cleargate 0.11.4 → 0.12.0

package/dist/cli.cjs

@@ -114,6 +114,40 @@ function requireMcpUrl(cfg) {
   }
   return cfg.mcpUrl;
 }
+function saveConfig(updates, opts = {}) {
+  const home = os.homedir();
+  if (!home) {
+    throw new Error("Cannot determine home directory.");
+  }
+  const configPath = opts.configPath ?? path2.join(home, ".cleargate", "config.json");
+  const dir = path2.dirname(configPath);
+  let existing = {};
+  try {
+    const raw = fs2.readFileSync(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      existing = parsed;
+    }
+  } catch (err) {
+    if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) {
+    }
+  }
+  const merged = { ...existing };
+  for (const [k, v] of Object.entries(updates)) {
+    if (v !== void 0) merged[k] = v;
+  }
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    fs2.chmodSync(dir, 448);
+  } catch {
+  }
+  const tmpPath = path2.join(dir, ".config.json.tmp");
+  const json = JSON.stringify(merged, null, 2) + "\n";
+  fs2.writeFileSync(tmpPath, json, { mode: 384 });
+  fs2.chmodSync(tmpPath, 384);
+  fs2.renameSync(tmpPath, configPath);
+  fs2.chmodSync(configPath, 384);
+}
 var fs2, os, path2, import_zod, ConfigSchema;
 var init_config = __esm({
   "src/config.ts"() {
@@ -383,6 +417,41 @@ var init_membership = __esm({
 });
 
 // src/auth/acquire.ts
+function defaultDiskCachePath(env = process.env) {
+  const override = env["CLEARGATE_DISK_CACHE_PATH"];
+  if (override === "off") return null;
+  if (typeof override === "string" && override.length > 0) return override;
+  const home = os9.homedir();
+  if (!home) return null;
+  return path45.join(home, ".cleargate", "access-token.json");
+}
+function readDiskCache(filePath) {
+  try {
+    const raw = fs42.readFileSync(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed !== null && typeof parsed === "object" && parsed.version === 1 && typeof parsed.entries === "object" && parsed.entries !== null) {
+      return parsed;
+    }
+  } catch {
+  }
+  return { version: 1, entries: {} };
+}
+function writeDiskCache(filePath, data) {
+  const dir = path45.dirname(filePath);
+  try {
+    fs42.mkdirSync(dir, { recursive: true, mode: 448 });
+    try {
+      fs42.chmodSync(dir, 448);
+    } catch {
+    }
+    const tmpPath = path45.join(dir, ".access-token.json.tmp");
+    fs42.writeFileSync(tmpPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+    fs42.chmodSync(tmpPath, 384);
+    fs42.renameSync(tmpPath, filePath);
+    fs42.chmodSync(filePath, 384);
+  } catch {
+  }
+}
 function decodeJwtPayload2(token) {
   try {
     const parts = token.split(".");
@@ -408,6 +477,15 @@ async function acquireAccessToken(opts) {
       return cached.accessToken;
     }
   }
+  const diskCachePath = opts.diskCachePath === void 0 ? defaultDiskCachePath() : opts.diskCachePath;
+  if (!opts.forceRefresh && diskCachePath) {
+    const file = readDiskCache(diskCachePath);
+    const entry = file.entries[cacheKey];
+    if (entry && nowFn() < entry.expiresAtMs) {
+      CACHE.set(cacheKey, entry);
+      return entry.accessToken;
+    }
+  }
   const store = await (opts.createStore ?? createTokenStore)();
   const stored = await store.load(opts.profile);
   if (!stored) {
@@ -456,15 +534,24 @@ async function acquireAccessToken(opts) {
   const exp = payload?.exp;
   if (typeof exp === "number" && Number.isFinite(exp)) {
     const expiresAtMs = (exp - 60) * 1e3;
-    CACHE.set(cacheKey, { accessToken, expiresAtMs });
+    const entry = { accessToken, expiresAtMs };
+    CACHE.set(cacheKey, entry);
+    if (diskCachePath) {
+      const file = readDiskCache(diskCachePath);
+      file.entries[cacheKey] = entry;
+      writeDiskCache(diskCachePath, file);
+    }
   }
   return accessToken;
 }
-var CACHE, AcquireError;
+var fs42, os9, path45, CACHE, AcquireError;
 var init_acquire = __esm({
   "src/auth/acquire.ts"() {
     "use strict";
     init_cjs_shims();
+    fs42 = __toESM(require("fs"), 1);
+    os9 = __toESM(require("os"), 1);
+    path45 = __toESM(require("path"), 1);
     init_factory();
     CACHE = /* @__PURE__ */ new Map();
     AcquireError = class extends Error {
@@ -696,7 +783,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "cleargate",
-  version: "0.11.4",
+  version: "0.12.0",
   private: false,
   type: "module",
   description: "Planning framework for Claude Code agents \u2014 sprint/epic/story protocol, five-role agent team (architect/developer/qa/devops/reporter), Karpathy-style awareness wiki.",
@@ -1314,7 +1401,8 @@ async function joinHandler(opts) {
     if (UUID_V4_RE.test(opts.inviteUrl)) {
       token = opts.inviteUrl;
       const cfg = loadConfig({
-        flags: { profile: opts.profile, mcpUrl: opts.mcpUrlFlag }
+        flags: { profile: opts.profile, mcpUrl: opts.mcpUrlFlag },
+        ...opts.configPath !== void 0 ? { configPath: opts.configPath } : {}
       });
       if (!cfg.mcpUrl) {
         stderr(
@@ -1651,9 +1739,15 @@ async function joinHandler(opts) {
   try {
     const store = await (opts.createStore ?? createTokenStore)();
     await store.save(opts.profile, refreshToken);
+    saveConfig(
+      { mcpUrl: baseUrl },
+      opts.configPath !== void 0 ? { configPath: opts.configPath } : {}
+    );
     stdout(`joined project '${projectName}' as '${hostname3()}'
 `);
     stdout(`refresh token saved to ${store.backend}.
+`);
+    stdout(`mcp_url ${baseUrl} saved to ~/.cleargate/config.json.
 `);
   } catch (err) {
     stderr(
@@ -2210,6 +2304,24 @@ var PREFIX_MAP = [
   { prefix: "BUG-", type: "bug", bucket: "bugs" },
   { prefix: "INITIATIVE-", type: "initiative", bucket: "initiatives" }
 ];
+var SPRINT_REPORT_FILENAMES = ["REPORT.md"];
+var SPRINT_REPORT_CANONICAL_RE = /^SPRINT-\d{2,}_REPORT\.md$/;
+function isSprintReportPath(relPath) {
+  const normalised = relPath.replace(/\\/g, "/");
+  const match = /\.cleargate\/sprint-runs\/(SPRINT-\d{2,})\/([^/]+)$/.exec(normalised);
+  if (!match) return false;
+  const filename = match[2];
+  return SPRINT_REPORT_FILENAMES.includes(filename) || SPRINT_REPORT_CANONICAL_RE.test(filename);
+}
+function deriveBucketFromReportPath(relPath) {
+  const normalised = relPath.replace(/\\/g, "/");
+  const match = /\.cleargate\/sprint-runs\/(SPRINT-\d{2,})\//.exec(normalised);
+  if (!match) {
+    throw new Error(`deriveBucketFromReportPath: cannot extract SPRINT-NN from: ${relPath}`);
+  }
+  const id = match[1];
+  return { type: "sprint", id, bucket: "sprints" };
+}
 function deriveBucket(filename) {
   const base = filename.includes("/") ? filename.split("/").pop() : filename;
   const stem = base.endsWith(".md") ? base.slice(0, -3) : base;
@@ -2333,6 +2445,12 @@ function serializePage(page, body) {
   if (page.sprint_cleargate_id !== void 0) {
     lines.push(`sprint_cleargate_id: "${page.sprint_cleargate_id}"`);
   }
+  if (page.report_raw_path !== void 0) {
+    lines.push(`report_raw_path: "${page.report_raw_path}"`);
+  }
+  if (page.last_report_ingest_commit !== void 0) {
+    lines.push(`last_report_ingest_commit: "${page.last_report_ingest_commit}"`);
+  }
   lines.push("---");
   const fm = lines.join("\n");
   return `${fm}
@@ -2355,7 +2473,9 @@ function parsePage(raw) {
   const last_contradict_sha = fm["last_contradict_sha"] !== void 0 ? String(fm["last_contradict_sha"]) : void 0;
   const parent_cleargate_id = fm["parent_cleargate_id"] !== void 0 ? String(fm["parent_cleargate_id"]) : void 0;
   const sprint_cleargate_id = fm["sprint_cleargate_id"] !== void 0 ? String(fm["sprint_cleargate_id"]) : void 0;
-  return { type, id, parent, children, status, remote_id, raw_path, last_ingest, last_ingest_commit, repo, last_contradict_sha, parent_cleargate_id, sprint_cleargate_id };
+  const report_raw_path = fm["report_raw_path"] !== void 0 ? String(fm["report_raw_path"]) : void 0;
+  const last_report_ingest_commit = fm["last_report_ingest_commit"] !== void 0 ? String(fm["last_report_ingest_commit"]) : void 0;
+  return { type, id, parent, children, status, remote_id, raw_path, last_ingest, last_ingest_commit, repo, last_contradict_sha, parent_cleargate_id, sprint_cleargate_id, report_raw_path, last_report_ingest_commit };
 }
 function parseFmRaw(raw) {
   const lines = raw.split("\n");
@@ -3887,28 +4007,33 @@ async function wikiIngestHandler(opts) {
   const rawPath = opts.rawPath;
   const absRawPath = path20.isAbsolute(rawPath) ? rawPath : path20.resolve(cwd, rawPath);
   const relRawPath = path20.relative(cwd, absRawPath).replace(/\\/g, "/");
-  const deliveryRoot = path20.join(cwd, ".cleargate", "delivery");
-  const deliveryRootNorm = deliveryRoot.replace(/\\/g, "/");
-  const absDeliveryRoot = deliveryRoot;
-  const relToDelivery = path20.relative(absDeliveryRoot, absRawPath);
-  if (relToDelivery.startsWith("..") || path20.isAbsolute(relToDelivery)) {
-    stderr(`wiki ingest: ${rawPath} not under .cleargate/delivery/
+  const isSprintReport = isSprintReportPath(relRawPath);
+  if (!isSprintReport) {
+    const deliveryRoot = path20.join(cwd, ".cleargate", "delivery");
+    const absDeliveryRoot = deliveryRoot;
+    const relToDelivery = path20.relative(absDeliveryRoot, absRawPath);
+    if (relToDelivery.startsWith("..") || path20.isAbsolute(relToDelivery)) {
+      stderr(`wiki ingest: ${rawPath} not under .cleargate/delivery/
 `);
-    exit(2);
-    return;
-  }
-  void deliveryRootNorm;
-  const isExcluded = EXCLUDED_SUFFIXES2.some((excl) => relRawPath.startsWith(excl));
-  if (isExcluded) {
-    stdout(`wiki ingest: ${rawPath} excluded (skip)
+      exit(2);
+      return;
+    }
+    const isExcluded = EXCLUDED_SUFFIXES2.some((excl) => relRawPath.startsWith(excl));
+    if (isExcluded) {
+      stdout(`wiki ingest: ${rawPath} excluded (skip)
 `);
-    exit(0);
-    return;
+      exit(0);
+      return;
+    }
   }
   const filename = path20.basename(absRawPath);
   let bucketInfo;
   try {
-    bucketInfo = deriveBucket(filename);
+    if (isSprintReport) {
+      bucketInfo = deriveBucketFromReportPath(relRawPath);
+    } else {
+      bucketInfo = deriveBucket(filename);
+    }
   } catch (e) {
     stderr(`wiki ingest: cannot determine bucket for ${rawPath}: ${e.message}
 `);
@@ -3951,16 +4076,26 @@ async function wikiIngestHandler(opts) {
   }
   const currentSha = getGitSha(absRawPath, gitRunner) ?? "";
   const pageExists = fs19.existsSync(pagePath);
-  if (pageExists && currentSha !== "") {
-    let isNoOp = false;
+  let existingPage;
+  if (pageExists) {
     try {
       const existingPageContent = fs19.readFileSync(pagePath, "utf8");
-      const existingPage = parsePage(existingPageContent);
-      if (existingPage.last_ingest_commit === currentSha) {
-        const contentUnchanged = checkContentUnchanged(absRawPath, currentSha, relRawPath, gitRunner);
-        if (contentUnchanged) {
+      existingPage = parsePage(existingPageContent);
+    } catch {
+    }
+  }
+  if (existingPage !== void 0 && currentSha !== "") {
+    let isNoOp = false;
+    try {
+      if (isSprintReport) {
+        if (existingPage.last_report_ingest_commit === currentSha) {
           isNoOp = true;
         }
+      } else {
+        if (existingPage.last_ingest_commit === currentSha) {
+          const contentUnchanged = checkContentUnchanged(absRawPath, currentSha, relRawPath, gitRunner);
+          if (contentUnchanged) isNoOp = true;
+        }
       }
     } catch {
     }
@@ -3972,36 +4107,53 @@ async function wikiIngestHandler(opts) {
     }
   }
   const action = pageExists ? "update" : "create";
-  let existingLastContradictSha;
-  if (pageExists) {
-    try {
-      const existingPageContent = fs19.readFileSync(pagePath, "utf8");
-      const existingPage = parsePage(existingPageContent);
-      existingLastContradictSha = existingPage.last_contradict_sha;
-    } catch {
-    }
-  }
+  const timestamp = now();
+  const existingLastContradictSha = existingPage?.last_contradict_sha;
+  const existingReportRawPath = existingPage?.report_raw_path;
+  const existingLastReportIngestCommit = existingPage?.last_report_ingest_commit;
   const parent = buildParentRef2(fm);
   const children = buildChildrenRefs2(fm);
-  const timestamp = now();
   const wikiPage = {
     type,
     id,
-    parent,
-    children,
-    status: String(fm["status"] ?? ""),
-    remote_id: String(fm["remote_id"] ?? ""),
-    raw_path: relRawPath,
+    parent: isSprintReport ? existingPage?.parent ?? "" : parent,
+    children: isSprintReport ? existingPage?.children ?? [] : children,
+    status: isSprintReport ? existingPage?.status ?? String(fm["status"] ?? "") : String(fm["status"] ?? ""),
+    remote_id: isSprintReport ? existingPage?.remote_id ?? String(fm["remote_id"] ?? "") : String(fm["remote_id"] ?? ""),
+    // raw_path tracks the plan file path; for report-only ingest preserve existing or use relRawPath as fallback
+    raw_path: isSprintReport ? existingPage?.raw_path ?? relRawPath : relRawPath,
     last_ingest: timestamp,
-    last_ingest_commit: currentSha,
+    // last_ingest_commit tracks the plan source; preserve when re-ingesting report
+    last_ingest_commit: isSprintReport ? existingPage?.last_ingest_commit ?? "" : currentSha,
     repo,
     // Carry forward last_contradict_sha so Phase 4 idempotency survives re-ingest
     ...existingLastContradictSha !== void 0 ? { last_contradict_sha: existingLastContradictSha } : {},
-    // Hierarchy keys (§11.7): read from raw fm — stamped at raw-side, not wiki-side
-    ...typeof fm["parent_cleargate_id"] === "string" ? { parent_cleargate_id: fm["parent_cleargate_id"] } : {},
-    ...typeof fm["sprint_cleargate_id"] === "string" ? { sprint_cleargate_id: fm["sprint_cleargate_id"] } : {}
+    // Hierarchy keys (§11.7): read from raw fm for plan ingest; preserve for report ingest
+    ...isSprintReport ? existingPage?.parent_cleargate_id !== void 0 ? { parent_cleargate_id: existingPage.parent_cleargate_id } : {} : typeof fm["parent_cleargate_id"] === "string" ? { parent_cleargate_id: fm["parent_cleargate_id"] } : {},
+    ...isSprintReport ? existingPage?.sprint_cleargate_id !== void 0 ? { sprint_cleargate_id: existingPage.sprint_cleargate_id } : {} : typeof fm["sprint_cleargate_id"] === "string" ? { sprint_cleargate_id: fm["sprint_cleargate_id"] } : {},
+    // CR-063 sprint-report fields
+    report_raw_path: isSprintReport ? relRawPath : existingReportRawPath ?? void 0,
+    last_report_ingest_commit: isSprintReport ? currentSha : existingLastReportIngestCommit ?? void 0
   };
-  const pageBody = buildPageBody2({ id, fm, body });
+  let existingPageBody = "";
+  if (existingPage !== void 0 && pageExists) {
+    try {
+      const existingPageContent = fs19.readFileSync(pagePath, "utf8");
+      const lines = existingPageContent.split("\n");
+      let closingDash = -1;
+      for (let i = 1; i < lines.length; i++) {
+        if (lines[i] === "---") {
+          closingDash = i;
+          break;
+        }
+      }
+      if (closingDash !== -1) {
+        existingPageBody = lines.slice(closingDash + 1).join("\n").replace(/^\n/, "");
+      }
+    } catch {
+    }
+  }
+  const pageBody = buildPageBody2({ id, fm, body, isSprintReport, existingPageBody });
   const pageContent = serializePage(wikiPage, pageBody);
   fs19.mkdirSync(pageDir, { recursive: true });
   fs19.writeFileSync(pagePath, pageContent, "utf8");
@@ -4079,7 +4231,37 @@ function buildChildrenRefs2(fm) {
     return `[[${s}]]`;
   });
 }
+function extractReportBlock(pageBody) {
+  const beginMarker = "<!-- BEGIN sprint-report -->";
+  const endMarker = "<!-- END sprint-report -->";
+  const beginIdx = pageBody.indexOf(beginMarker);
+  const endIdx = pageBody.indexOf(endMarker);
+  if (beginIdx === -1 || endIdx === -1 || endIdx <= beginIdx) return void 0;
+  return pageBody.slice(beginIdx, endIdx + endMarker.length);
+}
+function extractPlanStub(pageBody) {
+  const beginMarker = "<!-- BEGIN sprint-report -->";
+  const beginIdx = pageBody.indexOf(beginMarker);
+  if (beginIdx === -1) return pageBody;
+  return pageBody.slice(0, beginIdx);
+}
 function buildPageBody2(item) {
+  const { isSprintReport, existingPageBody } = item;
+  if (isSprintReport) {
+    const planStub = existingPageBody ? extractPlanStub(existingPageBody) : buildPlanStub(item);
+    const reportBlock = buildReportBlock(item.body);
+    return planStub + reportBlock;
+  } else {
+    const planStub = buildPlanStub(item);
+    const existingReportBlock = existingPageBody ? extractReportBlock(existingPageBody) : void 0;
+    if (existingReportBlock !== void 0) {
+      const stub = planStub.trimEnd() + "\n\n";
+      return stub + existingReportBlock + "\n";
+    }
+    return planStub;
+  }
+}
+function buildPlanStub(item) {
   const title = String(item.fm["title"] ?? item.id);
   const summary = String(
     item.fm["description"] ?? item.body.split("\n")[0] ?? "No summary available."
@@ -4103,6 +4285,16 @@ function buildPageBody2(item) {
     ""
   ].join("\n");
 }
+function buildReportBlock(reportBody) {
+  return [
+    "<!-- BEGIN sprint-report -->",
+    "## Sprint Report",
+    "",
+    reportBody.trim(),
+    "<!-- END sprint-report -->",
+    ""
+  ].join("\n");
+}
 function appendLogEntry(wikiRoot, entry) {
   const logPath = path20.join(wikiRoot, "log.md");
   const logEntry = [
@@ -6583,7 +6775,7 @@ async function writeCachedGate(absPath, result, opts) {
     throw new Error(`writeCachedGate: failed to parse frontmatter in ${absPath}`);
   }
   const existing = coerceCachedGate(fm["cached_gate_result"]);
-  if (existing && JSON.stringify(existing) === JSON.stringify(newResult)) {
+  if (existing && existing.pass === newResult.pass && JSON.stringify(existing.failing_criteria) === JSON.stringify(newResult.failing_criteria)) {
     return;
   }
   const newFm = {};
@@ -8109,6 +8301,10 @@ function refreshScopedGateCaches(sprintId, cwd, execFn) {
     if (!absPath) {
       continue;
     }
+    if (absPath.includes(`${path36.sep}archive${path36.sep}`)) {
+      result.skipped.push(id);
+      continue;
+    }
     let status = "";
     try {
       const raw = fs34.readFileSync(absPath, "utf8");
@@ -9618,7 +9814,7 @@ async function uninstallHandler(opts) {
 // src/commands/sync.ts
 init_cjs_shims();
 var fsPromises8 = __toESM(require("fs/promises"), 1);
-var path50 = __toESM(require("path"), 1);
+var path51 = __toESM(require("path"), 1);
 
 // src/lib/sync-log.ts
 init_cjs_shims();
@@ -9938,12 +10134,12 @@ init_config();
 // src/lib/intake.ts
 init_cjs_shims();
 var fsPromises4 = __toESM(require("fs/promises"), 1);
-var path46 = __toESM(require("path"), 1);
+var path47 = __toESM(require("path"), 1);
 
 // src/lib/slug.ts
 init_cjs_shims();
 var fsPromises3 = __toESM(require("fs/promises"), 1);
-var path45 = __toESM(require("path"), 1);
+var path46 = __toESM(require("path"), 1);
 function slugify(title, max = 40) {
   const normalized = title.normalize("NFKD").replace(new RegExp("\\p{M}", "gu"), "");
   const lowered = normalized.toLowerCase();
@@ -9958,8 +10154,8 @@ function slugify(title, max = 40) {
 var PROPOSAL_ID_RE = /^proposal_id:\s*"?PROP-(\d+)"?/m;
 async function nextProposalId(projectRoot) {
   const dirs = [
-    path45.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path45.join(projectRoot, ".cleargate", "delivery", "archive")
+    path46.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path46.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   let maxN = 0;
   for (const dir of dirs) {
@@ -9971,7 +10167,7 @@ async function nextProposalId(projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path45.join(dir, entry.name);
+      const fullPath = path46.join(dir, entry.name);
       try {
         const raw = await fsPromises3.readFile(fullPath, "utf8");
         const fmEnd = extractFrontmatterBlock(raw);
@@ -9989,8 +10185,8 @@ async function nextProposalId(projectRoot) {
 }
 async function findByRemoteId(projectRoot, remoteId) {
   const dirs = [
-    path45.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path45.join(projectRoot, ".cleargate", "delivery", "archive")
+    path46.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path46.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   const escaped = remoteId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`^remote_id:\\s*"?${escaped}"?\\s*$`, "m");
@@ -10003,7 +10199,7 @@ async function findByRemoteId(projectRoot, remoteId) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path45.join(dir, entry.name);
+      const fullPath = path46.join(dir, entry.name);
       try {
         const raw = await fsPromises3.readFile(fullPath, "utf8");
         const fm = extractFrontmatterBlock(raw);
@@ -10040,7 +10236,7 @@ async function runIntakeBranch(opts) {
     labelFilter = "cleargate:proposal",
     now = () => (/* @__PURE__ */ new Date()).toISOString()
   } = opts;
-  const pendingSyncDir = path46.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSyncDir = path47.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let remoteItems = [];
   try {
     remoteItems = await mcp2.call(
@@ -10071,7 +10267,7 @@ async function runIntakeBranch(opts) {
       const slug2 = slugify(item.title ?? "untitled");
       const num2 = proposalId2.replace("PROP-", "");
       const filename2 = `PROPOSAL-${num2}-remote-${slug2}.md`;
-      const targetPath2 = path46.join(pendingSyncDir, filename2);
+      const targetPath2 = path47.join(pendingSyncDir, filename2);
       createdItems.push({
         proposalId: proposalId2,
         remoteId: item.remote_id,
@@ -10084,7 +10280,7 @@ async function runIntakeBranch(opts) {
     const num = proposalId.replace("PROP-", "");
     const slug = slugify(item.title ?? "untitled");
     const filename = `PROPOSAL-${num}-remote-${slug}.md`;
-    const targetPath = path46.join(pendingSyncDir, filename);
+    const targetPath = path47.join(pendingSyncDir, filename);
     const nowTs = now();
     const fm = {
       proposal_id: proposalId,
@@ -10176,8 +10372,8 @@ path/to/new/file.ext - {Explanation of purpose}
 }
 async function hasAnyRemoteAuthored(projectRoot) {
   const dirs = [
-    path46.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path46.join(projectRoot, ".cleargate", "delivery", "archive")
+    path47.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path47.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   for (const dir of dirs) {
     let entries;
@@ -10188,7 +10384,7 @@ async function hasAnyRemoteAuthored(projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path46.join(dir, entry.name);
+      const fullPath = path47.join(dir, entry.name);
       try {
         const raw = await fsPromises4.readFile(fullPath, "utf8");
         const fmEnd = raw.indexOf("\n---", 4);
@@ -10206,9 +10402,9 @@ async function hasAnyRemoteAuthored(projectRoot) {
 
 // src/lib/active-criteria.ts
 init_cjs_shims();
-var fs42 = __toESM(require("fs"), 1);
+var fs43 = __toESM(require("fs"), 1);
 var fsPromises5 = __toESM(require("fs/promises"), 1);
-var path47 = __toESM(require("path"), 1);
+var path48 = __toESM(require("path"), 1);
 async function resolveActiveItems(projectRoot, localItems, nowFn = () => (/* @__PURE__ */ new Date()).toISOString()) {
   const active = /* @__PURE__ */ new Set();
   const now = Date.parse(nowFn());
@@ -10233,7 +10429,7 @@ async function resolveInSprintIds(projectRoot) {
   const ids = /* @__PURE__ */ new Set();
   try {
     const sprintDir = resolveActiveSprintDir(projectRoot);
-    const sprintId = path47.basename(sprintDir);
+    const sprintId = path48.basename(sprintDir);
     if (sprintId === "_off-sprint") return ids;
     const sprintFile = await findSprintFile2(projectRoot, sprintId);
     if (!sprintFile) return ids;
@@ -10248,14 +10444,14 @@ async function resolveInSprintIds(projectRoot) {
   return ids;
 }
 async function findSprintFile2(projectRoot, sprintId) {
-  const pendingSync = path47.join(projectRoot, ".cleargate", "delivery", "pending-sync");
-  const archive = path47.join(projectRoot, ".cleargate", "delivery", "archive");
+  const pendingSync = path48.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const archive = path48.join(projectRoot, ".cleargate", "delivery", "archive");
   for (const dir of [pendingSync, archive]) {
     try {
-      const entries = fs42.readdirSync(dir, { withFileTypes: true });
+      const entries = fs43.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isFile() && entry.name.startsWith(sprintId) && entry.name.endsWith(".md")) {
-          return path47.join(dir, entry.name);
+          return path48.join(dir, entry.name);
         }
       }
     } catch {
@@ -10267,12 +10463,12 @@ async function findSprintFile2(projectRoot, sprintId) {
 // src/lib/comments-cache.ts
 init_cjs_shims();
 var fsPromises6 = __toESM(require("fs/promises"), 1);
-var path48 = __toESM(require("path"), 1);
+var path49 = __toESM(require("path"), 1);
 function cacheDir(projectRoot) {
-  return path48.join(projectRoot, ".cleargate", ".comments-cache");
+  return path49.join(projectRoot, ".cleargate", ".comments-cache");
 }
 function cachePath(projectRoot, remoteId) {
-  return path48.join(cacheDir(projectRoot), `${remoteId}.json`);
+  return path49.join(cacheDir(projectRoot), `${remoteId}.json`);
 }
 async function writeCommentCache(projectRoot, remoteId, comments) {
   const dir = cacheDir(projectRoot);
@@ -10287,7 +10483,7 @@ async function writeCommentCache(projectRoot, remoteId, comments) {
 // src/lib/wiki-comments-render.ts
 init_cjs_shims();
 var fsPromises7 = __toESM(require("fs/promises"), 1);
-var path49 = __toESM(require("path"), 1);
+var path50 = __toESM(require("path"), 1);
 var START = "<!-- cleargate:comments:start -->";
 var END = "<!-- cleargate:comments:end -->";
 function resolveBucket(fm) {
@@ -10332,7 +10528,7 @@ async function renderCommentsSection(opts) {
   const bucket = resolveBucket(localItem.fm);
   const primaryId = getPrimaryId(localItem.fm);
   if (!bucket || !primaryId) return;
-  const wikiPath = path49.join(
+  const wikiPath = path50.join(
     projectRoot,
     ".cleargate",
     "wiki",
@@ -10368,7 +10564,7 @@ async function renderCommentsSection(opts) {
   await writeAtomic4(wikiPath, updated);
 }
 async function writeAtomic4(filePath, content) {
-  await fsPromises7.mkdir(path49.dirname(filePath), { recursive: true });
+  await fsPromises7.mkdir(path50.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises7.writeFile(tmpPath, content, "utf8");
   await fsPromises7.rename(tmpPath, filePath);
@@ -10380,11 +10576,11 @@ async function syncCheckHandler(opts = {}) {
   const env = opts.env ?? process.env;
   const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const markerPath = path50.join(projectRoot, ".cleargate", ".sync-marker.json");
+  const markerPath = path51.join(projectRoot, ".cleargate", ".sync-marker.json");
   const updateMarker = async (nowIso2) => {
     try {
       const content = JSON.stringify({ last_check: nowIso2 });
-      await fsPromises8.mkdir(path50.dirname(markerPath), { recursive: true });
+      await fsPromises8.mkdir(path51.dirname(markerPath), { recursive: true });
       const tmpPath = `${markerPath}.tmp.${Date.now()}`;
       await fsPromises8.writeFile(tmpPath, content, "utf8");
       await fsPromises8.rename(tmpPath, markerPath);
@@ -10467,7 +10663,7 @@ async function syncHandler(opts = {}) {
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
-  const sprintId = path50.basename(sprintRoot);
+  const sprintId = path51.basename(sprintRoot);
   let mcp2;
   if (opts.mcp) {
     mcp2 = opts.mcp;
@@ -10528,7 +10724,7 @@ async function syncHandler(opts = {}) {
     exit(2);
     return;
   }
-  const wikiMetaPath = path50.join(projectRoot, ".cleargate", "wiki", "meta.json");
+  const wikiMetaPath = path51.join(projectRoot, ".cleargate", "wiki", "meta.json");
   let lastRemoteSync = "1970-01-01T00:00:00.000Z";
   try {
     const metaRaw = await fsPromises8.readFile(wikiMetaPath, "utf8");
@@ -10769,7 +10965,7 @@ async function syncHandler(opts = {}) {
     };
     await appendSyncLog(sprintRoot, entry);
   }
-  const conflictsFile = path50.join(projectRoot, ".cleargate", ".conflicts.json");
+  const conflictsFile = path51.join(projectRoot, ".cleargate", ".conflicts.json");
   const conflictsContent = {
     generated_at: nowFn(),
     sprint_id: sprintId,
@@ -10777,7 +10973,7 @@ async function syncHandler(opts = {}) {
   };
   await writeAtomic5(conflictsFile, JSON.stringify(conflictsContent, null, 2) + "\n");
   try {
-    await fsPromises8.mkdir(path50.dirname(wikiMetaPath), { recursive: true });
+    await fsPromises8.mkdir(path51.dirname(wikiMetaPath), { recursive: true });
     let meta = {};
     try {
       const raw = await fsPromises8.readFile(wikiMetaPath, "utf8");
@@ -10818,13 +11014,13 @@ async function applyPull(item, localPath, fm, actorEmail, nowFn) {
   await writeAtomic5(localPath, newContent);
 }
 async function writeAtomic5(filePath, content) {
-  await fsPromises8.mkdir(path50.dirname(filePath), { recursive: true });
+  await fsPromises8.mkdir(path51.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises8.writeFile(tmpPath, content, "utf8");
   await fsPromises8.rename(tmpPath, filePath);
 }
 async function scanLocalItems(projectRoot) {
-  const pendingSync = path50.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSync = path51.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   const results = [];
   let entries;
   try {
@@ -10834,7 +11030,7 @@ async function scanLocalItems(projectRoot) {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const fullPath = path50.join(pendingSync, entry.name);
+    const fullPath = path51.join(pendingSync, entry.name);
     try {
       const raw = await fsPromises8.readFile(fullPath, "utf8");
       const { fm, body } = parseFrontmatter(raw);
@@ -10862,7 +11058,7 @@ init_config();
 // src/lib/sync/work-items.ts
 init_cjs_shims();
 var fsPromises9 = __toESM(require("fs/promises"), 1);
-var path51 = __toESM(require("path"), 1);
+var path52 = __toESM(require("path"), 1);
 var import_node_crypto2 = require("crypto");
 var BATCH_SIZE = 100;
 var ATTRIBUTION_FIELDS = /* @__PURE__ */ new Set([
@@ -10910,8 +11106,8 @@ function getItemId2(fm) {
 }
 async function walkDeliveryDirs(projectRoot) {
   const dirs = [
-    path51.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
-    path51.join(projectRoot, ".cleargate", "delivery", "archive")
+    path52.join(projectRoot, ".cleargate", "delivery", "pending-sync"),
+    path52.join(projectRoot, ".cleargate", "delivery", "archive")
   ];
   const results = [];
   for (const dir of dirs) {
@@ -10923,7 +11119,7 @@ async function walkDeliveryDirs(projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path51.join(dir, entry.name);
+      const fullPath = path52.join(dir, entry.name);
       try {
         const raw = await fsPromises9.readFile(fullPath, "utf8");
         const { fm, body } = parseFrontmatter(raw);
@@ -10948,7 +11144,7 @@ async function walkDeliveryDirs(projectRoot) {
   return results;
 }
 async function writeAtomic6(filePath, content) {
-  await fsPromises9.mkdir(path51.dirname(filePath), { recursive: true });
+  await fsPromises9.mkdir(path52.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises9.writeFile(tmpPath, content, "utf8");
   await fsPromises9.rename(tmpPath, filePath);
@@ -11015,9 +11211,9 @@ async function syncWorkItems(opts) {
 
 // src/lib/admin-url.ts
 init_cjs_shims();
-var fs43 = __toESM(require("fs"), 1);
-var os9 = __toESM(require("os"), 1);
-var path52 = __toESM(require("path"), 1);
+var fs44 = __toESM(require("fs"), 1);
+var os10 = __toESM(require("os"), 1);
+var path53 = __toESM(require("path"), 1);
 var DEFAULT_BASE = "https://admin.cleargate.soula.ge/";
 function adminUrl(urlPath, opts) {
   const env = opts?.env ?? process.env;
@@ -11038,10 +11234,10 @@ function adminUrl(urlPath, opts) {
   return base;
 }
 function readLocalConfig() {
-  const home = os9.homedir();
+  const home = os10.homedir();
   if (!home) return null;
-  const configPath = path52.join(home, ".cleargate", "config.json");
-  const raw = fs43.readFileSync(configPath, "utf8");
+  const configPath = path53.join(home, ".cleargate", "config.json");
+  const raw = fs44.readFileSync(configPath, "utf8");
   return JSON.parse(raw);
 }
 
@@ -11156,7 +11352,7 @@ async function syncWorkItemsHandler(opts = {}) {
 // src/commands/pull.ts
 init_cjs_shims();
 var fsPromises10 = __toESM(require("fs/promises"), 1);
-var path53 = __toESM(require("path"), 1);
+var path54 = __toESM(require("path"), 1);
 init_acquire();
 init_config();
 async function pullHandler(idOrRemoteId, opts = {}) {
@@ -11271,7 +11467,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
     result: "ok"
   };
   await appendSyncLog(sprintRoot, entry);
-  stdout(`pull: ${remoteId} applied to ${path53.relative(projectRoot, localPath)}
+  stdout(`pull: ${remoteId} applied to ${path54.relative(projectRoot, localPath)}
 `);
   if (opts.comments) {
     const comments = await mcp2.call(
@@ -11294,7 +11490,7 @@ async function resolveRemoteId(idOrRemoteId, projectRoot) {
   if (/^[A-Z]+-\d+/.test(idOrRemoteId)) {
     return idOrRemoteId;
   }
-  const pendingSync = path53.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSync = path54.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let entries;
   try {
     entries = await fsPromises10.readdir(pendingSync, { withFileTypes: true });
@@ -11304,7 +11500,7 @@ async function resolveRemoteId(idOrRemoteId, projectRoot) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
     try {
-      const raw = await fsPromises10.readFile(path53.join(pendingSync, entry.name), "utf8");
+      const raw = await fsPromises10.readFile(path54.join(pendingSync, entry.name), "utf8");
       const { fm } = parseFrontmatter(raw);
       for (const key of ["story_id", "epic_id", "proposal_id", "cr_id", "bug_id"]) {
         if (fm[key] === idOrRemoteId && typeof fm["remote_id"] === "string") {
@@ -11317,7 +11513,7 @@ async function resolveRemoteId(idOrRemoteId, projectRoot) {
   return null;
 }
 async function findLocalFile(remoteId, projectRoot) {
-  const pendingSync = path53.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingSync = path54.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let entries;
   try {
     entries = await fsPromises10.readdir(pendingSync, { withFileTypes: true });
@@ -11326,7 +11522,7 @@ async function findLocalFile(remoteId, projectRoot) {
   }
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const fullPath = path53.join(pendingSync, entry.name);
+    const fullPath = path54.join(pendingSync, entry.name);
     try {
       const raw = await fsPromises10.readFile(fullPath, "utf8");
       const { fm } = parseFrontmatter(raw);
@@ -11337,7 +11533,7 @@ async function findLocalFile(remoteId, projectRoot) {
   return null;
 }
 async function writeAtomic7(filePath, content) {
-  await fsPromises10.mkdir(path53.dirname(filePath), { recursive: true });
+  await fsPromises10.mkdir(path54.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises10.writeFile(tmpPath, content, "utf8");
   await fsPromises10.rename(tmpPath, filePath);
@@ -11353,7 +11549,7 @@ function getItemId3(fm) {
 // src/commands/push.ts
 init_cjs_shims();
 var fsPromises11 = __toESM(require("fs/promises"), 1);
-var path54 = __toESM(require("path"), 1);
+var path55 = __toESM(require("path"), 1);
 init_acquire();
 init_config();
 async function pushHandler(fileOrId, opts = {}) {
@@ -11429,7 +11625,20 @@ async function pushHandler(fileOrId, opts = {}) {
 }
 async function handlePush(filePath, ctx) {
   const { projectRoot, identity, sprintRoot, nowFn, resolveMcp, stdout, stderr, exit } = ctx;
-  const resolvedPath = path54.isAbsolute(filePath) ? filePath : path54.resolve(projectRoot, filePath);
+  const resolvedPath = path55.isAbsolute(filePath) ? filePath : path55.resolve(projectRoot, filePath);
+  if (SPRINT_RUNS_PATH_REGEX.test(resolvedPath)) {
+    if (!SPRINT_REPORT_PATH_REGEX.test(resolvedPath)) {
+      stderr(
+        `Error: path not in allowlist. Only sprint report files are accepted from sprint-runs/.
+  Allowed: .cleargate/sprint-runs/SPRINT-NN/REPORT.md
+           .cleargate/sprint-runs/SPRINT-NN/SPRINT-NN_REPORT.md
+  Got:     "${resolvedPath}"
+`
+      );
+      exit(2);
+      return;
+    }
+  }
   let rawContent;
   try {
     rawContent = await fsPromises11.readFile(resolvedPath, "utf8");
@@ -11459,7 +11668,7 @@ async function handlePush(filePath, ctx) {
     return;
   }
   const itemId = getItemId4(fm);
-  const type = getItemType2(fm);
+  const type = getItemTypeWithPathOverride(resolvedPath, fm);
   if (!type) {
     stderr(`Error: cannot determine item type from frontmatter in "${resolvedPath}".
 `);
@@ -11472,6 +11681,9 @@ async function handlePush(filePath, ctx) {
     if (h1) payloadForPush["title"] = h1;
   }
   payloadForPush["body"] = body;
+  if (payloadForPush["origin"] === void 0) {
+    payloadForPush["origin"] = "cleargate-cli";
+  }
   const mcp2 = await resolveMcp();
   let result;
   try {
@@ -11555,8 +11767,8 @@ async function handleRevert(idOrRemoteId, ctx) {
   void localPath;
 }
 async function resolveLocalItem(idOrRemoteId, projectRoot) {
-  const pendingSync = path54.join(projectRoot, ".cleargate", "delivery", "pending-sync");
-  const archive = path54.join(projectRoot, ".cleargate", "delivery", "archive");
+  const pendingSync = path55.join(projectRoot, ".cleargate", "delivery", "pending-sync");
+  const archive = path55.join(projectRoot, ".cleargate", "delivery", "archive");
   for (const dir of [pendingSync, archive]) {
     let entries;
     try {
@@ -11566,7 +11778,7 @@ async function resolveLocalItem(idOrRemoteId, projectRoot) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const fullPath = path54.join(dir, entry.name);
+      const fullPath = path55.join(dir, entry.name);
       try {
         const raw = await fsPromises11.readFile(fullPath, "utf8");
         const { fm } = parseFrontmatter(raw);
@@ -11585,23 +11797,26 @@ async function resolveLocalItem(idOrRemoteId, projectRoot) {
   return null;
 }
 async function writeAtomic8(filePath, content) {
-  await fsPromises11.mkdir(path54.dirname(filePath), { recursive: true });
+  await fsPromises11.mkdir(path55.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
   await fsPromises11.writeFile(tmpPath, content, "utf8");
   await fsPromises11.rename(tmpPath, filePath);
 }
 function getItemId4(fm) {
-  for (const key of ["story_id", "epic_id", "proposal_id", "cr_id", "bug_id"]) {
+  for (const key of ["story_id", "epic_id", "proposal_id", "sprint_id", "cr_id", "bug_id"]) {
     const val = fm[key];
     if (typeof val === "string" && val) return val;
   }
   return "unknown";
 }
+var SPRINT_RUNS_PATH_REGEX = /\.cleargate[\\/]sprint-runs[\\/]/;
+var SPRINT_REPORT_PATH_REGEX = /\.cleargate[\\/]sprint-runs[\\/]SPRINT-\d{2,}[\\/](REPORT|SPRINT-\d{2,}_REPORT)\.md$/;
 function getItemType2(fm) {
   const typeMap = {
     story_id: "story",
     epic_id: "epic",
     proposal_id: "proposal",
+    sprint_id: "sprint",
     cr_id: "cr",
     bug_id: "bug"
   };
@@ -11610,11 +11825,15 @@ function getItemType2(fm) {
   }
   return null;
 }
+function getItemTypeWithPathOverride(localPath, fm) {
+  if (SPRINT_REPORT_PATH_REGEX.test(localPath)) return "sprint_report";
+  return getItemType2(fm);
+}
 
 // src/commands/conflicts.ts
 init_cjs_shims();
 var fsPromises12 = __toESM(require("fs/promises"), 1);
-var path55 = __toESM(require("path"), 1);
+var path56 = __toESM(require("path"), 1);
 init_acquire();
 init_config();
 var RESOLUTION_HINTS = {
@@ -11652,7 +11871,7 @@ async function conflictsHandler(opts = {}) {
       }
     }
   }
-  const conflictsFile = path55.join(projectRoot, ".cleargate", ".conflicts.json");
+  const conflictsFile = path56.join(projectRoot, ".cleargate", ".conflicts.json");
   let data;
   try {
     const raw = await fsPromises12.readFile(conflictsFile, "utf8");
@@ -11740,24 +11959,24 @@ function formatEntry(entry) {
 
 // src/commands/admin-login.ts
 init_cjs_shims();
-var fs44 = __toESM(require("fs"), 1);
-var path56 = __toESM(require("path"), 1);
-var os10 = __toESM(require("os"), 1);
+var fs45 = __toESM(require("fs"), 1);
+var path57 = __toESM(require("path"), 1);
+var os11 = __toESM(require("os"), 1);
 var DEFAULT_MCP_URL = "http://localhost:3000";
 function resolveMcpUrl(mcpUrlFlag, env) {
   return (mcpUrlFlag ?? (env ?? process.env)["CLEARGATE_MCP_URL"] ?? DEFAULT_MCP_URL).replace(/\/$/, "");
 }
 function resolveAuthFilePath(opts) {
   if (opts.authFilePath) return opts.authFilePath;
-  const homedirFn = opts.homedir ?? os10.homedir;
-  return path56.join(homedirFn(), ".cleargate", "admin-auth.json");
+  const homedirFn = opts.homedir ?? os11.homedir;
+  return path57.join(homedirFn(), ".cleargate", "admin-auth.json");
 }
 function writeAdminAuth(filePath, token) {
-  const dir = path56.dirname(filePath);
-  fs44.mkdirSync(dir, { recursive: true });
+  const dir = path57.dirname(filePath);
+  fs45.mkdirSync(dir, { recursive: true });
   const payload = JSON.stringify({ version: 1, token }, null, 2);
-  fs44.writeFileSync(filePath, payload, { encoding: "utf8", mode: 384 });
-  fs44.chmodSync(filePath, 384);
+  fs45.writeFileSync(filePath, payload, { encoding: "utf8", mode: 384 });
+  fs45.chmodSync(filePath, 384);
 }
 async function adminLoginHandler(opts = {}) {
   const fetchFn = opts.fetch ?? globalThis.fetch;
@@ -11867,8 +12086,8 @@ async function adminLoginHandler(opts = {}) {
 
 // src/commands/hotfix.ts
 init_cjs_shims();
-var fs45 = __toESM(require("fs"), 1);
-var path57 = __toESM(require("path"), 1);
+var fs46 = __toESM(require("fs"), 1);
+var path58 = __toESM(require("path"), 1);
 function defaultExit4(code) {
   return process.exit(code);
 }
@@ -11878,7 +12097,7 @@ function maxHotfixId(pendingDir) {
   let max = 0;
   let entries;
   try {
-    entries = fs45.readdirSync(pendingDir);
+    entries = fs46.readdirSync(pendingDir);
   } catch {
     return 0;
   }
@@ -11892,13 +12111,13 @@ function maxHotfixId(pendingDir) {
   return max;
 }
 function countActiveHotfixes(repoRoot) {
-  const pendingDir = path57.join(repoRoot, ".cleargate", "delivery", "pending-sync");
-  const archiveDir = path57.join(repoRoot, ".cleargate", "delivery", "archive");
+  const pendingDir = path58.join(repoRoot, ".cleargate", "delivery", "pending-sync");
+  const archiveDir = path58.join(repoRoot, ".cleargate", "delivery", "archive");
   const sevenDaysAgo = Date.now() - 7 * 24 * 60 * 60 * 1e3;
   let count = 0;
   let pendingEntries = [];
   try {
-    pendingEntries = fs45.readdirSync(pendingDir);
+    pendingEntries = fs46.readdirSync(pendingDir);
   } catch {
   }
   for (const entry of pendingEntries) {
@@ -11906,13 +12125,13 @@ function countActiveHotfixes(repoRoot) {
   }
   let archiveEntries = [];
   try {
-    archiveEntries = fs45.readdirSync(archiveDir);
+    archiveEntries = fs46.readdirSync(archiveDir);
   } catch {
   }
   for (const entry of archiveEntries) {
     if (entry.startsWith("HOTFIX-") && entry.endsWith(".md")) {
       try {
-        const stat = fs45.statSync(path57.join(archiveDir, entry));
+        const stat = fs46.statSync(path58.join(archiveDir, entry));
         if (stat.mtimeMs >= sevenDaysAgo) count++;
       } catch {
       }
@@ -11921,7 +12140,7 @@ function countActiveHotfixes(repoRoot) {
   return count;
 }
 function resolveTemplatePath(repoRoot) {
-  return path57.join(repoRoot, ".cleargate", "templates", "hotfix.md");
+  return path58.join(repoRoot, ".cleargate", "templates", "hotfix.md");
 }
 function hotfixNewHandler(opts, cli) {
   const stdoutFn = cli?.stdout ?? ((s) => process.stdout.write(s + "\n"));
@@ -11940,14 +12159,14 @@ function hotfixNewHandler(opts, cli) {
     );
     return exitFn(1);
   }
-  const pendingDir = path57.join(repoRoot, ".cleargate", "delivery", "pending-sync");
+  const pendingDir = path58.join(repoRoot, ".cleargate", "delivery", "pending-sync");
   const maxId = maxHotfixId(pendingDir);
   const nextId = maxId + 1;
   const idStr = `HOTFIX-${String(nextId).padStart(3, "0")}`;
   const templatePath = resolveTemplatePath(repoRoot);
   let templateContent;
   try {
-    templateContent = fs45.readFileSync(templatePath, "utf8");
+    templateContent = fs46.readFileSync(templatePath, "utf8");
   } catch {
     stderrFn(`[cleargate hotfix new] template not found: ${templatePath}`);
     return exitFn(2);
@@ -11955,10 +12174,10 @@ function hotfixNewHandler(opts, cli) {
   const content = templateContent.replace(/\{ID\}/g, idStr).replace(/\{SLUG\}/g, opts.slug).replace(/\{ISO\}/g, now);
   const fileSlug = opts.slug.replace(/-/g, "_");
   const fileName = `${idStr}_${fileSlug}.md`;
-  const outPath = path57.join(pendingDir, fileName);
+  const outPath = path58.join(pendingDir, fileName);
   try {
-    fs45.mkdirSync(pendingDir, { recursive: true });
-    fs45.writeFileSync(outPath, content, "utf8");
+    fs46.mkdirSync(pendingDir, { recursive: true });
+    fs46.writeFileSync(outPath, content, "utf8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     stderrFn(`[cleargate hotfix new] write failed: ${msg}`);
@@ -12046,8 +12265,26 @@ var AuthFetcher = class {
   }
 };
 
+// src/auth/service-token-fetcher.ts
+init_cjs_shims();
+var ServiceTokenFetcher = class {
+  constructor(token) {
+    this.token = token;
+  }
+  token;
+  async getAccessToken() {
+    return this.token;
+  }
+};
+
 // src/commands/mcp-serve.ts
 var DEFAULT_BASE_URL = "https://cleargate-mcp.soula.ge";
+var ServiceToken401Error = class extends Error {
+  constructor() {
+    super("service-token-401");
+    this.name = "ServiceToken401Error";
+  }
+};
 async function mcpServeHandler(opts) {
   const fetchFn = opts.fetch ?? globalThis.fetch;
   const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
@@ -12057,32 +12294,44 @@ async function mcpServeHandler(opts) {
     flags: { profile: opts.profile, mcpUrl: opts.mcpUrlFlag }
   });
   const baseUrl = cfg.mcpUrl ?? DEFAULT_BASE_URL;
-  const store = await (opts.createStore ?? createTokenStore)({
-    ...opts.keychainService !== void 0 ? { keychainService: opts.keychainService } : {},
-    ...opts.forceBackend !== void 0 ? { forceBackend: opts.forceBackend } : {}
-  });
-  const fetcher = new AuthFetcher({
-    baseUrl,
-    loadRefresh: () => store.load(opts.profile),
-    saveRefresh: (t) => store.save(opts.profile, t),
-    ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
-    ...opts.now !== void 0 ? { now: opts.now } : {}
-  });
-  try {
-    await fetcher.getAccessToken();
-  } catch (err) {
-    if (err instanceof RefreshError) {
-      stderr(
-        `cleargate mcp serve: refresh failed (${err.status} ${err.code}). Run \`cleargate join <invite-url>\` to re-authenticate.
+  const serviceToken = process.env["CLEARGATE_SERVICE_TOKEN"] ?? "";
+  let fetcher;
+  let isServiceTokenMode;
+  if (serviceToken.length > 0) {
+    isServiceTokenMode = true;
+    fetcher = new ServiceTokenFetcher(serviceToken);
+    stderr("cleargate mcp serve: auth mode = service-token\n");
+  } else {
+    isServiceTokenMode = false;
+    const store = await (opts.createStore ?? createTokenStore)({
+      ...opts.keychainService !== void 0 ? { keychainService: opts.keychainService } : {},
+      ...opts.forceBackend !== void 0 ? { forceBackend: opts.forceBackend } : {}
+    });
+    const authFetcher = new AuthFetcher({
+      baseUrl,
+      loadRefresh: () => store.load(opts.profile),
+      saveRefresh: (t) => store.save(opts.profile, t),
+      ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
+      ...opts.now !== void 0 ? { now: opts.now } : {}
+    });
+    fetcher = authFetcher;
+    stderr("cleargate mcp serve: auth mode = keychain-refresh\n");
+    try {
+      await authFetcher.getAccessToken();
+    } catch (err) {
+      if (err instanceof RefreshError) {
+        stderr(
+          `cleargate mcp serve: refresh failed (${err.status} ${err.code}). Run \`cleargate join <invite-url>\` to re-authenticate.
 `
-      );
-    } else {
-      stderr(
-        `cleargate mcp serve: ${err instanceof Error ? err.message : String(err)}
+        );
+      } else {
+        stderr(
+          `cleargate mcp serve: ${err instanceof Error ? err.message : String(err)}
 `
-      );
+        );
+      }
+      return exit(1);
     }
-    return exit(1);
   }
   const inputStream = opts.stdin ?? process.stdin;
   const rl = readline5.createInterface({
@@ -12093,8 +12342,23 @@ async function mcpServeHandler(opts) {
   for await (const line of rl) {
     if (!line.trim()) continue;
     try {
-      await proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr);
+      await proxyOne(
+        line,
+        baseUrl,
+        fetcher,
+        isServiceTokenMode,
+        fetchFn,
+        stdout,
+        stderr
+      );
     } catch (err) {
+      if (err instanceof ServiceToken401Error) {
+        stderr(
+          `cleargate mcp serve: CLEARGATE_SERVICE_TOKEN rejected by /mcp (401). Issue a new token in the admin console: Tokens \u2192 Issue \u2192 copy snippet.
+`
+        );
+        return exit(1);
+      }
       const errMsg = err instanceof Error ? err.message : String(err);
       stderr(`cleargate mcp serve: proxy error: ${errMsg}
 `);
@@ -12111,7 +12375,7 @@ async function mcpServeHandler(opts) {
     }
   }
 }
-async function proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr) {
+async function proxyOne(line, baseUrl, fetcher, isServiceTokenMode, fetchFn, stdout, stderr) {
   let parsed;
   try {
     parsed = JSON.parse(line);
@@ -12124,6 +12388,9 @@ async function proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr) {
   let access = await fetcher.getAccessToken();
   let res = await postFrame(baseUrl, line, access, fetchFn);
   if (res.status === 401) {
+    if (isServiceTokenMode) {
+      throw new ServiceToken401Error();
+    }
     fetcher.invalidate();
     access = await fetcher.getAccessToken();
     res = await postFrame(baseUrl, line, access, fetchFn);