@mutmutco/cli 4.5.122 → 4.5.124

package/dist/main.cjs

@@ -5119,8 +5119,8 @@ function survivingFlagArgs(argv, rejectedFlag, ownFlags) {
   return out;
 }
 function formatPositionalTarget(commandPath3, argName, opts = {}) {
-  const concrete = opts.flag && opts.argv ? targetFlagValueFromArgv(opts.flag, opts.argv) : void 0;
-  const target = concrete ?? `<${argName}>`;
+  const concrete2 = opts.flag && opts.argv ? targetFlagValueFromArgv(opts.flag, opts.argv) : void 0;
+  const target = concrete2 ?? `<${argName}>`;
   const kept = opts.flag && opts.argv && opts.ownFlags ? survivingFlagArgs(opts.argv, opts.flag, opts.ownFlags) : [];
   return [`mmi-cli ${commandPath3}`, target, ...kept].join(" ");
 }
@@ -5656,7 +5656,7 @@ function resolveVerbAliasShim(argv) {
 
 // src/command-composition.ts
 var import_node_os25 = require("node:os");
-var import_node_path54 = require("node:path");
+var import_node_path55 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs14 = require("node:fs");
@@ -5789,6 +5789,8 @@ var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "read run view",
   "read run list",
   "read run watch",
+  "read run log",
+  // #8136: bounded jobs/logs REST read, same polling credential.
   "read pr view",
   "read pr checks",
   "read issue view",
@@ -10108,18 +10110,18 @@ function isGhHttpNotFound(err) {
 function isForkStyleHead(head) {
   return head.includes(":");
 }
-async function defaultReadRemoteHead(exec2, repo, head) {
+async function defaultReadRemoteHead(exec3, repo, head) {
   try {
-    await exec2("gh", ["api", `repos/${repo}/git/ref/heads/${encodeURIComponent(head)}`], { timeout: 15e3 });
+    await exec3("gh", ["api", `repos/${repo}/git/ref/heads/${encodeURIComponent(head)}`], { timeout: 15e3 });
     return "present";
   } catch (e) {
     if (isGhHttpNotFound(e)) return "absent";
     return "unknown";
   }
 }
-async function defaultCompareRefs(exec2, repo, base, head) {
+async function defaultCompareRefs(exec3, repo, base, head) {
   try {
-    const { stdout } = await exec2(
+    const { stdout } = await exec3(
       "gh",
       ["api", `repos/${repo}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}`],
       { timeout: 15e3 }
@@ -10130,11 +10132,11 @@ async function defaultCompareRefs(exec2, repo, base, head) {
     return "unknown";
   }
 }
-async function publishAbsentPrHeadIfOwned(repo, head, exec2) {
+async function publishAbsentPrHeadIfOwned(repo, head, exec3) {
   if (isForkStyleHead(head)) return false;
   let originRepo;
   try {
-    const { stdout } = await exec2("git", ["remote", "get-url", "--push", "origin"], { timeout: GIT_TIMEOUT_MS });
+    const { stdout } = await exec3("git", ["remote", "get-url", "--push", "origin"], { timeout: GIT_TIMEOUT_MS });
     originRepo = repoFromRemoteUrl(stdout.trim());
   } catch {
     return false;
@@ -10142,20 +10144,20 @@ async function publishAbsentPrHeadIfOwned(repo, head, exec2) {
   if (!originRepo || originRepo.toLowerCase() !== repo.toLowerCase()) return false;
   let currentBranch2;
   try {
-    currentBranch2 = (await exec2("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+    currentBranch2 = (await exec3("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
   } catch {
     return false;
   }
   if (!currentBranch2 || currentBranch2 !== head) return false;
   let commit;
   try {
-    commit = (await exec2("git", ["rev-parse", "--verify", "HEAD^{commit}"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+    commit = (await exec3("git", ["rev-parse", "--verify", "HEAD^{commit}"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
   } catch {
     return false;
   }
   if (!commit) return false;
   try {
-    await exec2("git", ["push", "origin", `${commit}:refs/heads/${head}`], { timeout: GH_MUTATION_TIMEOUT_MS });
+    await exec3("git", ["push", "origin", `${commit}:refs/heads/${head}`], { timeout: GH_MUTATION_TIMEOUT_MS });
     return true;
   } catch {
     return false;
@@ -10285,22 +10287,22 @@ function upstreamFaultMessage(verb, stderr) {
   const advice = mayRetryCreate(verb) ? "Retrying is the right action" : "The write may have completed server-side before the error \u2014 VERIFY before retrying, or a retry will duplicate it";
   return `gh ${verb} create failed: GitHub's API is failing (server-side 5xx) \u2014 this is NOT a problem with your diff or arguments. GitHub request ID: ${requestId ?? "unavailable"}. ${advice}; note githubstatus.com may still read green while this is happening.`;
 }
-async function resolveRepoForCreate(args, exec2) {
+async function resolveRepoForCreate(args, exec3) {
   const fromFlag = flagValue(args, "--repo");
   if (fromFlag) return fromFlag;
   try {
-    const { stdout } = await exec2("git", ["remote", "get-url", "origin"], { timeout: 1e4 });
+    const { stdout } = await exec3("git", ["remote", "get-url", "origin"], { timeout: 1e4 });
     const fromOrigin = repoFromRemoteUrl(stdout.trim());
     if (fromOrigin) return fromOrigin;
   } catch {
   }
   return repoFromRemoteUrl(originUrlFromGitConfig() ?? "") || void 0;
 }
-async function resolveHeadForCreate(args, exec2) {
+async function resolveHeadForCreate(args, exec3) {
   const fromFlag = flagValue(args, "--head");
   if (fromFlag) return fromFlag;
   try {
-    const { stdout } = await exec2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: 1e4 });
+    const { stdout } = await exec3("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: 1e4 });
     const head = stdout.trim();
     return head && head !== "HEAD" ? head : void 0;
   } catch {
@@ -10312,13 +10314,13 @@ async function resolveBodyForCreate(args, read) {
   if (bodyFile !== void 0) return read(bodyFile, "utf8");
   return flagValue(args, "--body") ?? "";
 }
-async function defaultFindOpenPr(exec2, input) {
+async function defaultFindOpenPr(exec3, input) {
   const owner = input.repo.split("/")[0];
   if (!owner) return void 0;
   const qs = new URLSearchParams({ state: "open", head: `${owner}:${input.head}` });
   if (input.base) qs.set("base", input.base);
   try {
-    const { stdout } = await exec2("gh", ["api", `repos/${input.repo}/pulls?${qs.toString()}`], { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { stdout } = await exec3("gh", ["api", `repos/${input.repo}/pulls?${qs.toString()}`], { timeout: GH_MUTATION_TIMEOUT_MS });
     const rows = JSON.parse(stdout);
     const first = Array.isArray(rows) ? rows[0] : void 0;
     if (typeof first?.number === "number" && typeof first.html_url === "string") {
@@ -10328,7 +10330,7 @@ async function defaultFindOpenPr(exec2, input) {
   }
   return void 0;
 }
-async function defaultRestCreatePr(exec2, input, deps = {}) {
+async function defaultRestCreatePr(exec3, input, deps = {}) {
   const write = deps.write ?? import_promises.writeFile;
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
@@ -10353,7 +10355,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
     file
   ];
   try {
-    const { stdout } = await exec2("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { stdout } = await exec3("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
     const parsed = JSON.parse(stdout);
     if (typeof parsed.number === "number" && typeof parsed.html_url === "string") {
       return { number: parsed.number, url: parsed.html_url };
@@ -10365,7 +10367,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
     const fromText = parseExistingPr(text);
     if (fromText) return { ...fromText, existing: true };
     if (/already exists/i.test(text)) {
-      const found = await defaultFindOpenPr(exec2, { repo: input.repo, head: input.head, base: input.base });
+      const found = await defaultFindOpenPr(exec3, { repo: input.repo, head: input.head, base: input.base });
       if (found) return found;
     }
     throw e;
@@ -10376,7 +10378,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
     }
   }
 }
-async function defaultRestCreateIssue(exec2, input) {
+async function defaultRestCreateIssue(exec3, input) {
   const args = [
     "api",
     "--method",
@@ -10391,7 +10393,7 @@ async function defaultRestCreateIssue(exec2, input) {
     args.push("-f", `labels[]=${label}`);
   }
   try {
-    const { stdout } = await exec2("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { stdout } = await exec3("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
     const parsed = JSON.parse(stdout);
     if (typeof parsed.number === "number" && typeof parsed.html_url === "string") {
       return { number: parsed.number, url: parsed.html_url };
@@ -10410,9 +10412,9 @@ ${err.stdout ?? ""}`;
     throw e;
   }
 }
-async function defaultReadRateLimit(exec2) {
+async function defaultReadRateLimit(exec3) {
   try {
-    const { stdout } = await exec2("gh", ["api", "rate_limit"], { timeout: 15e3 });
+    const { stdout } = await exec3("gh", ["api", "rate_limit"], { timeout: 15e3 });
     return parseRateLimitPools(stdout);
   } catch {
     return {};
@@ -10585,17 +10587,17 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
   }
 }
 async function ghCreate(args, deps = {}) {
-  const exec2 = deps.exec ?? execFileP;
+  const exec3 = deps.exec ?? execFileP;
   const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
-  const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec2, input));
-  const restCreateIssue = deps.restCreateIssue ?? ((input) => defaultRestCreateIssue(exec2, input));
-  const findOpenPr = deps.findOpenPr ?? ((input) => defaultFindOpenPr(exec2, input));
-  const readRateLimit = deps.readRateLimit ?? (() => defaultReadRateLimit(exec2));
+  const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec3, input));
+  const restCreateIssue = deps.restCreateIssue ?? ((input) => defaultRestCreateIssue(exec3, input));
+  const findOpenPr = deps.findOpenPr ?? ((input) => defaultFindOpenPr(exec3, input));
+  const readRateLimit = deps.readRateLimit ?? (() => defaultReadRateLimit(exec3));
   if (args[0] === "pr") {
     const refusal = await preflightPrCreateRemoteHead(args, {
-      exec: exec2,
+      exec: exec3,
       readRemoteHead: deps.readRemoteHead,
       compareRefs: deps.compareRefs
     });
@@ -10603,7 +10605,7 @@ async function ghCreate(args, deps = {}) {
   }
   const swapped = await bodyArgsViaFile(args);
   const restDeps = {
-    exec: exec2,
+    exec: exec3,
     sleep: sleep2,
     now,
     readFile: read,
@@ -10646,7 +10648,7 @@ async function ghCreate(args, deps = {}) {
     }
     for (let attempt = 1; attempt <= GH_CREATE_UPSTREAM_RETRIES; attempt++) {
       try {
-        const { stdout } = await exec2("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
+        const { stdout } = await exec3("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
         return parseCreatedUrl(stdout);
       } catch (e) {
         const err = e;
@@ -10664,7 +10666,7 @@ async function ghCreate(args, deps = {}) {
         if (args[0] === "issue" && isGhRateLimitError(errText)) {
           try {
             const result = await createIssueViaRestFallback(args, swapped.args, {
-              exec: exec2,
+              exec: exec3,
               sleep: sleep2,
               now,
               readFile: read,
@@ -15785,6 +15787,135 @@ function checkCommands(docs, commandPaths) {
   }
   return { ok: findings.length === 0, findings, warnings: [] };
 }
+function isRunbook(doc, body) {
+  return doc === "docs/Guides/operator.md" || body.split(/\r?\n/).slice(0, 20).some((line) => line.includes("<!-- runbook -->"));
+}
+function shellClaims(body) {
+  const claims = [];
+  let fence = "";
+  let enabled = false;
+  body.split(/\r?\n/).forEach((text, index) => {
+    const marker = /^\s*(`{3,}|~{3,})(.*)$/.exec(text);
+    if (marker) {
+      if (!fence) {
+        fence = marker[1];
+        enabled = /^(bash|sh|shell|console)?$/.test(marker[2].trim().toLowerCase());
+      } else if (marker[1][0] === fence[0] && marker[1].length >= fence.length && !marker[2].trim()) {
+        fence = "";
+        enabled = false;
+      }
+      return;
+    }
+    if (!enabled || /^\s*#/.test(text)) return;
+    const parts = text.replace(/^\s*\$ /, "").match(/(?:"[^"\n]*"|'[^'\n]*'|<[^>\n]*>|[^\s;&|])+|&&|\|\||[;|]/g) ?? [];
+    let tokens2 = [];
+    const emit = () => {
+      while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens2[0] ?? "")) tokens2.shift();
+      if (tokens2.length) claims.push({ tokens: tokens2, line: index + 1 });
+      tokens2 = [];
+    };
+    for (const part of parts) {
+      if (part.startsWith("#")) break;
+      if (["&&", "||", ";", "|"].includes(part)) emit();
+      else tokens2.push(part.replace(/^(["'])(.*)\1$/, "$2"));
+    }
+    emit();
+  });
+  return claims;
+}
+function checkRunbookClaims(root, docs, deps) {
+  const findings = [];
+  const placeholder = (token) => token.includes("<");
+  const paths = deps.commandPaths ?? /* @__PURE__ */ new Set();
+  for (const [doc, body] of Object.entries(docs)) {
+    for (const { tokens: tokens2, line } of shellClaims(body)) {
+      const [cmd, ...args] = tokens2;
+      const report = (kind, detail) => {
+        findings.push({ kind, doc, line, detail });
+      };
+      if (cmd === "mmi-cli" && deps.commandPaths) {
+        let resolved = "";
+        let unknown = false;
+        for (const token of args) {
+          if (token.startsWith("-") || placeholder(token)) break;
+          const next = resolved ? `${resolved} ${token}` : token;
+          if ([...paths].some((path2) => path2 === next || path2.startsWith(`${next} `))) resolved = next;
+          else if (paths.has(resolved)) break;
+          else {
+            report("unknown-command", `mmi-cli ${next}`);
+            unknown = true;
+            break;
+          }
+        }
+        for (const token of unknown ? [] : args) {
+          if (token === "--") break;
+          const flag = token.split("=")[0];
+          if (/^--[\w-]+$/.test(flag) && flag !== "--help" && !placeholder(flag) && !deps.commandOptions?.get(resolved)?.has(flag)) {
+            report("unknown-flag", `mmi-cli ${resolved}: ${flag}`);
+          }
+        }
+      } else if (cmd === "npm") {
+        const run = args.indexOf("run");
+        if (run < 0) continue;
+        const prefix = args.indexOf("--prefix");
+        const dir = prefix >= 0 ? args[prefix + 1] : ".";
+        const script = args.slice(run + 1).find((token, i, tail) => !token.startsWith("-") && tail[i - 1] !== "--prefix");
+        if (!dir || !script || placeholder(dir) || placeholder(script)) continue;
+        const manifest = deps.readFile((0, import_node_path13.join)(root, dir, "package.json"));
+        const scripts = manifest ? JSON.parse(manifest).scripts : void 0;
+        if (!scripts || !Object.hasOwn(scripts, script)) report("missing-script", `npm run ${script} (${dir}/package.json)`);
+      } else if ((cmd === "python" || cmd === "python3") && args[0] === "-m") {
+        const module2 = args[1];
+        if (!module2 || placeholder(module2)) continue;
+        const rel = module2.replaceAll(".", "/");
+        const first = rel.split("/")[0];
+        const tracked = deps.trackedFirstSegments([first, `${first}.py`, `src/${first}`, `src/${first}.py`]);
+        const roots = ["", "src/"].filter((prefix) => {
+          if (!prefix) return tracked ? tracked.has(first) || tracked.has(`${first}.py`) : deps.exists((0, import_node_path13.join)(root, first)) || deps.exists((0, import_node_path13.join)(root, `${first}.py`));
+          return tracked ? tracked.has(`src/${first}`) || tracked.has(`src/${first}.py`) : deps.exists((0, import_node_path13.join)(root, "src", first)) || deps.exists((0, import_node_path13.join)(root, "src", `${first}.py`));
+        });
+        if (roots.length && !roots.some((prefix) => [".py", "/__init__.py", "/__main__.py"].some((suffix) => deps.exists((0, import_node_path13.join)(root, `${prefix}${rel}${suffix}`))))) {
+          report("missing-module", module2);
+        }
+      } else if (["node", "bash", "sh"].includes(cmd)) {
+        const rel = args[0];
+        if (!rel || rel.startsWith("-") || placeholder(rel) || /^(\/|[A-Za-z]:|\.\.\/)/.test(rel)) continue;
+        const first = refFirstSegment(rel);
+        const tracked = deps.trackedFirstSegments([first]);
+        if ((tracked ? tracked.has(first) : deps.exists((0, import_node_path13.join)(root, first))) && !deps.exists((0, import_node_path13.join)(root, rel)) && !deps.isIgnored([rel]).has(rel)) report("missing-path", rel);
+      }
+    }
+  }
+  return findings;
+}
+function checkRunbookCoverage(docs, base, git3) {
+  const changed = git3(["diff", "--name-only", `${base}...HEAD`]).split(/\r?\n/).filter(Boolean);
+  const findings = [];
+  const matches = (glob, path2) => {
+    const pattern = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, "
").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replaceAll("\0", "(?:.*/)?").replaceAll("
", ".*");
+    return new RegExp(`^${pattern}$`).test(path2);
+  };
+  for (const [doc, body] of Object.entries(docs)) {
+    const lines2 = stripFences(body);
+    const headings = lines2.flatMap((text, i) => {
+      const match = /^(#{1,6})\s+(.+)$/.exec(text);
+      return match ? [{ level: match[1].length, title: match[2], start: i + 1 }] : [];
+    });
+    const diff = git3(["diff", "-U0", `${base}...HEAD`, "--", doc]);
+    const ranges = [...diff.matchAll(/^@@ .*?\+(\d+)(?:,(\d+))? @@/gm)].map((m) => ({ start: Number(m[1]), count: m[2] === void 0 ? 1 : Number(m[2]) }));
+    for (let i = 0; i < headings.length; i++) {
+      const heading = headings[i];
+      const end = headings.slice(i + 1).find((h) => h.level <= heading.level)?.start ?? lines2.length + 1;
+      const markerEnd = headings[i + 1]?.start ?? end;
+      const globs = lines2.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
+      const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)));
+      if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
+        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title}: changed ${affected.join(", ")}; update this section or declare Runbook-Unaffected: <reason>` });
+      }
+    }
+  }
+  return findings;
+}
 function readFileOrNull(path2) {
   return (0, import_node_fs15.existsSync)(path2) ? (0, import_node_fs15.readFileSync)(path2, "utf8") : null;
 }
@@ -15806,11 +15937,11 @@ function defaultListDocs(root) {
   return [...ROOT_DOCS.filter((rel) => (0, import_node_fs15.existsSync)((0, import_node_path13.join)(root, rel))), ...docs];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
-function defaultIsIgnored(root, relPaths, exec2 = import_node_child_process6.execFileSync) {
+function defaultIsIgnored(root, relPaths, exec3 = import_node_child_process6.execFileSync) {
   const inRepo = relPaths.filter((p) => !p.startsWith(".."));
   if (inRepo.length === 0) return /* @__PURE__ */ new Set();
   try {
-    const out = exec2("git", ["check-ignore", "--stdin"], {
+    const out = exec3("git", ["check-ignore", "--stdin"], {
       cwd: root,
       input: inRepo.join("\n"),
       encoding: "utf8",
@@ -15829,17 +15960,19 @@ function defaultIsIgnored(root, relPaths, exec2 = import_node_child_process6.exe
     throw error;
   }
 }
-function defaultTrackedFirstSegments(root, firstSegments, exec2 = import_node_child_process6.execFileSync) {
+function defaultTrackedFirstSegments(root, firstSegments, exec3 = import_node_child_process6.execFileSync) {
   if (firstSegments.length === 0) return /* @__PURE__ */ new Set();
   try {
-    const out = exec2("git", ["ls-files", "-z", "--", ...firstSegments.map((s) => `:(literal)${s}`)], {
+    const out = exec3("git", ["ls-files", "-z", "--", ...firstSegments.map((s) => `:(literal)${s}`)], {
       cwd: root,
       encoding: "utf8",
       maxBuffer: CHECK_IGNORE_MAX_BUFFER
     });
     const tracked = /* @__PURE__ */ new Set();
     for (const path2 of out.split("\0")) {
-      if (path2) tracked.add(path2.split("/")[0]);
+      if (path2) for (const segment of firstSegments) {
+        if (path2 === segment || path2.startsWith(`${segment}/`)) tracked.add(segment);
+      }
     }
     return tracked;
   } catch (error) {
@@ -15863,7 +15996,7 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path13.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path13.join)(root, rel))]).filter(([rel, body]) => body != null && (!deps.runbooksOnly || isRunbook(rel, body)))
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
@@ -15880,10 +16013,22 @@ function runDocRefs(root, deps = {}) {
   } else {
     findings.push(...checkCommands(docs, commandPaths).findings);
   }
+  const runbooks = Object.fromEntries(Object.entries(docs).filter(([doc, body]) => isRunbook(doc, body)));
+  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions }));
+  const warnings = [...refResult.warnings];
+  if (deps.runbooksOnly && !Object.keys(runbooks).length) {
+    warnings.push({ kind: "runbook-missing", doc: "docs/Guides/operator.md", line: 0, detail: "no operator runbook or <!-- runbook --> document exists" });
+  }
+  if (deps.base) {
+    const git3 = deps.git ?? ((args) => (0, import_node_child_process6.execFileSync)("git", args, { cwd: root, encoding: "utf8", maxBuffer: CHECK_IGNORE_MAX_BUFFER, windowsHide: true }));
+    const stale = checkRunbookCoverage(runbooks, deps.base, git3);
+    const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(git3(["log", "--format=%B", `${deps.base}..HEAD`]));
+    (override ? warnings : findings).push(...stale);
+  }
   return {
     ok: findings.length === 0,
     findings,
-    warnings: refResult.warnings,
+    warnings,
     docCount: Object.keys(docs).length
   };
 }
@@ -16001,6 +16146,7 @@ function createDocsIndexDeps(repoRoot2) {
 // src/gate-budget.ts
 var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
+var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
 var FULL_SHA = /^[0-9a-f]{40}$/;
@@ -16375,6 +16521,8 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA,
     GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA,
+    // #8129: the guard and its bundled CLI must come from the same immutable Hub revision.
+    GATE_RUNBOOK_SHA: BLESSED_RUNBOOK_GUARD_SHA,
     // #7407: repo-declared service containers and extra check steps; empty renders today's gate byte-for-byte.
     GATE_SERVICES_YAML: "",
     GATE_EXTRA_STEPS_YAML: ""
@@ -16412,6 +16560,8 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
 }
 function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranches, requiredChecks) {
   const out = { ...vars };
+  out.OWNER ??= parsed.owner;
+  out.REPO ??= parsed.name;
   out.REPO_NAME ??= parsed.name;
   out.REPO_SLUG ??= parsed.slug;
   out.CLASS ??= cls;
@@ -18093,10 +18243,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.122",
-    tag: "v4.5.122",
-    commit: "6eb49646ae34",
-    npm: "@mutmutco/cli@4.5.122"
+    version: "4.5.124",
+    tag: "v4.5.124",
+    commit: "255e8e974e8e",
+    npm: "@mutmutco/cli@4.5.124"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18113,14 +18263,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.122"
+          v3Target: "v4.5.124"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.122 and redeploy the Hub Lambda from tag v4.5.122 (6eb49646ae34); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.122 (@mutmutco/cli@4.5.122, tag commit 6eb49646ae34 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.124 and redeploy the Hub Lambda from tag v4.5.124 (255e8e974e8e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.124 (@mutmutco/cli@4.5.124, tag commit 255e8e974e8e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20977,6 +21127,14 @@ async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
   }
   return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
 }
+async function isPromotedUnreleasedTag(deps, tag, remoteSha, repo) {
+  try {
+    await deps.run("git", ["merge-base", "--is-ancestor", remoteSha, "origin/main"]);
+  } catch {
+    return false;
+  }
+  return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
+}
 function cmpReleaseTag(a, b) {
   const parse2 = (t) => {
     const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(t.trim());
@@ -27609,7 +27767,9 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
     for (const note of reverifyNotes) deps.warn?.(`release ledger: ${note}`);
   }
   const ledgerMode = persisted ? "strict" : "migration";
-  const partialRelease = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  const preMainPartial = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  const promotedPartial = !preMainPartial && await isPromotedUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  const partialRelease = preMainPartial || promotedPartial;
   if (partialRelease && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   if (!partialRelease) {
     try {
@@ -27726,7 +27886,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       note: state2 === "failed" ? `release ${tag} was already published, but its deploy/publish on the release SHA FAILED \u2014 re-run the failed job (do NOT re-tag); the protected alignment PRs were reused` : state2 === "pending" ? `release ${tag} was already published; reused its protected alignment PRs, but a deploy/publish or alignment follow-up is unresolved \u2014 watch it to completion` : `release ${tag} was already published; alignment is complete and the deploy on the release SHA is proven green`
     };
   }
-  if (!await probeAncestor(deps, "origin/main", tagSha, "release --resume: origin/main fast-forward ancestry")) {
+  if (!promotedPartial && !await probeAncestor(deps, "origin/main", tagSha, "release --resume: origin/main fast-forward ancestry")) {
     throw new Error(
       `release --resume: origin/main is not an ancestor of ${tag} (${tagSha.slice(0, 12)}) \u2014 main has moved on since the partial release, so finishing it here would not be a fast-forward. Resolve by hand; nothing was written.`
     );
@@ -27772,9 +27932,9 @@ ${recovery.note}`), recoveryInput);
   }
   await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified the required-check wall live on this resume" }), { strict: ledgerMode === "strict", landed: "the immutable tag on origin at the resumed SHA" });
   deps.warn?.("Release: Promoting the verified release");
-  const versionEnv = await pushAfterVercelVersionEnv(deps, meta, "main", tag, ["push", "origin", `${tagSha}:refs/heads/main`]);
-  steps.push(`pushed ${tagSha.slice(0, 12)} to origin/main`);
-  await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
+  const versionEnv = promotedPartial ? { status: "skipped", note: "" } : await pushAfterVercelVersionEnv(deps, meta, "main", tag, ["push", "origin", `${tagSha}:refs/heads/main`]);
+  steps.push(promotedPartial ? `origin/main already contains ${tagSha.slice(0, 12)} (the main push had landed): not pushed again` : `pushed ${tagSha.slice(0, 12)} to origin/main`);
+  await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: promotedPartial ? "re-verified live: origin/main contains the immutable tag SHA (#8128)" : `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
   const autoRunSince = (deps.now ?? Date.now)();
   const cutBy = (await ledger.load(anchors))?.cutBy ?? describeSessionIdentity();
@@ -38048,8 +38208,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
   const { tmpdir: tmpdir12 } = await import("node:os");
-  const { join: join48 } = await import("node:path");
-  const dir = await mkdtemp2(join48(tmpdir12(), "mmi-hotfix-preflight-"));
+  const { join: join49 } = await import("node:path");
+  const dir = await mkdtemp2(join49(tmpdir12(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -52015,6 +52175,65 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 // src/api-read.ts
 var import_node_fs50 = require("node:fs");
 
+// src/run-log-read.ts
+init_cli_shared();
+var FAILED2 = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out"]);
+function logRepo(raw) {
+  const repo = parseBrokerRepo(raw, "--repo");
+  if (repo.split("/").some((s) => s === "." || s === "..")) throw new Error("read run log: --repo refuses dot segments");
+  return repo;
+}
+function logJob(raw) {
+  if (!raw.trim() || /[\r\n\0]/.test(raw)) throw new Error("read run log: --job must be a non-empty job name");
+  return raw;
+}
+function sliceRunLog(text, tail) {
+  const lines2 = text.replace(/\r\n/g, "\n").split("\n");
+  if (lines2.at(-1) === "") lines2.pop();
+  const context = /* @__PURE__ */ new Set();
+  lines2.forEach((line, i) => {
+    if (line.includes("##[error]")) for (let j = Math.max(0, i - 3); j <= Math.min(lines2.length - 1, i + 3); j++) context.add(j);
+  });
+  return { errorLines: lines2.filter((_, i) => context.has(i)), tail: lines2.slice(-tail) };
+}
+async function readRunLog(id, o, runner) {
+  const runId = parseBrokerId(id, "run id");
+  const repo = logRepo(o.repo);
+  const tail = parseBrokerInt(o.tail ?? "200", "--tail", 1, 2e3);
+  const attempt = o.attempt === void 0 ? void 0 : parseBrokerInt(o.attempt, "--attempt", 1, 1e3);
+  const jobName = o.job === void 0 ? void 0 : logJob(o.job);
+  if (o.failed && jobName !== void 0) throw new Error("read run log: --failed and --job are mutually exclusive");
+  const base = `repos/${repo}/actions/runs/${runId}`;
+  const pages = JSON.parse(await readAppApi(`${base}${attempt === void 0 ? "" : `/attempts/${attempt}`}/jobs`, runner));
+  const jobs = pages.flatMap((page) => page.jobs);
+  const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName);
+  const result = { runId, repo, jobs: [] };
+  if (!selected.length) return { result, exitCode: 1, message: `read run log: no matching job for run ${runId} in ${repo}; conclusions seen: ${[...new Set(jobs.map((j) => j.conclusion ?? "pending"))].join(", ") || "none"}` };
+  for (const job of selected) {
+    const text = await readAppApi(`repos/${repo}/actions/jobs/${parseBrokerId(String(job.id), "job id")}/logs`, runner);
+    result.jobs.push({ id: job.id, name: job.name, conclusion: job.conclusion, failedStep: job.steps?.find((s) => s.conclusion === "failure")?.name ?? null, ...sliceRunLog(text, tail) });
+  }
+  return { result, exitCode: 0 };
+}
+function registerRunLogRead(run, runner) {
+  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
+    requireBrokerApp("read run log");
+    const env = brokerChildEnv();
+    try {
+      const { result, message: message2, exitCode } = await readRunLog(id, o, runner);
+      if (message2) printLine(message2);
+      else if (o.json) printLine(redactPrivateCredential(JSON.stringify(result), env));
+      else for (const job of result.jobs) {
+        printLine(redactPrivateCredential(`== ${job.name} (${job.id}) ${job.conclusion}: failing step "${job.failedStep ?? "none"}"`, env));
+        for (const line of [...job.errorLines, ...job.tail]) printLine(redactPrivateCredential(line, env));
+      }
+      process.exitCode = exitCode;
+    } catch (e) {
+      return fail(redactPrivateCredential(`read run log: App-pool read failed (${e.message}) \u2014 re-run the same command; never falls back to personal`, env));
+    }
+  });
+}
+
 // src/app-read-broker.ts
 init_cli_shared();
 var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -52301,7 +52520,8 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
   const runStatusOpt = (v) => parseBrokerRunStatus(v);
   const assigneeOpt = (v) => parseBrokerAssignee(v);
   const read = program3.command("read").description(`closed typed GitHub reads on the App pool (${BROKER_JSON_FLAGS_NOTE})`);
-  const run = read.command("run").description("workflow-run reads (view/list/watch) \u2014 stdout and exit codes pass gh through verbatim");
+  const run = read.command("run").description("workflow-run reads (view/list/watch pass gh through; log is a bounded App REST read)");
+  registerRunLogRead(run, overrides?.apiRunner);
   run.command("view").description("read a workflow run (attempt/exit-status/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--exit-status", "exit non-zero when the run failed").option("--attempt <n>", "the attempt number of the run (1-1000)", intOpt("--attempt", 1, 1e3)).argument("<id>", "workflow run number", idOpt("run id")).action(async (id, o) => {
     let spec;
     try {
@@ -52391,11 +52611,11 @@ var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
-var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/jobs$`);
+var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/attempts/\\d+)?/jobs$`);
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
@@ -52429,8 +52649,16 @@ function buildApiGetArgs(path2, accept) {
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
+var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout;
+async function readAppApi(path2, runner = apiReadRunner) {
+  const req = parseApiGetPath(path2);
+  requireBrokerApp("read run log");
+  const log = req.kind === "actions-job-logs";
+  const body = await runApiGet((args, timeout) => runner(req.kind === "actions-jobs" ? [...args, "--slurp"] : args, log ? ZIP_TIMEOUT_MS : timeout, brokerChildEnv(), log || void 0), path2);
+  return log ? Buffer.from(body, "latin1").toString("utf8") : body;
+}
 function registerApiReadCommands(program3, overrides) {
-  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout);
+  const spawn6 = overrides?.runner ?? apiReadRunner;
   const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts)");
   api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
     acceptHeaderFor(v);
@@ -54053,7 +54281,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path53 = require("node:path");
+var import_node_path54 = require("node:path");
 init_house_map();
 init_hub_url();
 
@@ -54132,6 +54360,7 @@ function digestPackedFiles(packageRoot, packedFiles) {
 var DIST_ARTIFACTS = [
   { path: "cli/dist/index.cjs", packageDir: "cli", output: "index.cjs" },
   { path: "cli/dist/main.cjs", packageDir: "cli", output: "main.cjs" },
+  { path: "cli/dist/runbook-sweep.cjs", packageDir: "cli", output: "runbook-sweep.cjs" },
   { path: "updater/dist/index.cjs", packageDir: "updater", output: "index.cjs" }
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
@@ -54272,6 +54501,123 @@ function runDistStatus(root) {
   }
 }
 
+// src/doc-refs-live.ts
+var import_node_path51 = require("node:path");
+var concrete = (value) => !!value && !/[<>{}$]/.test(value);
+var liveOption = (tokens2, flag) => {
+  const index = tokens2.indexOf(flag);
+  return index >= 0 ? tokens2[index + 1] : tokens2.find((token) => token.startsWith(`${flag}=`))?.slice(flag.length + 1);
+};
+async function checkRunbookLive(docs, deps) {
+  const findings = [];
+  const warnings = [];
+  const cache = /* @__PURE__ */ new Map();
+  const names = (type, scope) => {
+    const key = `${type}:${scope}`;
+    if (!cache.has(key)) cache.set(key, Promise.resolve().then(() => deps[type](scope)));
+    return cache.get(key);
+  };
+  for (const [doc, body] of Object.entries(docs)) {
+    if (!isRunbook(doc, body)) continue;
+    for (const { tokens: raw, line } of shellClaims(body)) {
+      if (raw[0] !== "mmi-cli") continue;
+      const end = raw.indexOf("--");
+      const tokens2 = end < 0 ? raw : raw.slice(0, end);
+      const task = liveOption(tokens2, "--task");
+      const repo = liveOption(tokens2, "--repo") ?? tokens2.find((token) => /^[\w.-]+\/[\w.-]+$/.test(token));
+      const key = liveOption(tokens2, "--key");
+      const scope = liveOption(tokens2, "--repo") ?? (liveOption(tokens2, "--slug") === "_org" ? "_org" : void 0);
+      const checks = [];
+      if (tokens2.includes("run-task") && concrete(repo) && concrete(task)) checks.push({ type: "tasks", scope: repo, name: task, kind: "unknown-task" });
+      if (tokens2[1] === "vault" && tokens2[2] === "secrets" && ["use", "set", "rm"].includes(tokens2[3]) && concrete(scope) && concrete(key)) checks.push({ type: "vaultKeys", scope, name: key, kind: "unknown-vault-key" });
+      for (const check of checks) {
+        const detail = `${check.scope}: ${check.name}`;
+        try {
+          if (!(await names(check.type, check.scope)).has(check.name)) findings.push({ kind: check.kind, doc, line, detail });
+        } catch {
+          warnings.push({ kind: "live-unverified", doc, line, detail: `${check.type} ${check.scope}: remote names unreadable (auth/transport or unsupported scope)` });
+        }
+      }
+    }
+    let fence = "";
+    const seen = /* @__PURE__ */ new Set();
+    for (const [index, text] of body.split(/\r?\n/).entries()) {
+      const marker = /^\s*(`{3,}|~{3,})(.*)$/.exec(text);
+      if (marker) {
+        if (!fence) fence = marker[1];
+        else if (marker[1][0] === fence[0] && marker[1].length >= fence.length && !marker[2].trim()) fence = "";
+        continue;
+      }
+      const spans = fence ? [text] : [...text.matchAll(/`([^`]+)`/g)].map((match) => match[1]);
+      for (const span of spans) for (const match of span.matchAll(/https:\/\/[^\s`"']+/g)) {
+        const url = match[0].replace(/[),.;]+$/, "");
+        if (!concrete(url) || seen.has(url)) continue;
+        let host;
+        try {
+          host = new URL(url).hostname;
+        } catch {
+          continue;
+        }
+        if (/(^|\.)example\./i.test(host)) continue;
+        seen.add(url);
+        try {
+          const status = await deps.endpoint(url);
+          if (status >= 500) findings.push({ kind: "endpoint-down", doc, line: index + 1, detail: `${url}: HTTP ${status}` });
+        } catch {
+          findings.push({ kind: "endpoint-down", doc, line: index + 1, detail: `${url}: network error or 10s timeout` });
+        }
+      }
+    }
+  }
+  return { findings, warnings };
+}
+async function runLiveDocRefs(root, deps, live) {
+  const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
+  const read = deps.readFile ?? readFileOrNull;
+  const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
+    const body = read((0, import_node_path51.join)(root, doc));
+    return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
+  }));
+  const remote = await checkRunbookLive(docs, live);
+  const findings = [...offline.findings, ...remote.findings];
+  return { ...offline, findings, warnings: [...offline.warnings, ...remote.warnings], ok: findings.length === 0 };
+}
+
+// src/doc-refs-live-io.ts
+var import_node_child_process20 = require("node:child_process");
+var import_node_util7 = require("node:util");
+var exec2 = (0, import_node_util7.promisify)(import_node_child_process20.execFile);
+function createRunbookLiveDeps(cliBin) {
+  const json = async (args) => {
+    const { stdout } = await exec2(process.execPath, [cliBin, ...args, "--json"], { windowsHide: true, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 });
+    return JSON.parse(stdout);
+  };
+  return {
+    tasks: async (repo) => {
+      const project2 = await json(["oracle", "org", "project", "get", repo]);
+      if (!project2 || typeof project2 !== "object" || Array.isArray(project2)) throw new Error("unreadable META");
+      return new Set(Object.keys(project2.tenantTasks ?? {}));
+    },
+    vaultKeys: async (scope) => {
+      if (scope === "_org") throw new Error("org names listing unsupported");
+      const result = await json(["vault", "secrets", "list", "--repo", scope]);
+      if (!Array.isArray(result?.secrets) || result.secrets.some((item) => typeof item.key !== "string")) throw new Error("unreadable names");
+      return new Set(result.secrets.map((item) => item.key));
+    },
+    endpoint: async (url) => {
+      const probe = async () => {
+        const response = await fetch(url, { method: "GET", signal: AbortSignal.timeout(1e4) });
+        await response.body?.cancel();
+        return response.status;
+      };
+      const first = await probe().catch(() => 599);
+      if (first < 500) return first;
+      await new Promise((resolve7) => setTimeout(resolve7, 2e4));
+      return probe();
+    }
+  };
+}
+
 // src/edge-commands.ts
 init_cli_shared();
 
@@ -54369,7 +54715,7 @@ init_hub_auth();
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -54398,7 +54744,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path51.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path52.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -54480,9 +54826,9 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process20 = require("node:child_process");
+var import_node_child_process21 = require("node:child_process");
 var import_node_fs55 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -54551,7 +54897,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process20.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process21.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -54568,7 +54914,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs55.readFileSync)((0, import_node_path52.join)(root, file), "utf8");
+      raw = (0, import_node_fs55.readFileSync)((0, import_node_path53.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -54588,7 +54934,7 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path53.join)(process.cwd(), ".gitignore");
+    const path2 = (0, import_node_path54.join)(process.cwd(), ".gitignore");
     const current = (0, import_node_fs56.existsSync)(path2) ? (0, import_node_fs56.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -54734,17 +55080,23 @@ function registerDeveloperCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  docs.command("refs").description("deterministic doc reference gate: repo paths, markdown links, mmi-cli command refs, and pins across docs, org-guide, mmi-help, README and architecture must resolve, or exit 1").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).action(async (o) => {
+  docs.command("refs").description("deterministic doc reference gate: repo paths, markdown links, mmi-cli command refs, and pins across docs, org-guide, mmi-help, README and architecture must resolve, or exit 1").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).option("--base <ref>", "require covered runbook sections to be touched against this merge base (#8126)").option("--runbooks-only", "check only operator runbooks (#8126)").option("--live", "check operator runbooks against registry tasks, vault names and HTTPS endpoints (implies --runbooks-only)").action(async (o) => {
     try {
       if (o.repo) {
         const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs refs${o.json ? " --json" : ""}`, "docs refs");
         if (!guard.ok) return failGraceful(guard.message);
       }
       const root = await repoRoot();
-      const commandPaths = new Set(
-        buildCommandManifest(program3).index.map((entry) => entry.path)
-      );
-      const result = runDocRefs(root, { commandPaths });
+      const manifest = buildCommandManifest(program3);
+      const commandPaths = new Set(manifest.index.map((entry) => entry.path));
+      const commandOptions = /* @__PURE__ */ new Map();
+      const collect = (entry) => {
+        commandOptions.set(entry.path, new Set(entry.options.flatMap((option) => option.flags.match(/--[\w-]+/g) ?? [])));
+        entry.subcommands.forEach(collect);
+      };
+      collect(manifest.tree);
+      const deps = { commandPaths, commandOptions, base: o.base, runbooksOnly: o.runbooksOnly };
+      const result = o.live ? await runLiveDocRefs(root, deps, createRunbookLiveDeps(process.argv[1])) : runDocRefs(root, deps);
       if (o.json) {
         consoleIo.log(JSON.stringify({ ok: result.ok, docCount: result.docCount, findings: result.findings, warnings: result.warnings }, null, 2));
         if (!result.ok) process.exitCode = 1;
@@ -54863,7 +55215,7 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path54.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path55.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -55035,7 +55387,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path55.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55044,7 +55396,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path55.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -56152,16 +56504,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path54.join)(root, path2);
+      const fullPath = (0, import_node_path55.join)(root, path2);
       return (0, import_node_fs57.existsSync)(fullPath) ? (0, import_node_fs57.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path54.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path55.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs57.existsSync)((0, import_node_path55.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs57.existsSync)((0, import_node_path55.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -56330,7 +56682,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path54.join)(path2, entry.name);
+    const child2 = (0, import_node_path55.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -56360,7 +56712,7 @@ function pluginCacheFsDeps(configRoot, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path54.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path55.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -56374,7 +56726,7 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path54.join)(stagingRoot, name);
+      const p = (0, import_node_path55.join)(stagingRoot, name);
       if (!(0, import_node_fs57.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs57.statSync)(q).mtimeMs);