse", "--verify", `${from}^{commit}`]));
+  const sha = clean3(await deps.run("git", ["rev-parse", "--verify", `${from}^{commit}`]));
   if (!sha) throw new Error(`could not resolve commit ${from}`);
   return { sha, label: sha.slice(0, 7) };
 }
@@ -11305,7 +11501,7 @@ async function runHotfixStart(deps, options) {
     };
   }
   const { sha, label } = await resolveHotfixSource(deps, ctx, options.from);
-  const remoteBranch = clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
     await deps.run("git", ["pull", "--ff-only", "origin", branch]);
@@ -11336,7 +11532,7 @@ async function runHotfixStart(deps, options) {
     await deps.run("git", ["push", "-u", "origin", branch]);
   }
   const bumpNote = deployModel === "hub-serverless" ? " with the locked distribution bump" : "";
-  const prUrl = clean2(await deps.run("gh", [
+  const prUrl = clean3(await deps.run("gh", [
     "pr",
     "create",
     "--repo",
@@ -11480,7 +11676,7 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   }
   let verifyNote;
   if (deployModel === "hub-serverless") {
-    const previousRef = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+    const previousRef = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
     const publishSucceeded = runs.find((r) => r.workflow === "publish.yml")?.conclusion === "success";
     try {
       await deps.run("git", ["-c", "advice.detachedHead=false", "checkout", tag]);
@@ -11567,9 +11763,9 @@ async function runHotfixStatus(deps, versionInput) {
   return { ...ctx, command: "hotfix-status", ...facts, ...deriveHotfixState(facts), warnings };
 }
 async function gatherHotfixFacts(deps, ctx, tag, version) {
-  const branchExists = Boolean(clean2(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
+  const branchExists = Boolean(clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
   const pr2 = await findHotfixPr(deps, ctx, tag);
-  const remoteTag = clean2(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
+  const remoteTag = clean3(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
   const tagPushed = Boolean(remoteTag);
   const tagSha = remoteTag.split(/\s+/)[0] || "";
   let releaseExists = false;
@@ -11603,7 +11799,7 @@ async function gatherHotfixFacts(deps, ctx, tag, version) {
       }
     }
   }
-  const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean2, () => "unknown");
+  const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean3, () => "unknown");
   return { tag, version, branchExists, pr: pr2 ? { number: pr2.number, state: pr2.state, url: pr2.url } : null, tagPushed, releaseExists, runs, npmVersion };
 }
 function compareHotfixVersions(a, b) {
@@ -11638,7 +11834,7 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag) {
     const m = typeof row.headRefName === "string" && /^hotfix\/(v\d+\.\d+\.\d+)/.exec(row.headRefName);
     if (m) tags.add(m[1]);
   }
-  const branchOut = clean2(await deps.run("git", ["ls-remote", "origin", "refs/heads/hotfix/v*"]));
+  const branchOut = clean3(await deps.run("git", ["ls-remote", "origin", "refs/heads/hotfix/v*"]));
   for (const line of branchOut.split("\n").filter(Boolean)) {
     const ref = line.split(/\s+/)[1] ?? "";
     const m = /^refs\/heads\/hotfix\/(v\d+\.\d+\.\d+)/.exec(ref);
@@ -12130,7 +12326,7 @@ function renderAccessReport(report) {
 }
 
 // src/bootstrap-verify.ts
-var TRAIN_BRANCHES = ["development", "rc", "main"];
+var TRAIN_BRANCHES2 = ["development", "rc", "main"];
 var requiredDocs = ["README.md", "architecture.md"];
 var requiredIssueTemplates = [
   ".github/ISSUE_TEMPLATE/bug.yml",
@@ -12308,7 +12504,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: hasPushAllowlist(protection) ? void 0 : "restrictions.users is empty or unset"
     });
   }
-  const strayTrainBranches = TRAIN_BRANCHES.filter((b) => !branchesWanted.includes(b) && branchNames.has(b));
+  const strayTrainBranches = TRAIN_BRANCHES2.filter((b) => !branchesWanted.includes(b) && branchNames.has(b));
   checks.push({
     ok: strayTrainBranches.length === 0,
     label: "no stray train branch for this track",
@@ -12783,13 +12979,13 @@ var WIKI_STAMP_FILE = ".wiki-state.json";
 function redactWikiSecrets(msg) {
   return msg.replace(/x-access-token:[^@\s]+@/gi, "x-access-token:***@").replace(/(AUTHORIZATION:\s*basic\s+)[A-Za-z0-9+/=]+/gi, "$1***");
 }
+function wikiAuthArgs(token) {
+  return ["-c", `http.extraheader=AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`];
+}
 function publishWikiViaGit(deps, opts) {
   const dir = deps.mkdtemp();
   const url = `https://github.com/${opts.repo}.wiki.git`;
-  const authArgs = [
-    "-c",
-    `http.extraheader=AUTHORIZATION: basic ${Buffer.from(`x-access-token:${opts.token}`).toString("base64")}`
-  ];
+  const authArgs = wikiAuthArgs(opts.token);
   try {
     deps.gitRun(["init", "-q"], dir);
     deps.gitRun(["remote", "add", "origin", url], dir);
@@ -12844,12 +13040,37 @@ function publishWikiViaGit(deps, opts) {
     deps.rm(dir);
   }
 }
+function readWikiStampViaGit(deps, opts) {
+  const dir = deps.mkdtemp();
+  const url = `https://github.com/${opts.repo}.wiki.git`;
+  const authArgs = wikiAuthArgs(opts.token);
+  try {
+    deps.gitRun(["init", "-q"], dir);
+    deps.gitRun(["remote", "add", "origin", url], dir);
+    if (!deps.gitProbe([...authArgs, "ls-remote", "origin"], dir)) {
+      return { ok: false, error: `could not reach ${opts.repo}.wiki.git to read the wiki stamp \u2014 auth or network failure` };
+    }
+    if (!deps.gitProbe([...authArgs, "fetch", "--depth", "1", "origin", "master"], dir)) {
+      return { ok: true, stamp: {} };
+    }
+    deps.gitRun(["reset", "--hard", "FETCH_HEAD"], dir);
+    const stampPath = (0, import_node_path14.join)(dir, WIKI_STAMP_FILE);
+    if (!deps.fileExists(stampPath)) return { ok: true, stamp: {} };
+    const parsed = JSON.parse(deps.readFile(stampPath));
+    return { ok: true, stamp: parsed && typeof parsed === "object" ? parsed : {} };
+  } catch (e) {
+    return { ok: false, error: redactWikiSecrets(e.message) };
+  } finally {
+    deps.rm(dir);
+  }
+}
 function realWikiGitPublishDeps() {
   return {
     mkdtemp: () => (0, import_node_fs13.mkdtempSync)((0, import_node_path14.join)((0, import_node_os5.tmpdir)(), "wiki-")),
     readdir: (dir) => (0, import_node_fs13.readdirSync)(dir),
     copyFile: (src, dest) => (0, import_node_fs13.copyFileSync)(src, dest),
     fileExists: (p) => (0, import_node_fs13.existsSync)(p),
+    readFile: (p) => (0, import_node_fs13.readFileSync)(p, "utf8"),
     rm: (p) => (0, import_node_fs13.rmSync)(p, { recursive: true, force: true }),
     gitProbe: (args, cwd) => {
       try {
@@ -12867,6 +13088,124 @@ function realWikiGitPublishDeps() {
   };
 }
 
+// src/wiki-pages.ts
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs14 = require("node:fs");
+var import_node_path15 = require("node:path");
+var MARKER_RE = /<!--\s*wiki:page\s+([^>]*?)-->/g;
+var attr = (raw, key) => {
+  const m = new RegExp(`${key}\\s*=\\s*"([^"]*)"`).exec(raw);
+  return m ? m[1].trim() : "";
+};
+var sanitizeSlug = (s) => String(s ?? "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
+function extractWikiMarkers(text, sourcePath = "") {
+  const out = [];
+  for (const m of String(text ?? "").matchAll(MARKER_RE)) {
+    const raw = m[1];
+    const slug = sanitizeSlug(attr(raw, "slug"));
+    const title = attr(raw, "title");
+    if (!slug || !title) continue;
+    out.push({ slug, title, artifact: attr(raw, "artifact"), sourcePath });
+  }
+  return out;
+}
+var DURABLE_GLOBS = [
+  "architecture.md",
+  "docs/Architecture",
+  "kb/architecture",
+  "docs/org-architecture.md",
+  "docs/org-readme.md"
+];
+var walkMarkdown = (root, rel) => {
+  const abs = (0, import_node_path15.join)(root, rel);
+  let st;
+  try {
+    st = (0, import_node_fs14.statSync)(abs);
+  } catch {
+    return [];
+  }
+  if (st.isFile()) return rel.endsWith(".md") ? [rel] : [];
+  return (0, import_node_fs14.readdirSync)(abs).flatMap((name) => walkMarkdown(root, (0, import_node_path15.join)(rel, name)));
+};
+function collectFeaturePages({ listDocs, readDoc }) {
+  const seen = /* @__PURE__ */ new Set();
+  const pages = [];
+  for (const path2 of listDocs()) {
+    for (const mk of extractWikiMarkers(readDoc(path2), path2)) {
+      if (seen.has(mk.slug)) continue;
+      seen.add(mk.slug);
+      pages.push(mk);
+    }
+  }
+  return pages;
+}
+function fsReaders(rootDir) {
+  return {
+    listDocs: () => DURABLE_GLOBS.flatMap((g) => walkMarkdown(rootDir, g)),
+    readDoc: (p) => {
+      try {
+        return (0, import_node_fs14.readFileSync)((0, import_node_path15.join)(rootDir, p), "utf8");
+      } catch {
+        return "";
+      }
+    }
+  };
+}
+function hashPageInputs({ slug, title, source }) {
+  return (0, import_node_crypto4.createHash)("sha256").update(JSON.stringify([slug ?? "", title ?? "", source ?? ""])).digest("hex");
+}
+function computePageStamp(pages, readSource) {
+  const stamp = {};
+  for (const p of pages ?? []) {
+    stamp[p.slug] = {
+      hash: hashPageInputs({ slug: p.slug, title: p.title, source: readSource(p.sourcePath) }),
+      sourcePath: p.sourcePath
+    };
+  }
+  return stamp;
+}
+function selectChangedPages(pages, prevStamp, readSource) {
+  const prev = prevStamp && typeof prevStamp === "object" ? prevStamp : {};
+  const backfill = Object.keys(prev).length === 0;
+  return (pages ?? []).filter((p) => {
+    if (backfill) return true;
+    const prior = prev[p.slug];
+    if (!prior) return true;
+    const cur = hashPageInputs({ slug: p.slug, title: p.title, source: readSource(p.sourcePath) });
+    return prior.hash !== cur;
+  });
+}
+
+// src/wiki-plan-command.ts
+async function wikiPlan(deps, opts) {
+  const wikiRepo = `${opts.repo}.wiki.git`;
+  const pages = deps.collectPages();
+  if (pages.length === 0) {
+    emit(deps, { repo: opts.repo, wikiRepo, backfill: false, pages: [], stamp: {} });
+    return true;
+  }
+  const read = await deps.mintAndReadStamp(opts.repo);
+  if (!read.ok) {
+    deps.err(`wiki plan failed: could not read the wiki stamp for ${opts.repo}: ${read.error}`);
+    return false;
+  }
+  const prevStamp = read.stamp;
+  const backfill = Object.keys(prevStamp).length === 0;
+  const changed = new Set(selectChangedPages(pages, prevStamp, deps.readSource).map((p) => p.slug));
+  const stamp = computePageStamp(pages, deps.readSource);
+  emit(deps, {
+    repo: opts.repo,
+    wikiRepo,
+    backfill,
+    pages: pages.map((p) => ({ ...p, changed: changed.has(p.slug) })),
+    stamp
+  });
+  return true;
+}
+function emit(deps, result) {
+  deps.out(JSON.stringify(result, null, 2));
+}
+
 // src/project-readiness.ts
 function stagesForTrack(meta) {
   return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
@@ -13659,6 +13998,11 @@ function parseFofuEnabledVar(raw) {
   if (raw === "false") return false;
   throw new Error("project set: fofuEnabled must be true or false");
 }
+function parseRuntimeVaultOnlyVar(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error("project set: runtimeVaultOnly must be true or false");
+}
 function parseConsumesDesignSystemVar(raw) {
   if (raw === "fofu") return raw;
   throw new Error('project set: consumesDesignSystem must be "fofu"');
@@ -13736,6 +14080,7 @@ var SETTABLE_VAR_KEYS = [
   "dsManifestPath",
   "fofuEnabled",
   "consumesDesignSystem",
+  "runtimeVaultOnly",
   "requiredGcpApis",
   "requiredRuntimeSecrets",
   "requiredBuildSecrets",
@@ -13758,6 +14103,7 @@ var SETTABLE_VAR_HINTS = {
   dsManifestPath: "relative path to a package.json, e.g. web/package.json",
   fofuEnabled: "true|false",
   consumesDesignSystem: '"fofu"',
+  runtimeVaultOnly: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
@@ -13839,6 +14185,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parsePublishRequiredVar(raw);
     } else if (key === "fofuEnabled") {
       patch[key] = parseFofuEnabledVar(raw);
+    } else if (key === "runtimeVaultOnly") {
+      patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "consumesDesignSystem") {
       patch[key] = parseConsumesDesignSystemVar(raw);
     } else if (key === "publishDir") {
@@ -13876,22 +14224,22 @@ var DEPLOY_STAGES = ["dev", "rc", "main"];
 var DEPLOY_DOMAIN_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
 var DEPLOY_SHELL_SAFE_RE = /^[A-Za-z0-9./:_?&=%-]*$/;
 function buildSetDeployPatch(slug, input) {
-  const clean3 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
-  const stage2 = clean3(input.stage);
+  const clean4 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
+  const stage2 = clean4(input.stage);
   if (!stage2 || !DEPLOY_STAGES.includes(stage2)) {
     throw new Error(`project set-deploy: --stage must be one of: ${DEPLOY_STAGES.join(", ")}`);
   }
-  const substrate = clean3(input.substrate) ?? "hetzner-ssh";
+  const substrate = clean4(input.substrate) ?? "hetzner-ssh";
   if (!DEPLOY_SUBSTRATES.includes(substrate)) {
     throw new Error(`project set-deploy: --substrate must be one of: ${DEPLOY_SUBSTRATES.join(", ")}`);
   }
-  const sshHost = clean3(input.sshHost);
+  const sshHost = clean4(input.sshHost);
   if (substrate === "hetzner-ssh" && !sshHost) {
     throw new Error("project set-deploy: hetzner-ssh requires --ssh-host");
   }
-  const sshUser = clean3(input.sshUser) ?? "root";
-  const deployPath = clean3(input.deployPath) ?? `/opt/mmi/${slug}/${stage2}`;
-  const serviceName = clean3(input.service) ?? slug;
+  const sshUser = clean4(input.sshUser) ?? "root";
+  const deployPath = clean4(input.deployPath) ?? `/opt/mmi/${slug}/${stage2}`;
+  const serviceName = clean4(input.service) ?? slug;
   for (const [label, v] of [["--ssh-host", sshHost], ["--ssh-user", sshUser], ["--deploy-path", deployPath], ["--service", serviceName]]) {
     if (v !== void 0 && !DEPLOY_SHELL_SAFE_RE.test(v)) throw new Error(`project set-deploy: ${label} contains unsafe characters`);
   }
@@ -13900,9 +14248,9 @@ function buildSetDeployPatch(slug, input) {
     port = Number(input.port);
     if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("project set-deploy: --port must be an integer 1..65535");
   }
-  const domain = clean3(input.domain);
+  const domain = clean4(input.domain);
   if (domain !== void 0 && !DEPLOY_DOMAIN_RE.test(domain)) throw new Error(`project set-deploy: --domain must be a DNS hostname, got ${JSON.stringify(input.domain)}`);
-  const aliases = (Array.isArray(input.aliases) ? input.aliases : []).map((a) => clean3(a)).filter((a) => a !== void 0);
+  const aliases = (Array.isArray(input.aliases) ? input.aliases : []).map((a) => clean4(a)).filter((a) => a !== void 0);
   for (const a of aliases) {
     if (!DEPLOY_DOMAIN_RE.test(a)) throw new Error(`project set-deploy: --alias must be a DNS hostname, got ${JSON.stringify(a)}`);
   }
@@ -14809,8 +15157,8 @@ async function secretsUse(deps, key, opts) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs14 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path16 = require("node:path");
 var RAILS_CREDENTIALS_DECRYPT_TIMEOUT_MS = 3e4;
 var DEFAULT_RAILS_CREDENTIALS_FILE = "config/credentials.yml.enc";
 var DEFAULT_RAILS_MASTER_KEY_FILE = "config/master.key";
@@ -14818,18 +15166,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path15.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path16.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path15.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path15.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path16.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path16.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs14.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs14.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs15.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs15.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -14895,7 +15243,7 @@ function registerSecretsCommands(program3) {
   secrets.command("org-catalog").description("MASTER-ONLY: set the _org/<provider>/* catalog declarations from a JSON file (#2244)").requiredOption("--file <path>", 'JSON file: { "entries": { "<provider>/<KEY>": {key,purpose,group,owner,provider,stages[],consumers[]} } }').action((o) => withSecrets(async (d) => {
     let body;
     try {
-      body = (0, import_node_fs14.readFileSync)((0, import_node_path15.resolve)(o.file), "utf8");
+      body = (0, import_node_fs15.readFileSync)((0, import_node_path16.resolve)(o.file), "utf8");
     } catch (e) {
       return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
     }
@@ -14970,7 +15318,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs14.unlinkSync)((0, import_node_path15.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs15.unlinkSync)((0, import_node_path16.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -15059,10 +15407,10 @@ function registerEdgeCommands(program3) {
 }
 
 // src/doctor-run.ts
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 var import_node_child_process11 = require("node:child_process");
 var import_promises2 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 var import_node_os7 = require("node:os");
 
 // src/plugin-guard.ts
@@ -15085,9 +15433,9 @@ function buildGuardSessionStartLine(state, opts = {}) {
 
 // src/cursor-plugin-seed.ts
 var import_node_child_process10 = require("node:child_process");
-var import_node_fs15 = require("node:fs");
+var import_node_fs16 = require("node:fs");
 var import_node_os6 = require("node:os");
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 var import_node_util7 = require("node:util");
 
 // src/doctor.ts
@@ -16407,17 +16755,17 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path16.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path16.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
+    const base = process.env.APPDATA || (0, import_node_path17.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path17.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path16.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path17.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path16.join)((0, import_node_os6.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path17.join)((0, import_node_os6.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
-  if (!(0, import_node_fs15.existsSync)(dbPath)) return void 0;
+  if (!(0, import_node_fs16.existsSync)(dbPath)) return void 0;
   try {
     const { stdout } = await execFileP5("sqlite3", [dbPath, `SELECT value FROM ItemTable WHERE key = '${CURSOR_THIRD_PARTY_STATE_KEY}';`], {
       timeout: 5e3
@@ -16431,57 +16779,57 @@ async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   }
 }
 function syncDirContents(src, dest) {
-  (0, import_node_fs15.mkdirSync)(dest, { recursive: true });
-  for (const name of (0, import_node_fs15.readdirSync)(dest)) {
-    (0, import_node_fs15.rmSync)((0, import_node_path16.join)(dest, name), { recursive: true, force: true });
+  (0, import_node_fs16.mkdirSync)(dest, { recursive: true });
+  for (const name of (0, import_node_fs16.readdirSync)(dest)) {
+    (0, import_node_fs16.rmSync)((0, import_node_path17.join)(dest, name), { recursive: true, force: true });
   }
-  (0, import_node_fs15.cpSync)(src, dest, { recursive: true });
+  (0, import_node_fs16.cpSync)(src, dest, { recursive: true });
 }
 function releaseTag(releasedVersion) {
   return releasedVersion.startsWith("v") ? releasedVersion : `v${releasedVersion}`;
 }
 async function extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5) {
-  const tarFile = (0, import_node_path16.join)(tmpRoot, "archive.tar");
+  const tarFile = (0, import_node_path17.join)(tmpRoot, "archive.tar");
   try {
     await execFileP5("git", gitFetchReleaseTagArgs(hubCheckout, tag), { timeout: 6e4 });
     await execFileP5("git", ["-C", hubCheckout, "archive", "--format=tar", `--output=${tarFile}`, tag, "plugins/mmi"], {
       timeout: 6e4
     });
     await execFileP5("tar", ["-xf", tarFile, "-C", tmpRoot], { timeout: 6e4 });
-    const pluginMmi = (0, import_node_path16.join)(tmpRoot, "plugins", "mmi");
-    return (0, import_node_fs15.existsSync)((0, import_node_path16.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path17.join)(tmpRoot, "plugins", "mmi");
+    return (0, import_node_fs16.existsSync)((0, import_node_path17.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function downloadPluginMmiViaGh(tag, tmpRoot) {
-  const tarPath = (0, import_node_path16.join)(tmpRoot, "repo.tgz");
+  const tarPath = (0, import_node_path17.join)(tmpRoot, "repo.tgz");
   try {
-    (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
+    (0, import_node_fs16.mkdirSync)(tmpRoot, { recursive: true });
     const { stdout } = await execFileBuffer("gh", ghReleaseTarballApiArgs(tag), {
       timeout: 12e4,
       maxBuffer: 100 * 1024 * 1024,
       encoding: "buffer",
       windowsHide: true
     });
-    (0, import_node_fs15.writeFileSync)(tarPath, stdout);
+    (0, import_node_fs16.writeFileSync)(tarPath, stdout);
     await execFileBuffer("tar", ["-xzf", tarPath, "-C", tmpRoot], { timeout: 12e4, windowsHide: true });
-    const top = (0, import_node_fs15.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
+    const top = (0, import_node_fs16.readdirSync)(tmpRoot).find((entry) => entry !== "repo.tgz");
     if (!top) return void 0;
-    const pluginMmi = (0, import_node_path16.join)(tmpRoot, top, "plugins", "mmi");
-    return (0, import_node_fs15.existsSync)((0, import_node_path16.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
+    const pluginMmi = (0, import_node_path17.join)(tmpRoot, top, "plugins", "mmi");
+    return (0, import_node_fs16.existsSync)((0, import_node_path17.join)(pluginMmi, PLUGIN_JSON_REL)) ? pluginMmi : void 0;
   } catch {
     return void 0;
   }
 }
 async function resolvePluginMmiSource(releasedVersion, hubCheckout, tmpRoot, execFileP5) {
-  (0, import_node_fs15.mkdirSync)(tmpRoot, { recursive: true });
+  (0, import_node_fs16.mkdirSync)(tmpRoot, { recursive: true });
   const tag = releaseTag(releasedVersion);
   if (hubCheckout) {
     const fromHub = await extractPluginMmiFromHubCheckout(hubCheckout, tag, tmpRoot, execFileP5);
     if (fromHub) return fromHub;
   }
-  return downloadPluginMmiViaGh(tag, (0, import_node_path16.join)(tmpRoot, "gh"));
+  return downloadPluginMmiViaGh(tag, (0, import_node_path17.join)(tmpRoot, "gh"));
 }
 function cursorPluginPinsNeedingSeed(pins, releasedVersion) {
   if (!isSemverVersion2(releasedVersion)) return pins.filter((pin) => !pin.hasPluginJson || !pin.hasHooksJson || pin.isEmpty);
@@ -16495,7 +16843,7 @@ function cursorPluginCacheSeedTargets(pins, releasedVersion, cacheRoot, cacheRoo
   const needing = cursorPluginPinsNeedingSeed(pins, releasedVersion);
   if (needing.length > 0) return needing.map((pin) => pin.path);
   if (pins.length === 0 && cacheRoot && cacheRootExists && isSemverVersion2(releasedVersion)) {
-    return [(0, import_node_path16.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
+    return [(0, import_node_path17.join)(cacheRoot, `v${releasedVersion.replace(/^v/, "")}`)];
   }
   return [];
 }
@@ -16510,7 +16858,7 @@ async function applyCursorPluginCacheSeed(input) {
   for (const dest of targets) {
     syncDirContents(source, dest);
   }
-  (0, import_node_fs15.rmSync)(tmpRoot, { recursive: true, force: true });
+  (0, import_node_fs16.rmSync)(tmpRoot, { recursive: true, force: true });
   return true;
 }
 var CURSOR_ENABLED_PIN_LABEL = "Cursor Team Marketplace enabled plugin pin";
@@ -16869,9 +17217,9 @@ ${block}
 }
 
 // src/cli-doctor-shared.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path17 = require("node:path");
 var import_node_fs17 = require("node:fs");
+var import_node_path18 = require("node:path");
+var import_node_fs18 = require("node:fs");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function awsCallerArn() {
   try {
@@ -16917,7 +17265,7 @@ async function localBranchHeads() {
 }
 async function currentRepoWorktreeGitRoot(repoRoot) {
   const gitCommonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-  return gitCommonDir ? (0, import_node_path17.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
+  return gitCommonDir ? (0, import_node_path18.resolve)(repoRoot, gitCommonDir, "worktrees") : "";
 }
 async function worktreeBranches() {
   const { stdout } = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
@@ -16937,18 +17285,18 @@ function resolveGitdirForWorktreeFile(worktreePath, content) {
   const match = /^gitdir:\s*(.+)\s*$/im.exec(content);
   if (!match?.[1]) return void 0;
   const raw = match[1].trim();
-  return (0, import_node_path17.isAbsolute)(raw) ? raw : (0, import_node_path17.resolve)(worktreePath, raw);
+  return (0, import_node_path18.isAbsolute)(raw) ? raw : (0, import_node_path18.resolve)(worktreePath, raw);
 }
 function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
   if (!worktreeGitRoot) return false;
   try {
-    const entries = (0, import_node_fs17.readdirSync)(worktreeGitRoot, { withFileTypes: true });
+    const entries = (0, import_node_fs18.readdirSync)(worktreeGitRoot, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       try {
-        const gitdirPath = (0, import_node_fs16.readFileSync)((0, import_node_path17.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
-        const resolvedGitdir = (0, import_node_path17.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path17.resolve)(worktreeGitRoot, ent.name, gitdirPath);
-        if (sameWorktreeMetadataPath((0, import_node_path17.dirname)(resolvedGitdir), worktreePath)) return true;
+        const gitdirPath = (0, import_node_fs17.readFileSync)((0, import_node_path18.join)(worktreeGitRoot, ent.name, "gitdir"), "utf8").trim();
+        const resolvedGitdir = (0, import_node_path18.isAbsolute)(gitdirPath) ? gitdirPath : (0, import_node_path18.resolve)(worktreeGitRoot, ent.name, gitdirPath);
+        if (sameWorktreeMetadataPath((0, import_node_path18.dirname)(resolvedGitdir), worktreePath)) return true;
       } catch {
       }
     }
@@ -16958,7 +17306,7 @@ function metadataOwnsMissingWorktreeDir(worktreePath, worktreeGitRoot) {
 }
 function pathExistsKnown(path2) {
   try {
-    (0, import_node_fs17.statSync)(path2);
+    (0, import_node_fs18.statSync)(path2);
     return true;
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
@@ -16967,10 +17315,10 @@ function pathExistsKnown(path2) {
   }
 }
 function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
-  const gitPath = (0, import_node_path17.join)(path2, ".git");
+  const gitPath = (0, import_node_path18.join)(path2, ".git");
   let st;
   try {
-    st = (0, import_node_fs17.lstatSync)(gitPath);
+    st = (0, import_node_fs18.lstatSync)(gitPath);
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -16987,7 +17335,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
   if (st.isDirectory()) return { path: path2, gitType: "dir" };
   if (!st.isFile()) return { path: path2, gitType: "other" };
   try {
-    const gitFileContent = (0, import_node_fs16.readFileSync)(gitPath, "utf8");
+    const gitFileContent = (0, import_node_fs17.readFileSync)(gitPath, "utf8");
     const gitdir = resolveGitdirForWorktreeFile(path2, gitFileContent);
     const gitDirExists = gitdir ? pathExistsKnown(gitdir) : false;
     return {
@@ -17004,7 +17352,7 @@ function inspectSiblingWorktreeDir(path2, worktreeGitRoot) {
 }
 function inspectDeadWorktreeDirContent(path2) {
   try {
-    return { entries: (0, import_node_fs17.readdirSync)(path2) };
+    return { entries: (0, import_node_fs18.readdirSync)(path2) };
   } catch (e) {
     const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
     return { error: code ? `unable to inspect directory contents (${code})` : "unable to inspect directory contents" };
@@ -17023,8 +17371,8 @@ async function siblingWorktreeDirs() {
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot);
   const siblingRoot = siblingMmiWorktreesRoot(repoRoot);
   try {
-    const entries = (0, import_node_fs17.readdirSync)(siblingRoot, { withFileTypes: true });
-    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path17.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
+    const entries = (0, import_node_fs18.readdirSync)(siblingRoot, { withFileTypes: true });
+    return entries.filter((ent) => ent.isDirectory()).map((ent) => inspectSiblingWorktreeDir((0, import_node_path18.join)(siblingRoot, ent.name), worktreeGitRoot)).filter((entry) => Boolean(entry));
   } catch {
     return [];
   }
@@ -17074,7 +17422,7 @@ async function fetchHubVersionInfo(baseUrl) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path19.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -17226,11 +17574,11 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs18.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -17238,13 +17586,13 @@ function readInstalledPlugins(surface = detectSurface(process.env)) {
 function marketplaceCloneCandidates(surface, home) {
   if (surface === "codex") {
     return [
-      (0, import_node_path18.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path18.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path19.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
+      (0, import_node_path19.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
     ];
   }
-  return [(0, import_node_path18.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path19.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs18.existsSync) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs19.existsSync) {
   return marketplaceCloneCandidates(surface, home).some(exists);
 }
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
@@ -17254,14 +17602,14 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
-    pluginCachePresent: (0, import_node_fs18.existsSync)((0, import_node_path18.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: (0, import_node_fs19.existsSync)((0, import_node_path19.join)((0, import_node_os7.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path19.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
-      return { surface, installed: JSON.parse((0, import_node_fs18.readFileSync)(recordPath, "utf8")), recordPath };
+      return { surface, installed: JSON.parse((0, import_node_fs19.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
       return { surface, installed: null, recordPath };
     }
@@ -17269,7 +17617,7 @@ function installedPluginSources() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path19.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -17291,7 +17639,7 @@ function writeProjectInstallRecord(record) {
     const list = file.plugins[MMI_PLUGIN_ID] ?? [];
     list.push(record);
     file.plugins[MMI_PLUGIN_ID] = list;
-    (0, import_node_fs18.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs19.writeFileSync)(installedPluginsPath(), `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17304,9 +17652,9 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
     if (!file) return false;
     if (!file.plugins) file.plugins = {};
     const path2 = installedPluginsPath();
-    (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
     file.plugins[pluginId] = records;
-    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
+    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify(file, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17314,22 +17662,22 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "opencode");
+  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
-  return (0, import_node_path18.join)(opencodeConfigDir(), "opencode.jsonc");
+  return (0, import_node_path19.join)(opencodeConfigDir(), "opencode.jsonc");
 }
 function opencodeCommandsDir() {
-  return (0, import_node_path18.join)(opencodeConfigDir(), "commands");
+  return (0, import_node_path19.join)(opencodeConfigDir(), "commands");
 }
 function opencodeSkillsPath() {
-  return (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
+  return (0, import_node_path19.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "skills");
 }
 function opencodeConfigSnapshot() {
   const path2 = opencodeConfigPath();
-  if (!(0, import_node_fs18.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
+  if (!(0, import_node_fs19.existsSync)(path2)) return { path: path2, hasConfig: false, hasPluginField: false, parseOk: true };
   try {
-    const raw = (0, import_node_fs18.readFileSync)(path2, "utf8");
+    const raw = (0, import_node_fs19.readFileSync)(path2, "utf8");
     const parsed = JSON.parse(stripJsonc(raw));
     const hasPluginField = Object.prototype.hasOwnProperty.call(parsed, "plugin");
     const skillsPaths = Array.isArray(parsed.skills?.paths) ? parsed.skills.paths.filter((p) => typeof p === "string") : void 0;
@@ -17352,9 +17700,9 @@ function writeOpencodeConfigPlugin(snapshot) {
     const plan = planOpencodeConfigWrite(snapshot.hasConfig ? snapshot.raw : void 0);
     if (plan.action === "already") return true;
     if (!plan.text || plan.action === "unsafe") return false;
-    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
-    if (snapshot.hasConfig) (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs18.writeFileSync)(path2, plan.text, "utf8");
+    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(path2), { recursive: true });
+    if (snapshot.hasConfig) (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs19.writeFileSync)(path2, plan.text, "utf8");
     return true;
   } catch {
     return false;
@@ -17369,9 +17717,9 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
     const normalized = skillsPath.replace(/\\/g, "/");
     if (!paths.some((p) => p.replace(/\\/g, "/") === normalized)) paths.push(skillsPath.replace(/\\/g, "/"));
     parsed.skills = { ...skills, paths };
-    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(snapshot.path), { recursive: true });
-    if (snapshot.hasConfig && (0, import_node_fs18.existsSync)(snapshot.path)) (0, import_node_fs18.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
-    (0, import_node_fs18.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
+    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(snapshot.path), { recursive: true });
+    if (snapshot.hasConfig && (0, import_node_fs19.existsSync)(snapshot.path)) (0, import_node_fs19.copyFileSync)(snapshot.path, `${snapshot.path}.bak`);
+    (0, import_node_fs19.writeFileSync)(snapshot.path, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
     return true;
   } catch {
@@ -17380,7 +17728,7 @@ function writeOpencodeSkillsPath(snapshot, skillsPath) {
 }
 function opencodeExistingCommands() {
   try {
-    return (0, import_node_fs18.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
+    return (0, import_node_fs19.readdirSync)(opencodeCommandsDir(), { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name.slice(0, -3).toLowerCase());
   } catch {
     return [];
   }
@@ -17388,9 +17736,9 @@ function opencodeExistingCommands() {
 function writeOpencodeCommandFiles() {
   try {
     const dir = opencodeCommandsDir();
-    (0, import_node_fs18.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
     for (const command of OPENCODE_WORKFLOW_COMMANDS) {
-      (0, import_node_fs18.writeFileSync)((0, import_node_path18.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
+      (0, import_node_fs19.writeFileSync)((0, import_node_path19.join)(dir, `${command}.md`), opencodeCommandMarkdown(command), "utf8");
     }
     return true;
   } catch {
@@ -17399,12 +17747,12 @@ function writeOpencodeCommandFiles() {
 }
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
-    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path19.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
+    (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
-      const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim()) return parsed.version.trim();
     } catch {
       continue;
@@ -17420,7 +17768,7 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   try {
     const specs = opencodeMmiPluginSpecs(snapshot);
     log(`  \u21BB force-refreshing OpenCode MMI npm plugin(s): ${specs.join(", ")}\u2026`);
-    (0, import_node_fs18.mkdirSync)(opencodeConfigDir(), { recursive: true });
+    (0, import_node_fs19.mkdirSync)(opencodeConfigDir(), { recursive: true });
     await runHostBin("npm", ["install", "--prefix", opencodeConfigDir(), "--force", ...specs], { timeout: NPM_UPDATE_TIMEOUT_MS });
     return true;
   } catch {
@@ -17428,12 +17776,12 @@ async function forceInstallOpencodeMmiPlugins(snapshot, log) {
   }
 }
 function opencodePackagesRoot() {
-  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
+  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", "@mutmutco");
 }
 function opencodePluginCacheDirs() {
   const root = opencodePackagesRoot();
   try {
-    return (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path18.join)(root, e.name));
+    return (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("opencode-mmi@") && !e.name.startsWith(".")).map((e) => (0, import_node_path19.join)(root, e.name));
   } catch {
     return [];
   }
@@ -17441,7 +17789,7 @@ function opencodePluginCacheDirs() {
 function readOpencodeCacheDirVersion(cacheDir) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs18.readFileSync)((0, import_node_path18.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
+      (0, import_node_fs19.readFileSync)((0, import_node_path19.join)(cacheDir, "node_modules", "@mutmutco", "opencode-mmi", "package.json"), "utf8")
     );
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
   } catch {
@@ -17464,9 +17812,9 @@ function quarantineStaleOpencodePluginCaches(releasedVersion, log) {
     });
     if (!plan.quarantine) continue;
     try {
-      const quarantineRoot = (0, import_node_path18.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
-      (0, import_node_fs18.mkdirSync)(quarantineRoot, { recursive: true });
-      (0, import_node_fs18.renameSync)(cacheDir, (0, import_node_path18.join)(quarantineRoot, (0, import_node_path18.basename)(cacheDir)));
+      const quarantineRoot = (0, import_node_path19.join)(opencodePackagesRoot(), ".mmi-quarantine", stamp);
+      (0, import_node_fs19.mkdirSync)(quarantineRoot, { recursive: true });
+      (0, import_node_fs19.renameSync)(cacheDir, (0, import_node_path19.join)(quarantineRoot, (0, import_node_path19.basename)(cacheDir)));
       log(`  \u21BB quarantined stale OpenCode plugin cache ${plan.cacheVersion} (< ${plan.releasedVersion}) \u2014 OpenCode reinstalls the current adapter on next start`);
       moved = true;
     } catch {
@@ -17492,30 +17840,30 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path18.join)((0, import_node_os7.homedir)(), "AppData", "Roaming");
-    return (0, import_node_path18.join)(base, "ai.opencode.desktop", "logs");
+    const base = process.env.APPDATA || (0, import_node_path19.join)((0, import_node_os7.homedir)(), "AppData", "Roaming");
+    return (0, import_node_path19.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path19.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
   try {
-    const sessionDirs = (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path18.join)(root, entry.name)).sort((a, b) => (0, import_node_fs18.statSync)(b).mtimeMs - (0, import_node_fs18.statSync)(a).mtimeMs);
+    const sessionDirs = (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => (0, import_node_path19.join)(root, entry.name)).sort((a, b) => (0, import_node_fs19.statSync)(b).mtimeMs - (0, import_node_fs19.statSync)(a).mtimeMs);
     const newest = sessionDirs[0];
     if (!newest) return [];
-    const logPath = (0, import_node_path18.join)(newest, "renderer.log");
-    const text = (0, import_node_fs18.readFileSync)(logPath, "utf8");
-    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs18.existsSync)(directory)).map((directory) => ({ directory, logPath }));
+    const logPath = (0, import_node_path19.join)(newest, "renderer.log");
+    const text = (0, import_node_fs19.readFileSync)(logPath, "utf8");
+    return opencodeAgentDirectoriesFromLog(text).filter((directory) => !(0, import_node_fs19.existsSync)(directory)).map((directory) => ({ directory, logPath }));
   } catch {
     return [];
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".opencode", "opencode.json");
-  if (!(0, import_node_fs18.existsSync)(legacyPath)) return {};
+  const legacyPath = (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".opencode", "opencode.json");
+  if (!(0, import_node_fs19.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
   const plugins = parseOpencodeLegacyConfigPlugins(content);
@@ -17527,24 +17875,24 @@ function opencodeLegacyConfigSnapshot() {
 function quarantineOpencodeLegacyConfig(legacyPath) {
   try {
     const backupPath = `${legacyPath}.bak`;
-    if ((0, import_node_fs18.existsSync)(backupPath)) return false;
-    (0, import_node_fs18.renameSync)(legacyPath, backupPath);
+    if ((0, import_node_fs19.existsSync)(backupPath)) return false;
+    (0, import_node_fs19.renameSync)(legacyPath, backupPath);
     return true;
   } catch {
     return false;
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorLogsRoot() {
-  if (process.platform === "win32") return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "AppData", "Roaming", "Cursor", "logs");
-  if (process.platform === "darwin") return (0, import_node_path18.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "Cursor", "logs");
-  return (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".config", "Cursor", "logs");
+  if (process.platform === "win32") return (0, import_node_path19.join)((0, import_node_os7.homedir)(), "AppData", "Roaming", "Cursor", "logs");
+  if (process.platform === "darwin") return (0, import_node_path19.join)((0, import_node_os7.homedir)(), "Library", "Application Support", "Cursor", "logs");
+  return (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".config", "Cursor", "logs");
 }
 function safeReaddirNames(dir) {
   try {
-    return (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true }).map((e) => e.name);
+    return (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true }).map((e) => e.name);
   } catch {
     return [];
   }
@@ -17553,15 +17901,15 @@ function readCursorPluginLogText() {
   const root = cursorLogsRoot();
   const sessions = safeReaddirNames(root).sort().reverse();
   for (const session of sessions.slice(0, 5)) {
-    const sessionDir = (0, import_node_path18.join)(root, session);
+    const sessionDir = (0, import_node_path19.join)(root, session);
     const texts = [];
     for (const win of safeReaddirNames(sessionDir).filter((n) => n.startsWith("window"))) {
-      const dir = (0, import_node_path18.join)(sessionDir, win, "exthost", "anysphere.cursor-agent-exec");
+      const dir = (0, import_node_path19.join)(sessionDir, win, "exthost", "anysphere.cursor-agent-exec");
       for (const file of safeReaddirNames(dir)) {
         if (!/^Cursor Plugins.*\.log$/i.test(file)) continue;
-        const path2 = (0, import_node_path18.join)(dir, file);
+        const path2 = (0, import_node_path19.join)(dir, file);
         try {
-          texts.push({ text: (0, import_node_fs18.readFileSync)(path2, "utf8"), mtime: (0, import_node_fs18.statSync)(path2).mtimeMs });
+          texts.push({ text: (0, import_node_fs19.readFileSync)(path2, "utf8"), mtime: (0, import_node_fs19.statSync)(path2).mtimeMs });
         } catch {
         }
       }
@@ -17575,32 +17923,32 @@ function readCursorPluginLogText() {
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
   try {
-    return (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
-      const path2 = (0, import_node_path18.join)(root, entry.name);
-      const pluginJson = (0, import_node_path18.join)(path2, ".cursor-plugin", "plugin.json");
-      const hooksJson = (0, import_node_path18.join)(path2, "hooks", "hooks.json");
-      const cliBundle = (0, import_node_path18.join)(path2, "cli", "dist", "index.cjs");
-      const cursorHook = (0, import_node_path18.join)(path2, "scripts", "cursor-hook.mjs");
+    return (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => {
+      const path2 = (0, import_node_path19.join)(root, entry.name);
+      const pluginJson = (0, import_node_path19.join)(path2, ".cursor-plugin", "plugin.json");
+      const hooksJson = (0, import_node_path19.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path19.join)(path2, "cli", "dist", "index.cjs");
+      const cursorHook = (0, import_node_path19.join)(path2, "scripts", "cursor-hook.mjs");
       let version;
       try {
-        const raw = JSON.parse((0, import_node_fs18.readFileSync)(pluginJson, "utf8"));
+        const raw = JSON.parse((0, import_node_fs19.readFileSync)(pluginJson, "utf8"));
         version = typeof raw.version === "string" ? raw.version : void 0;
       } catch {
         version = void 0;
       }
       let isEmpty = true;
       try {
-        isEmpty = (0, import_node_fs18.readdirSync)(path2).length === 0;
+        isEmpty = (0, import_node_fs19.readdirSync)(path2).length === 0;
       } catch {
         isEmpty = true;
       }
       return {
         name: entry.name,
         path: path2,
-        hasPluginJson: (0, import_node_fs18.existsSync)(pluginJson),
-        hasHooksJson: (0, import_node_fs18.existsSync)(hooksJson),
-        hasCliBundle: (0, import_node_fs18.existsSync)(cliBundle),
-        hasCursorHookScript: (0, import_node_fs18.existsSync)(cursorHook),
+        hasPluginJson: (0, import_node_fs19.existsSync)(pluginJson),
+        hasHooksJson: (0, import_node_fs19.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs19.existsSync)(cliBundle),
+        hasCursorHookScript: (0, import_node_fs19.existsSync)(cursorHook),
         isEmpty,
         version
       };
@@ -17610,19 +17958,19 @@ function cursorPluginCachePinSnapshots() {
   }
 }
 function hubCheckoutForCursorSeed() {
-  const manifest = (0, import_node_path18.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
-  return (0, import_node_fs18.existsSync)(manifest) ? process.cwd() : void 0;
+  const manifest = (0, import_node_path19.join)(process.cwd(), "plugins", "mmi", ".cursor-plugin", "plugin.json");
+  return (0, import_node_fs19.existsSync)(manifest) ? process.cwd() : void 0;
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path19.join)((0, import_node_os7.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
-      const entries = (0, import_node_fs18.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
+      const entries = (0, import_node_fs19.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path18.join)(root, entry.name),
+        path: (0, import_node_path19.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -17633,7 +17981,7 @@ function mmiPluginCacheRootSnapshots() {
 }
 function hasNestedMmiChild(versionDir) {
   try {
-    return (0, import_node_fs18.statSync)((0, import_node_path18.join)(versionDir, "mmi")).isDirectory();
+    return (0, import_node_fs19.statSync)((0, import_node_path19.join)(versionDir, "mmi")).isDirectory();
   } catch {
     return false;
   }
@@ -17644,10 +17992,10 @@ function nestedPluginTreeSnapshot() {
   );
 }
 function uniqueQuarantineTarget(path2) {
-  if (!(0, import_node_fs18.existsSync)(path2)) return path2;
+  if (!(0, import_node_fs19.existsSync)(path2)) return path2;
   for (let i = 1; i < 100; i += 1) {
     const candidate = `${path2}-${i}`;
-    if (!(0, import_node_fs18.existsSync)(candidate)) return candidate;
+    if (!(0, import_node_fs19.existsSync)(candidate)) return candidate;
   }
   return `${path2}-${Date.now()}`;
 }
@@ -17656,10 +18004,10 @@ function quarantinePluginCacheDirs(plan) {
   const failed = [];
   for (const move of plan) {
     try {
-      if (!(0, import_node_fs18.existsSync)(move.from)) continue;
+      if (!(0, import_node_fs19.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(target), { recursive: true });
-      (0, import_node_fs18.renameSync)(move.from, target);
+      (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(target), { recursive: true });
+      (0, import_node_fs19.renameSync)(move.from, target);
       moved += 1;
     } catch {
       failed.push(move);
@@ -17678,23 +18026,23 @@ async function robocopyMirrorEmpty(emptyDir, target) {
 }
 async function clearNestedPluginTreeDir(targetPath) {
   try {
-    if (!(0, import_node_fs18.existsSync)(targetPath)) return true;
+    if (!(0, import_node_fs19.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path18.join)((0, import_node_os7.tmpdir)(), `mmi-empty-${Date.now()}`);
-      (0, import_node_fs18.mkdirSync)(emptyDir, { recursive: true });
+      const emptyDir = (0, import_node_path19.join)((0, import_node_os7.tmpdir)(), `mmi-empty-${Date.now()}`);
+      (0, import_node_fs19.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
-        (0, import_node_fs18.rmSync)(targetPath, { recursive: true, force: true });
+        (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
       } finally {
         try {
-          (0, import_node_fs18.rmSync)(emptyDir, { recursive: true, force: true });
+          (0, import_node_fs19.rmSync)(emptyDir, { recursive: true, force: true });
         } catch {
         }
       }
-      return !(0, import_node_fs18.existsSync)(targetPath);
+      return !(0, import_node_fs19.existsSync)(targetPath);
     }
-    (0, import_node_fs18.rmSync)(targetPath, { recursive: true, force: true });
-    return !(0, import_node_fs18.existsSync)(targetPath);
+    (0, import_node_fs19.rmSync)(targetPath, { recursive: true, force: true });
+    return !(0, import_node_fs19.existsSync)(targetPath);
   } catch {
     return false;
   }
@@ -17707,18 +18055,18 @@ async function applyNestedPluginTreeCleanup(paths, log) {
   }
   return true;
 }
-var gitignorePath = () => (0, import_node_path18.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path19.join)(process.cwd(), ".gitignore");
 function readTextFile(path2) {
   try {
-    if (!(0, import_node_fs18.existsSync)(path2)) return null;
-    return (0, import_node_fs18.readFileSync)(path2, "utf8");
+    if (!(0, import_node_fs19.existsSync)(path2)) return null;
+    return (0, import_node_fs19.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
 }
 function mcpDirExists(path2) {
   try {
-    return (0, import_node_fs18.existsSync)(path2);
+    return (0, import_node_fs19.existsSync)(path2);
   } catch {
     return false;
   }
@@ -17726,60 +18074,60 @@ function mcpDirExists(path2) {
 function mcpConfigTargets() {
   const cwd = process.cwd();
   const home = (0, import_node_os7.homedir)();
-  const cursorProjectDir = (0, import_node_path18.join)(cwd, ".cursor");
-  const cursorUserDir = (0, import_node_path18.join)(home, ".cursor");
-  const codexDir = (0, import_node_path18.join)(home, ".codex");
+  const cursorProjectDir = (0, import_node_path19.join)(cwd, ".cursor");
+  const cursorUserDir = (0, import_node_path19.join)(home, ".cursor");
+  const codexDir = (0, import_node_path19.join)(home, ".codex");
   return [
     // Claude Code project MCP — reconciled if present, never conjured (org seeds .cursor/mcp.json, not this).
     {
       host: "claude-code",
       label: "Claude Code project MCP",
-      path: (0, import_node_path18.join)(cwd, ".mcp.json"),
+      path: (0, import_node_path19.join)(cwd, ".mcp.json"),
       format: "json",
       present: true,
       // parent is the repo root (cwd); the caller gates the whole reconcile on isOrgRepo
       isRepoFile: true,
       createWhenFileAbsent: false,
-      content: readTextFile((0, import_node_path18.join)(cwd, ".mcp.json"))
+      content: readTextFile((0, import_node_path19.join)(cwd, ".mcp.json"))
     },
     // Cursor project MCP — the bootstrap-seeded surface; restored if its .cursor dir exists but the file is gone.
     {
       host: "cursor-project",
       label: "Cursor project MCP",
-      path: (0, import_node_path18.join)(cursorProjectDir, "mcp.json"),
+      path: (0, import_node_path19.join)(cursorProjectDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorProjectDir),
       isRepoFile: true,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path18.join)(cursorProjectDir, "mcp.json"))
+      content: readTextFile((0, import_node_path19.join)(cursorProjectDir, "mcp.json"))
     },
     // Cursor user MCP — global; written only when Cursor is installed (~/.cursor exists).
     {
       host: "cursor-user",
       label: "Cursor user MCP",
-      path: (0, import_node_path18.join)(cursorUserDir, "mcp.json"),
+      path: (0, import_node_path19.join)(cursorUserDir, "mcp.json"),
       format: "json",
       present: mcpDirExists(cursorUserDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path18.join)(cursorUserDir, "mcp.json"))
+      content: readTextFile((0, import_node_path19.join)(cursorUserDir, "mcp.json"))
     },
     // Codex user config (TOML) — global; written only when Codex is installed (~/.codex exists).
     {
       host: "codex",
       label: "Codex user config",
-      path: (0, import_node_path18.join)(codexDir, "config.toml"),
+      path: (0, import_node_path19.join)(codexDir, "config.toml"),
       format: "toml",
       present: mcpDirExists(codexDir),
       isRepoFile: false,
       createWhenFileAbsent: true,
-      content: readTextFile((0, import_node_path18.join)(codexDir, "config.toml"))
+      content: readTextFile((0, import_node_path19.join)(codexDir, "config.toml"))
     }
   ];
 }
 function writeMcpConfigFile(path2, content) {
   try {
-    (0, import_node_fs18.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs19.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -17859,7 +18207,7 @@ function strayBrowserArtifactPaths() {
   const cwd = process.cwd();
   return STRAY_BROWSER_ARTIFACT_DIRS.filter((rel) => {
     try {
-      return (0, import_node_fs18.existsSync)((0, import_node_path18.join)(cwd, rel));
+      return (0, import_node_fs19.existsSync)((0, import_node_path19.join)(cwd, rel));
     } catch {
       return false;
     }
@@ -17867,14 +18215,14 @@ function strayBrowserArtifactPaths() {
 }
 function readGitignore() {
   try {
-    return (0, import_node_fs18.readFileSync)(gitignorePath(), "utf8");
+    return (0, import_node_fs19.readFileSync)(gitignorePath(), "utf8");
   } catch {
     return null;
   }
 }
 function writeGitignore(content) {
   try {
-    (0, import_node_fs18.writeFileSync)(gitignorePath(), content, "utf8");
+    (0, import_node_fs19.writeFileSync)(gitignorePath(), content, "utf8");
     return true;
   } catch {
     return false;
@@ -17916,7 +18264,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   const semverPrefix = /^\d+\.\d+\.\d+/;
   const isBehind = (installed2, released) => Boolean(installed2 && released && semverPrefix.test(installed2) && semverPrefix.test(released) && compareVersions(installed2, released) < 0);
   const opencodeAdapterStale = isBehind(opencodeInstalledVersionForDoctor(), releasedVersion);
-  const cursorCacheStale = (0, import_node_fs18.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
+  const cursorCacheStale = (0, import_node_fs19.existsSync)(cursorPluginCacheRoot()) && (cursorPluginCachePinSnapshots() ?? []).some((p) => isBehind(p.version, releasedVersion));
   const healPlan = doctorHealPlan({
     isOrgRepo,
     surface,
@@ -17951,7 +18299,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   let onPath = pathProbe;
   if (!onPath) {
     const root = process.env.CLAUDE_PLUGIN_ROOT;
-    if (root && (0, import_node_fs18.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
+    if (root && (0, import_node_fs19.existsSync)(`${root}/bin/mmi-cli${isWin ? ".cmd" : ""}`)) onPath = true;
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const reloadHint = reloadAction(surface);
@@ -18098,7 +18446,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   checks.push(gitignoreCheck);
   checks.push(buildRepoLocalWorktreeCheck({
     isOrgRepo,
-    hasRepoLocalWorktrees: (0, import_node_fs18.existsSync)((0, import_node_path18.join)(process.cwd(), ".worktrees"))
+    hasRepoLocalWorktrees: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), ".worktrees"))
   }));
   let driftCheck = buildPluginConfigDriftCheck({ isOrgRepo, installed, surface });
   if (!driftCheck.ok && driftCheck.recordsToWrite && repairLocal) {
@@ -18387,7 +18735,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
   }
   checks.push(nestedPluginTreeCheck);
   const cursorCacheRoot = cursorPluginCacheRoot();
-  const cursorCacheRootExists = (0, import_node_fs18.existsSync)(cursorCacheRoot);
+  const cursorCacheRootExists = (0, import_node_fs19.existsSync)(cursorCacheRoot);
   let cursorPins = cursorPluginCachePinSnapshots() ?? [];
   checks.push(
     buildCursorPluginCacheCleanupCheck({
@@ -18415,7 +18763,7 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
       cacheRootExists: cursorCacheRootExists,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path18.join)((0, import_node_os7.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises2.mkdtemp)((0, import_node_path19.join)((0, import_node_os7.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -18610,23 +18958,23 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path18.join)((0, import_node_os7.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path19.join)((0, import_node_os7.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
     let current = null;
-    if ((0, import_node_fs18.existsSync)(path2)) {
+    if ((0, import_node_fs19.existsSync)(path2)) {
       try {
-        current = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+        current = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
       } catch {
         return "failed";
       }
     }
     if (settingsHasGuardHook(current)) return "already";
     const merged = mergeGuardHook(current);
-    (0, import_node_fs18.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
-    if ((0, import_node_fs18.existsSync)(path2)) (0, import_node_fs18.copyFileSync)(path2, `${path2}.bak`);
-    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
+    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(path2), { recursive: true });
+    if ((0, import_node_fs19.existsSync)(path2)) (0, import_node_fs19.copyFileSync)(path2, `${path2}.bak`);
+    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify(merged, null, 2)}
 `, "utf8");
     return "written";
   } catch {
@@ -18763,7 +19111,7 @@ async function applyGcPlan(plan, remote) {
     cleanupBranch: (branch, expectedHeadOid) => cleanupPrMergeLocalBranch(branch.branch, {
       beforeWorktrees,
       startingPath: branch.worktreePath,
-      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs20.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -18786,7 +19134,7 @@ async function applyGcPlan(plan, remote) {
   for (const wt of plan.worktreeDirs) {
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs19.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs20.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -18829,13 +19177,13 @@ var program2 = new Command();
 program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path19.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path20.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs19.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs20.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli rules gitignore: up to date");
@@ -19000,7 +19348,7 @@ function runWorktreeInstall(command, cwd, quiet) {
 async function primaryCheckoutRoot(worktreeRoot) {
   try {
     const out = (await execFileP2("git", ["-C", worktreeRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-    return out ? (0, import_node_path19.dirname)(out) : void 0;
+    return out ? (0, import_node_path20.dirname)(out) : void 0;
   } catch {
     return void 0;
   }
@@ -19015,26 +19363,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs19.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs20.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs19.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs20.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs19.closeSync)(fd);
+      (0, import_node_fs20.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs19.rmSync)(lockPath, { force: true });
+        (0, import_node_fs20.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs19.mkdirSync)((0, import_node_path19.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs20.mkdirSync)((0, import_node_path20.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs19.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs19.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs20.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs20.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -19524,7 +19872,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const vars = rawValues("--var");
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs19.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs20.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -20094,9 +20442,9 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path19.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs19.existsSync)(wfDir)) return [];
-  return (0, import_node_fs19.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  const wfDir = (0, import_node_path20.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs20.existsSync)(wfDir)) return [];
+  return (0, import_node_fs20.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -20115,7 +20463,7 @@ function ciAuditDeps() {
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates. The
     // reconcile runs IN the Hub checkout, so this is local-file I/O (no network fetch). Path is relative to
     // the repo root (e.g. skills/bootstrap/seeds/gate.template.yml).
-    readSeedFile: (path2) => (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null
+    readSeedFile: (path2) => (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null
   };
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -20285,7 +20633,7 @@ async function createDeferredWorktreeStore() {
       },
       write: async (entries) => {
         try {
-          await (0, import_promises3.mkdir)((0, import_node_path19.dirname)(registryPath), { recursive: true });
+          await (0, import_promises3.mkdir)((0, import_node_path20.dirname)(registryPath), { recursive: true });
           await (0, import_promises3.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
         } catch {
         }
@@ -20299,13 +20647,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs19.lstatSync)(p);
+      st = (0, import_node_fs20.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs19.readlinkSync)(p);
+      (0, import_node_fs20.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -20313,7 +20661,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs19.readdirSync)(p);
+      return (0, import_node_fs20.readdirSync)(p);
     } catch {
       return [];
     }
@@ -20322,9 +20670,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs19.rmdirSync)(p);
+      (0, import_node_fs20.rmdirSync)(p);
     } catch {
-      (0, import_node_fs19.unlinkSync)(p);
+      (0, import_node_fs20.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises3.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -20354,9 +20702,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs19.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs20.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs19.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs20.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -20428,7 +20776,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs19.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs20.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -20649,7 +20997,7 @@ function stageScopedRunOpts(o) {
   };
 }
 function printLine(value) {
-  (0, import_node_fs19.writeSync)(1, `${value}
+  (0, import_node_fs20.writeSync)(1, `${value}
 `);
 }
 function stageKeepAlive() {
@@ -20663,8 +21011,8 @@ async function resolveStage() {
   const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
   return decideStage({
     registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-    hasCompose: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), "docker-compose.yml")),
-    hasEnvExample: (0, import_node_fs19.existsSync)((0, import_node_path19.join)(process.cwd(), ".env.example"))
+    hasCompose: (0, import_node_fs20.existsSync)((0, import_node_path20.join)(process.cwd(), "docker-compose.yml")),
+    hasEnvExample: (0, import_node_fs20.existsSync)((0, import_node_path20.join)(process.cwd(), ".env.example"))
   });
 }
 async function fetchStageVaultEnvMerge() {
@@ -20887,7 +21235,11 @@ function trainApplyDeps() {
   return {
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+      try {
+        return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+      } catch (e) {
+        throw surfaceTrainSubprocessFailure(e, file, args);
+      }
     },
     runSelf: async (args) => (await execFileP2(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
     trainAuthority: async (repo) => {
@@ -21113,6 +21465,27 @@ wiki.command("publish <pages-dir>").description("mint a 1h repo-scoped contents:
   );
   if (!ok) process.exitCode = 1;
 });
+wiki.command("plan").description("compute the release wiki plan for the cwd repo \u2014 collect its opt-in `wiki:page` pages, read the previous incremental stamp from <repo>.wiki.git (scoped minted token), and print a JSON plan naming which pages changed plus the fresh full stamp. Runs from ANY org repo checkout (no repo-local script). Fails loud on the credential/read gap \u2014 never a silent skip").option("--repo <owner/repo>", "target repo (defaults to the cwd repo)").action(async (o) => {
+  const repo = await resolveRepo(o.repo);
+  if (!repo) return fail("wiki plan: could not determine the target repo (pass --repo owner/name)");
+  const cfg = await loadConfig();
+  const readers = fsReaders(process.cwd());
+  const ok = await wikiPlan(
+    {
+      collectPages: () => collectFeaturePages(readers),
+      readSource: (p) => readers.readDoc(p),
+      mintAndReadStamp: async (r) => {
+        const minted = await mintWikiToken(r, registryClientDeps(cfg));
+        if (!minted.ok) return { ok: false, error: minted.error };
+        return readWikiStampViaGit(realWikiGitPublishDeps(), { repo: r, token: minted.mint.token });
+      },
+      out: (json) => console.log(json),
+      err: (msg) => console.error(msg)
+    },
+    { repo }
+  );
+  if (!ok) process.exitCode = 1;
+});
 var bootstrap = program2.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").option("--class <class>", "deployable | content", "deployable").option("--json", "machine-readable output").option("--apply", "reserved for future bootstrap execution after explicit master-admin approval").action((o) => {
   if (!o.repo) return fail("bootstrap: required option --repo <owner/repo> not specified");
   if (o.apply) return fail("bootstrap: execution is not implemented yet; use the dry-run plan and the existing /bootstrap skill");
@@ -21132,7 +21505,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     client: defaultGitHubClient(),
     projectMeta: meta,
     deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null,
+    readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
     // comma-string — accept either so the seeded value verifies regardless of how it was written.
     requiredGcpApis: (() => {
@@ -21183,12 +21556,12 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
     return fail(`bootstrap apply: ${e.message}`);
   }
   const manifestPath = "skills/bootstrap/seeds/manifest.json";
-  if (!(0, import_node_fs19.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
-  const manifest = loadBootstrapSeeds((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
+  if (!(0, import_node_fs20.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; run from the MMI-Hub repo root`);
+  const manifest = loadBootstrapSeeds((0, import_node_fs20.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
   const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-  const readFile2 = (p) => (0, import_node_fs19.existsSync)(p) ? (0, import_node_fs19.readFileSync)(p, "utf8") : null;
+  const readFile2 = (p) => (0, import_node_fs20.existsSync)(p) ? (0, import_node_fs20.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
   for (const value of rawValues("--var")) {
@@ -21485,16 +21858,16 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     const repoClass = o.class;
     targets = [{ repo: o.repo, class: repoClass, releaseTrack: repoClass === "content" ? "trunk" : resolveReleaseTrack(meta, void 0, o.repo) }];
   } else {
-    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs19.existsSync)("projects.json") ? (0, import_node_fs19.readFileSync)("projects.json", "utf8") : null;
+    const projectsJson = registryProjects ? JSON.stringify({ projects: registryProjects }) : (0, import_node_fs20.existsSync)("projects.json") ? (0, import_node_fs20.readFileSync)("projects.json", "utf8") : null;
     if (!projectsJson) return failGraceful("access audit: no project registry \u2014 Hub API unreachable and projects.json not found; run from the MMI-Hub repo root or pass --repo <owner/repo>");
-    const fanoutJson = (0, import_node_fs19.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs19.readFileSync)(".github/fanout-targets.json", "utf8") : null;
+    const fanoutJson = (0, import_node_fs20.existsSync)(".github/fanout-targets.json") ? (0, import_node_fs20.readFileSync)(".github/fanout-targets.json", "utf8") : null;
     targets = loadAccessTargets(projectsJson, fanoutJson);
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs19.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs19.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs20.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs20.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs19.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs19.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs20.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs20.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
@@ -21533,6 +21906,15 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       // never costs banner time and next session's glance renders instantly within budget.
       scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
     }),
+    // local train sync (#2582): ff local development/main/rc to origin so this checkout never lags a
+    // release pushed to origin (incl. the deferred main -> development alignment merge). Bounded git,
+    // fail-soft, silent unless a branch moved.
+    syncTrain: async (io) => {
+      const gitRun = async (file, args) => (await execFileP2(file, args, { timeout: GIT_TIMEOUT_MS })).stdout;
+      const result = await syncLocalTrainBranches(gitRun, { warn: (m) => io.err(`[mmi-hook] train sync: ${m}`) });
+      const line = localTrainSyncBannerLine(result);
+      if (line) io.log(line);
+    },
     doctor: (io) => runDoctor({ banner: true }, io)
   });
   await runSessionStart(parallel, sequential, consoleIo);