theforge-cli 0.1.0 → 0.2.0

package/dist/index.js

@@ -95,7 +95,7 @@ var require_windows = __commonJS({
     module.exports = isexe;
     isexe.sync = sync;
     var fs2 = __require("fs");
-    function checkPathExt(path45, options) {
+    function checkPathExt(path49, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -106,25 +106,25 @@ var require_windows = __commonJS({
       }
       for (var i3 = 0; i3 < pathext.length; i3++) {
         var p = pathext[i3].toLowerCase();
-        if (p && path45.substr(-p.length).toLowerCase() === p) {
+        if (p && path49.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path45, options) {
+    function checkStat(stat, path49, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path45, options);
+      return checkPathExt(path49, options);
     }
-    function isexe(path45, options, cb) {
-      fs2.stat(path45, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path45, options));
+    function isexe(path49, options, cb) {
+      fs2.stat(path49, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path49, options));
       });
     }
-    function sync(path45, options) {
-      return checkStat(fs2.statSync(path45), path45, options);
+    function sync(path49, options) {
+      return checkStat(fs2.statSync(path49), path49, options);
     }
   }
 });
@@ -136,13 +136,13 @@ var require_mode = __commonJS({
     module.exports = isexe;
     isexe.sync = sync;
     var fs2 = __require("fs");
-    function isexe(path45, options, cb) {
-      fs2.stat(path45, function(er, stat) {
+    function isexe(path49, options, cb) {
+      fs2.stat(path49, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path45, options) {
-      return checkStat(fs2.statSync(path45), options);
+    function sync(path49, options) {
+      return checkStat(fs2.statSync(path49), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -176,7 +176,7 @@ var require_isexe = __commonJS({
     }
     module.exports = isexe;
     isexe.sync = sync;
-    function isexe(path45, options, cb) {
+    function isexe(path49, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -186,7 +186,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve, reject) {
-          isexe(path45, options || {}, function(er, is) {
+          isexe(path49, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
@@ -195,7 +195,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path45, options || {}, function(er, is) {
+      core(path49, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -205,9 +205,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path45, options) {
+    function sync(path49, options) {
       try {
-        return core.sync(path45, options || {});
+        return core.sync(path49, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -224,7 +224,7 @@ var require_which = __commonJS({
   "node_modules/which/which.js"(exports, module) {
     "use strict";
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path45 = __require("path");
+    var path49 = __require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -262,7 +262,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i3];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path45.join(pathPart, cmd);
+        const pCmd = path49.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve(subStep(p, i3, 0));
       });
@@ -289,7 +289,7 @@ var require_which = __commonJS({
       for (let i3 = 0; i3 < pathEnv.length; i3++) {
         const ppRaw = pathEnv[i3];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path45.join(pathPart, cmd);
+        const pCmd = path49.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -337,7 +337,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
     "use strict";
-    var path45 = __require("path");
+    var path49 = __require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -348,14 +348,14 @@ var require_resolveCommand = __commonJS({
       if (shouldSwitchCwd) {
         try {
           process.chdir(parsed.options.cwd);
-        } catch (err) {
+        } catch (err2) {
         }
       }
       let resolved;
       try {
         resolved = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
-          pathExt: withoutPathExt ? path45.delimiter : void 0
+          pathExt: withoutPathExt ? path49.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -364,7 +364,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path45.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path49.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -418,8 +418,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path45, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path45.split("/").pop();
+      const [path49, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path49.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -454,7 +454,7 @@ var require_readShebang = __commonJS({
 var require_parse = __commonJS({
   "node_modules/cross-spawn/lib/parse.js"(exports, module) {
     "use strict";
-    var path45 = __require("path");
+    var path49 = __require("path");
     var resolveCommand2 = require_resolveCommand();
     var escape = require_escape();
     var readShebang = require_readShebang();
@@ -479,7 +479,7 @@ var require_parse = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path45.normalize(parsed.command);
+        parsed.command = path49.normalize(parsed.command);
         parsed.command = escape.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -533,9 +533,9 @@ var require_enoent = __commonJS({
       const originalEmit = cp.emit;
       cp.emit = function(name, arg1) {
         if (name === "exit") {
-          const err = verifyENOENT(arg1, parsed);
-          if (err) {
-            return originalEmit.call(cp, "error", err);
+          const err2 = verifyENOENT(arg1, parsed);
+          if (err2) {
+            return originalEmit.call(cp, "error", err2);
           }
         }
         return originalEmit.apply(cp, arguments);
@@ -569,7 +569,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse = require_parse();
     var enoent = require_enoent();
-    function spawn2(command, args, options) {
+    function spawn3(command, args, options) {
       const parsed = parse(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -581,8 +581,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn2;
-    module.exports.spawn = spawn2;
+    module.exports = spawn3;
+    module.exports.spawn = spawn3;
     module.exports.sync = spawnSync2;
     module.exports._parse = parse;
     module.exports._enoent = enoent;
@@ -7044,13 +7044,13 @@ var logOutputSync = ({ serializedResult, fdNumber, state, verboseInfo, encoding,
   }
 };
 var writeToFiles = (serializedResult, stdioItems, outputFiles) => {
-  for (const { path: path45, append } of stdioItems.filter(({ type }) => FILE_TYPES.has(type))) {
-    const pathString = typeof path45 === "string" ? path45 : path45.toString();
+  for (const { path: path49, append } of stdioItems.filter(({ type }) => FILE_TYPES.has(type))) {
+    const pathString = typeof path49 === "string" ? path49 : path49.toString();
     if (append || outputFiles.has(pathString)) {
-      appendFileSync2(path45, serializedResult);
+      appendFileSync2(path49, serializedResult);
     } else {
       outputFiles.add(pathString);
-      writeFileSync2(path45, serializedResult);
+      writeFileSync2(path49, serializedResult);
     }
   }
 };
@@ -9446,8 +9446,12 @@ var {
 // src/utils/system.ts
 import { existsSync as existsSync3 } from "fs";
 import { mkdir } from "fs/promises";
+import os from "os";
 import path8 from "path";
 var DEFAULT_WORKSPACE = "./forge-workspace";
+function cliHome() {
+  return process.env.FORGE_CLI_HOME || os.homedir();
+}
 var WIN_SETUP_CANDIDATES = ["setup.ps1", "install.ps1"];
 var POSIX_SETUP_CANDIDATES = ["setup.sh", "install.sh"];
 function resolveTargetDir(input, cwd = process.cwd()) {
@@ -9590,8 +9594,8 @@ async function runStreamed(argv, cwd, onLine, timeoutMs) {
 }
 function errorDetail(error) {
   if (error && typeof error === "object") {
-    const err = error;
-    return redactSecrets(err.stderr?.trim() || err.shortMessage || err.message || String(error));
+    const err2 = error;
+    return redactSecrets(err2.stderr?.trim() || err2.shortMessage || err2.message || String(error));
   }
   return redactSecrets(String(error));
 }
@@ -9606,16 +9610,16 @@ function compareVersions(a3, b) {
   return b.localeCompare(a3, void 0, { numeric: true });
 }
 async function updateCheck(repoDir) {
+  const up = await execa("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
+    cwd: repoDir,
+    reject: false
+  });
+  if (up.exitCode !== 0) return { behind: 0, ahead: 0, failure: "no-upstream" };
   try {
     await execa("git", ["fetch", "--quiet", "--tags"], { cwd: repoDir, env: NO_PROMPT });
   } catch (error) {
     return { behind: 0, ahead: 0, failure: classifyGitFailure(errorDetail(error)) };
   }
-  const up = await execa("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
-    cwd: repoDir,
-    reject: false
-  });
-  if (up.exitCode !== 0) return { behind: 0, ahead: 0, failure: "unknown" };
   const counts = await execa("git", ["rev-list", "--left-right", "--count", "HEAD...@{u}"], {
     cwd: repoDir,
     reject: false
@@ -9777,10 +9781,26 @@ var S = {
   errRefDirty: "Working tree com altera\xE7\xF5es locais \u2014 n\xE3o \xE9 seguro trocar de revis\xE3o",
   refCheckedOut: "Revis\xE3o",
   errRefNeedsOne: "--ref/--version exigem exatamente uma Forja",
+  errMethodUnsupported: "--method registry s\xF3 \xE9 suportado em install|uninstall|update|reinstall|rollback|pin|unpin",
+  errRegistryReinstallNeedsNames: "reinstall --method registry exige nomes, --only ou --all (Forjas instaladas via registry)",
+  errRegistryRollbackNeedsNames: "rollback --method registry exige nomes, --only ou --all (Forjas instaladas via registry)",
+  errRegistryPinNeedsNames: "pin --method registry exige nomes, --only ou --all (Forjas instaladas via registry)",
+  errRegistryUnpinNeedsNames: "unpin --method registry exige nomes, --only ou --all (Forjas instaladas via registry)",
+  registryPinnedAt: "fixada em",
+  errRegistryNeedsNames: "informe as Forjas (ex.: forge-cli install api-forge --method registry) ou --all",
+  errRegistryUninstallNeedsNames: "uninstall --method registry exige nomes, --only ou --all (Forjas instaladas via registry)",
+  registryUninstallConfirm: "remover venvs e receipts das Forjas instaladas via PyPI",
+  registryUninstallNeedsYes: "Nada foi removido. Reexecute com --yes para confirmar.",
+  registryIgnoredFlags: "flags ignoradas no m\xE9todo registry",
+  registryStaleCache: "cache do PyPI expirado \u2014 metadados podem estar desatualizados",
+  registryOfflineMissing: "artefato ausente no cache local \u2014 instala\xE7\xE3o offline imposs\xEDvel",
+  registryHashMismatch: "digest sha256 diverge do publicado no PyPI \u2014 instala\xE7\xE3o abortada",
+  registryVerifyFailed: "(verify falhou)",
   errRefExclusive: "Use apenas um entre --ref e --version",
   errRefInvalid: "Revis\xE3o/vers\xE3o inv\xE1lida",
   updateCheckTitle: "Verifica\xE7\xE3o de atualiza\xE7\xF5es",
   updateCheckFailed: "n\xE3o foi poss\xEDvel verificar",
+  updateNoUpstream: "sem upstream configurado",
   updateCommitsBehind: "commit(s) dispon\xEDveis",
   updateUpToDate: "atualizado",
   updateNothing: "Nenhuma Forja clonada neste diret\xF3rio \u2014 nada para atualizar",
@@ -10013,13 +10033,17 @@ Uso:
   forge-cli doctor [--fix]      Diagnostica; --fix repara os que falharem
   forge-cli list                Lista o cat\xE1logo e o \xFAltimo estado conhecido
   forge-cli install [forjas]    Instala uma ou mais Forjas (sem nomes: interativo)
+                                --method registry instala do PyPI em venv isolada
   forge-cli clone <forjas>      S\xF3 clona/sincroniza; n\xE3o executa scripts
   forge-cli update [forjas]     Atualiza (pull + setup); --check s\xF3 verifica
+                                --method registry: mais nova no PyPI; respeita pin; --check plano
   forge-cli versions [forjas]   Lista tags/vers\xF5es e revis\xE3o atual
   forge-cli reinstall <forjas>  Reexecuta o setup mantendo a revis\xE3o atual; --clean recria o clone
+                                --method registry: reinstala a mesma vers\xE3o do receipt (drift)
   forge-cli pin <forja> --version <tag>   Fixa a vers\xE3o (update/install respeitam)
   forge-cli unpin <forja>       Remove a fixa\xE7\xE3o
   forge-cli rollback <forja>    Volta o checkout ao HEAD anterior registrado
+                                --method registry: desempilha a vers\xE3o anterior do receipt
   forge-cli uninstall <forjas>  Remove clones limpos (backup de .env/configs; exige --yes)
   forge-cli components [forjas] Mostra o instalador nativo e as flags suportadas por Forja
   forge-cli help                Mostra esta ajuda
@@ -10028,6 +10052,7 @@ Uso:
   forge-cli recommend           Recomenda\xE7\xF5es explic\xE1veis a partir dos sinais
   forge-cli env <verbo> [forja] Intelig\xEAncia de .env: inspect|plan|init|validate|migrate|doctor
   forge-cli hosts [verbo]       Hosts de IA: list|plan|register|validate|rollback
+  forge-cli mcp [forja\u2026]        Comando MCP por Forja (clone ou venv registry); --verify testa --version
   forge-cli self install        Registra forge-cli no PATH do usu\xE1rio
   forge-cli self uninstall      Remove o registro do PATH
   forge-cli self update         Atualiza o pr\xF3prio CLI conforme o m\xE9todo de instala\xE7\xE3o
@@ -10038,6 +10063,7 @@ Uso:
   forge-cli bundle <verbo>      Portabilidade: export [chaves-n\xE3o-secretas...]|import|verify
   forge-cli learning <verbo>    Observa\xE7\xF5es locais opt-in: status|enable|disable|report
   forge-cli uninstall           Sem nomes: remove o registro do PATH (legado)
+  forge-cli registry            Lista o cat\xE1logo PyPI e o que est\xE1 instalado via registry
 
 Op\xE7\xF5es:
   --dir <caminho>    Diret\xF3rio de instala\xE7\xE3o (padr\xE3o: ./forge-workspace)
@@ -10056,6 +10082,8 @@ Op\xE7\xF5es:
   --shallow          Clona com git clone --depth 1 (s\xF3 clones novos)
   --ref <rev>        Fixa a Forja (uma s\xF3) em commit/tag (checkout destacado)
   --version <tag>    Fixa a Forja (uma s\xF3) em uma vers\xE3o (tag, com ou sem 'v')
+  --method <m>       M\xE9todo de instala\xE7\xE3o: git (clone+setup) ou registry (PyPI+venv)
+  --offline          No m\xE9todo registry: resolve s\xF3 pelo cache local do PyPI
   --clean            Com 'reinstall': remove e reclona na mesma revis\xE3o (com backup)
   --profile <p>      Instalador nativo da Forja: minimal|recommended|full
   --scope <s>        Instalador nativo da Forja: project|workspace|user
@@ -10145,9 +10173,11 @@ function parseCliArgs(argv) {
         clean: { type: "boolean" },
         ref: { type: "string" },
         version: { type: "string" },
+        method: { type: "string" },
         "trust-custom": { type: "boolean" },
         "run-after-sync-failure": { type: "boolean" },
         rollback: { type: "boolean" },
+        verify: { type: "boolean" },
         help: { type: "boolean", short: "h" }
       },
       strict: true,
@@ -10179,6 +10209,9 @@ function parseCliArgs(argv) {
   if (ref !== void 0 && !isValidRef(ref)) {
     throw new CliError(`${S.errRefInvalid}: ${ref}`);
   }
+  if (values.method !== void 0 && !["git", "registry"].includes(values.method)) {
+    throw new CliError(`--method inv\xE1lido: ${values.method} (use git|registry)`);
+  }
   return {
     dir: values.dir,
     all: values.all ?? false,
@@ -10202,6 +10235,7 @@ function parseCliArgs(argv) {
     check: values.check ?? false,
     native: values.native ?? false,
     rollback: values.rollback ?? false,
+    verify: values.verify ?? false,
     host: values.host,
     gatewayProfile: values["gateway-profile"],
     verbose: values.verbose ?? false,
@@ -10211,6 +10245,7 @@ function parseCliArgs(argv) {
     components: values.components,
     clean: values.clean ?? false,
     ref,
+    method: values.method,
     trustCustom: values["trust-custom"] ?? false,
     runAfterSyncFailure: values["run-after-sync-failure"] ?? false,
     positionals
@@ -10265,6 +10300,7 @@ function resolveCommand(cli) {
   if (head === "recommend") return { command: "recommend", names: rest };
   if (head === "env") return { command: "env", names: rest };
   if (head === "hosts") return { command: "hosts", names: rest };
+  if (head === "mcp") return { command: "mcp", names: rest };
   if (head === "wizard") return { command: "wizard", names: rest };
   if (head === "lock") return { command: "lock", names: rest };
   if (head === "profile") return { command: "profile", names: rest };
@@ -10275,6 +10311,7 @@ function resolveCommand(cli) {
   if (head === "ai") return { command: "ai", names: rest };
   if (head === "bundle") return { command: "bundle", names: rest };
   if (head === "learning") return { command: "learning", names: rest };
+  if (head === "registry") return { command: "registry", names: rest };
   if (head === "uninstall") return { command: "uninstall", names: rest };
   if (REPO_COMMANDS.has(head)) return { command: head, names: rest };
   return { command: "unknown", names: [], unknown: head };
@@ -10420,6 +10457,18 @@ var MENU_ITEMS = [
   { value: "doctor", label: S.menuDoctor },
   { value: "exit", label: S.menuExit }
 ];
+var REGISTRY_MENU_ACTIONS = [
+  "install",
+  "update",
+  "reinstall",
+  "uninstall",
+  "status",
+  "exit"
+];
+function menuItemsFor(cli) {
+  if (cli.method !== "registry") return MENU_ITEMS;
+  return MENU_ITEMS.filter((i3) => REGISTRY_MENU_ACTIONS.includes(i3.value));
+}
 function shouldShowMenu(cli, tty3) {
   return tty3 && cli.positionals.length === 0 && !cli.help && !cli.plan && !isNonInteractive(cli);
 }
@@ -10440,12 +10489,12 @@ function actionToPositionals(action, names) {
       return [action, ...names];
   }
 }
-async function askMenu(io = {}) {
+async function askMenu(io = {}, items = MENU_ITEMS) {
   const choice = await select({
     ...io.input ? { input: io.input } : {},
     ...io.output ? { output: io.output } : {},
     message: S.menuTitle,
-    options: MENU_ITEMS.map((item) => ({
+    options: items.map((item) => ({
       value: item.value,
       label: item.label,
       hint: item.hint
@@ -10458,6 +10507,15 @@ async function askMenu(io = {}) {
 async function applyMenu(cli, deps) {
   const action = await deps.ask();
   if (action === "exit") return null;
+  if (cli.method === "registry") {
+    if (action === "status") return { ...cli, positionals: ["registry"] };
+    if (action === "install") {
+      const names3 = deps.pickRegistryCatalog ? await deps.pickRegistryCatalog() : [];
+      return { ...cli, positionals: ["install", ...names3] };
+    }
+    const names2 = deps.pickRegistryInstalled ? await deps.pickRegistryInstalled() : [];
+    return { ...cli, positionals: [action, ...names2] };
+  }
   if (action === "install") return cli;
   const dir = cli.dir ? deps.resolveDir(cli.dir) : await deps.workspace();
   const names = actionNeedsRepos(action) ? await deps.pickRepos(dir) : [];
@@ -11460,8 +11518,8 @@ var figlet = (() => {
       const generatedTxt = fontOpts ? generateText(fontName, _reworkFontOpts(fontOpts, options), txt) : "";
       if (next) next(null, generatedTxt);
       return generatedTxt;
-    } catch (err) {
-      const error = err instanceof Error ? err : new Error(String(err));
+    } catch (err2) {
+      const error = err2 instanceof Error ? err2 : new Error(String(err2));
       if (next) {
         next(error);
         return "";
@@ -11487,8 +11545,8 @@ var figlet = (() => {
       const result = [fontOpts, font.comment || ""];
       if (callback) callback(null, fontOpts, font.comment);
       return result;
-    } catch (err) {
-      const error = err instanceof Error ? err : new Error(String(err));
+    } catch (err2) {
+      const error = err2 instanceof Error ? err2 : new Error(String(err2));
       if (callback) {
         callback(error);
         return null;
@@ -11586,12 +11644,12 @@ var figlet = (() => {
       if (callback) callback(null, result);
       return result;
     } catch (error) {
-      const err = error instanceof Error ? error : new Error(String(error));
+      const err2 = error instanceof Error ? error : new Error(String(error));
       if (callback) {
-        callback(err);
+        callback(err2);
         return null;
       }
-      throw err;
+      throw err2;
     }
   };
   me.loadFontSync = function(name) {
@@ -11610,9 +11668,9 @@ var figlet = (() => {
       }
       if (callback) callback();
     } catch (error) {
-      const err = error instanceof Error ? error : new Error(String(error));
+      const err2 = error instanceof Error ? error : new Error(String(error));
       if (callback) {
-        callback(err);
+        callback(err2);
         return;
       }
       throw error;
@@ -11647,10 +11705,10 @@ nodeFiglet.loadFont = function(name, callback) {
       resolve(nodeFiglet.figFonts[actualFontName].options);
       return;
     }
-    fs.readFile(path9.join(nodeFiglet.defaults().fontPath, actualFontName + ".flf"), { encoding: "utf-8" }, (err, fontData) => {
-      if (err) {
-        if (callback) callback(err);
-        reject(err);
+    fs.readFile(path9.join(nodeFiglet.defaults().fontPath, actualFontName + ".flf"), { encoding: "utf-8" }, (err2, fontData) => {
+      if (err2) {
+        if (callback) callback(err2);
+        reject(err2);
         return;
       }
       fontData = fontData + "";
@@ -11675,10 +11733,10 @@ nodeFiglet.loadFontSync = function(font) {
 nodeFiglet.fonts = function(next) {
   return new Promise((resolve, reject) => {
     const fontList2 = [];
-    fs.readdir(nodeFiglet.defaults().fontPath, (err, files) => {
-      if (err) {
-        next && next(err);
-        reject(err);
+    fs.readdir(nodeFiglet.defaults().fontPath, (err2, files) => {
+      if (err2) {
+        next && next(err2);
+        reject(err2);
         return;
       }
       files.forEach((file) => {
@@ -14210,26 +14268,26 @@ var ContractValidator = class {
     }
     return this.validate(declared, document);
   }
-  check(value, schema, path45, errs) {
+  check(value, schema, path49, errs) {
     if (typeof schema.$ref === "string") {
       const target = schema.$ref;
       if (!target.startsWith("forge/")) {
-        errs.push({ code: "CONTRACT-REF", message: `external ref refused: ${target}`, path: path45 });
+        errs.push({ code: "CONTRACT-REF", message: `external ref refused: ${target}`, path: path49 });
         return;
       }
       const resolved = this.schemas[target];
       if (!resolved) {
-        errs.push({ code: "CONTRACT-UNKNOWN", message: `unknown contract: ${target}`, path: path45 });
+        errs.push({ code: "CONTRACT-UNKNOWN", message: `unknown contract: ${target}`, path: path49 });
         return;
       }
-      this.check(value, resolved, path45, errs);
+      this.check(value, resolved, path49, errs);
       return;
     }
     if ("const" in schema && value !== schema.const) {
       errs.push({
         code: "CONTRACT-CONST",
         message: `expected ${JSON.stringify(schema.const)}`,
-        path: path45
+        path: path49
       });
       return;
     }
@@ -14237,7 +14295,7 @@ var ContractValidator = class {
       errs.push({
         code: "CONTRACT-TYPE",
         message: `expected type ${JSON.stringify(schema.type)}`,
-        path: path45
+        path: path49
       });
       return;
     }
@@ -14245,27 +14303,27 @@ var ContractValidator = class {
       errs.push({
         code: "CONTRACT-ENUM",
         message: `value not in ${JSON.stringify(schema.enum)}`,
-        path: path45
+        path: path49
       });
       return;
     }
     if (typeof value === "string") {
       if (typeof schema.pattern === "string" && !new RegExp(schema.pattern).test(value)) {
-        errs.push({ code: "CONTRACT-PATTERN", message: `does not match ${schema.pattern}`, path: path45 });
+        errs.push({ code: "CONTRACT-PATTERN", message: `does not match ${schema.pattern}`, path: path49 });
       }
       if (typeof schema.minLength === "number" && value.length < schema.minLength) {
-        errs.push({ code: "CONTRACT-LENGTH", message: "string too short", path: path45 });
+        errs.push({ code: "CONTRACT-LENGTH", message: "string too short", path: path49 });
       }
       if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
-        errs.push({ code: "CONTRACT-LENGTH", message: "string too long", path: path45 });
+        errs.push({ code: "CONTRACT-LENGTH", message: "string too long", path: path49 });
       }
     }
     if (typeof value === "number") {
       if (typeof schema.min === "number" && value < schema.min) {
-        errs.push({ code: "CONTRACT-RANGE", message: `< ${schema.min}`, path: path45 });
+        errs.push({ code: "CONTRACT-RANGE", message: `< ${schema.min}`, path: path49 });
       }
       if (typeof schema.max === "number" && value > schema.max) {
-        errs.push({ code: "CONTRACT-RANGE", message: `> ${schema.max}`, path: path45 });
+        errs.push({ code: "CONTRACT-RANGE", message: `> ${schema.max}`, path: path49 });
       }
     }
     if (typeof value === "object" && value !== null && !Array.isArray(value)) {
@@ -14275,7 +14333,7 @@ var ContractValidator = class {
           errs.push({
             code: "CONTRACT-REQUIRED",
             message: `missing '${req}'`,
-            path: `${path45}/${req}`
+            path: `${path49}/${req}`
           });
         }
       }
@@ -14283,25 +14341,25 @@ var ContractValidator = class {
       const additional = schema.additionalProperties;
       for (const [key, val] of Object.entries(obj)) {
         if (key in props) {
-          this.check(val, props[key], `${path45}/${key}`, errs);
+          this.check(val, props[key], `${path49}/${key}`, errs);
         } else if (additional === false) {
           errs.push({
             code: "CONTRACT-UNKNOWN-FIELD",
             message: `unexpected '${key}'`,
-            path: `${path45}/${key}`
+            path: `${path49}/${key}`
           });
         } else if (typeof additional === "object" && additional !== null) {
-          this.check(val, additional, `${path45}/${key}`, errs);
+          this.check(val, additional, `${path49}/${key}`, errs);
         }
       }
     }
     if (Array.isArray(value)) {
       if (typeof schema.minItems === "number" && value.length < schema.minItems) {
-        errs.push({ code: "CONTRACT-SIZE", message: "too few items", path: path45 });
+        errs.push({ code: "CONTRACT-SIZE", message: "too few items", path: path49 });
       }
       const itemSchema = schema.items;
       if (typeof itemSchema === "object" && itemSchema !== null) {
-        value.forEach((item, i3) => this.check(item, itemSchema, `${path45}/${i3}`, errs));
+        value.forEach((item, i3) => this.check(item, itemSchema, `${path49}/${i3}`, errs));
       }
     }
   }
@@ -15259,10 +15317,681 @@ async function uninstall(opts = {}) {
   return { dirRemoved, shimsRemoved: dirRemoved, profilesTouched, pathRemoved };
 }
 
-// src/compat.ts
+// src/cmd/query.ts
+import os2 from "os";
+import { existsSync as existsSync12 } from "fs";
+
+// src/registry/install.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync9,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync4
+} from "fs";
+import path18 from "path";
+
+// src/registry/pypi.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync8 } from "fs";
 import path17 from "path";
+
+// src/registry/versions.ts
+var VERSION_RE = /^(\d+(?:\.\d+)*)(?:(a|b|rc)(\d+))?(?:\.post(\d+))?(?:\.dev(\d+))?$/i;
+function parseVersion2(input) {
+  const m3 = VERSION_RE.exec(input.trim());
+  if (!m3) return null;
+  const release = m3[1].split(".").map((x) => Number.parseInt(x, 10));
+  if (release.some((n4) => !Number.isFinite(n4))) return null;
+  const out = { release };
+  if (m3[2]) out.pre = { tag: m3[2].toLowerCase(), n: Number.parseInt(m3[3], 10) };
+  if (m3[4]) out.post = Number.parseInt(m3[4], 10);
+  if (m3[5]) out.dev = Number.parseInt(m3[5], 10);
+  return out;
+}
+var PRE_ORDER = { a: 0, b: 1, rc: 2 };
+function cmpRelease(a3, b) {
+  const len = Math.max(a3.length, b.length);
+  for (let i3 = 0; i3 < len; i3++) {
+    const d = (a3[i3] ?? 0) - (b[i3] ?? 0);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function phaseRank(v) {
+  if (v.dev !== void 0 && !v.pre && v.post === void 0) return 0;
+  if (v.pre) return 1;
+  if (v.post !== void 0) return 3;
+  return 2;
+}
+function compareVersions3(a3, b) {
+  const rel2 = cmpRelease(a3.release, b.release);
+  if (rel2 !== 0) return rel2;
+  const aPhase = phaseRank(a3);
+  const bPhase = phaseRank(b);
+  if (aPhase !== bPhase) return aPhase < bPhase ? -1 : 1;
+  if (aPhase === 0) return (a3.dev ?? 0) - (b.dev ?? 0);
+  if (aPhase === 1) {
+    const tag2 = PRE_ORDER[a3.pre.tag] - PRE_ORDER[b.pre.tag];
+    if (tag2 !== 0) return tag2;
+    const pre = a3.pre.n - b.pre.n;
+    if (pre !== 0) return pre;
+  }
+  if (aPhase === 1 || aPhase === 3) {
+    const post = (a3.post ?? 0) - (b.post ?? 0);
+    if (post !== 0) return post;
+  }
+  if (a3.dev === void 0 && b.dev === void 0) return 0;
+  if (a3.dev === void 0) return 1;
+  if (b.dev === void 0) return -1;
+  return a3.dev - b.dev;
+}
+function isPrerelease(v) {
+  return v.pre !== void 0 || v.dev !== void 0;
+}
+var SPEC_RE = /^(~=|==|!=|>=|<=|>|<)\s*([0-9][0-9a-zA-Z.]*?)(\.\*)?$/;
+function parseSpecifier(input) {
+  const m3 = SPEC_RE.exec(input.trim());
+  if (!m3) return null;
+  const version = parseVersion2(m3[2]);
+  if (!version) return null;
+  const wildcard = Boolean(m3[3]);
+  if (wildcard && m3[1] !== "==" && m3[1] !== "!=") return null;
+  if (m3[1] === "~=" && version.release.length < 2) return null;
+  return { op: m3[1], version, wildcard };
+}
+function matchWildcard(candidate, spec) {
+  if (candidate.length < spec.length) return false;
+  return spec.every((n4, i3) => candidate[i3] === n4);
+}
+function evalSpecifier(candidate, spec) {
+  if (spec.wildcard) {
+    const hit = matchWildcard(candidate.release, spec.version.release);
+    return spec.op === "==" ? hit : !hit;
+  }
+  const cmp4 = compareVersions3(candidate, spec.version);
+  switch (spec.op) {
+    case "==":
+      return cmp4 === 0;
+    case "!=":
+      return cmp4 !== 0;
+    case ">=":
+      return cmp4 >= 0;
+    case ">":
+      return cmp4 > 0;
+    case "<=":
+      return cmp4 <= 0;
+    case "<":
+      return cmp4 < 0;
+    case "~=": {
+      if (cmp4 < 0) return false;
+      const bound = [...spec.version.release];
+      bound.pop();
+      bound[bound.length - 1] += 1;
+      return cmpRelease(candidate.release, bound) < 0;
+    }
+  }
+}
+function satisfiesRequiresPython(requiresPython, candidate) {
+  const parts = requiresPython.split(",").map((s) => s.trim()).filter(Boolean);
+  if (!parts.length) return true;
+  let anyUnknown = false;
+  for (const part of parts) {
+    const spec = parseSpecifier(part);
+    if (!spec) {
+      anyUnknown = true;
+      continue;
+    }
+    if (!evalSpecifier(candidate, spec)) return false;
+  }
+  return anyUnknown ? null : true;
+}
+function latestStable(versions) {
+  let best = null;
+  let bestParsed = null;
+  for (const raw of versions) {
+    const parsed = parseVersion2(raw);
+    if (!parsed || isPrerelease(parsed)) continue;
+    if (!bestParsed || compareVersions3(parsed, bestParsed) > 0) {
+      best = raw;
+      bestParsed = parsed;
+    }
+  }
+  return best;
+}
+
+// src/registry/pypi.ts
+var PYPI_JSON = "https://pypi.org/pypi";
+var CACHE_TTL_MS = 60 * 60 * 1e3;
+function pypiCacheFile(cacheDir, dist) {
+  return path17.join(cacheDir, `${dist}.json`);
+}
+function asString(v) {
+  return typeof v === "string" && v.length ? v : void 0;
+}
+function parseFiles(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const rec = item;
+    const filename = asString(rec.filename);
+    const url = asString(rec.url);
+    if (!filename || !url) continue;
+    const digests = rec.digests;
+    out.push({
+      filename,
+      url,
+      sha256: digests ? asString(digests.sha256) : void 0,
+      packagetype: asString(rec.packagetype),
+      requiresPython: asString(rec.requires_python) ?? void 0,
+      yanked: rec.yanked === true || typeof rec.yanked === "string" ? true : void 0
+    });
+  }
+  return out;
+}
+function readCache(cacheDir, dist) {
+  try {
+    const raw = readFileSync8(pypiCacheFile(cacheDir, dist), "utf8");
+    const wrap = JSON.parse(raw);
+    if (typeof wrap.fetchedAt !== "number" || !wrap.payload) return null;
+    const age = Date.now() - wrap.fetchedAt;
+    return { payload: wrap.payload, fresh: age >= 0 && age < CACHE_TTL_MS };
+  } catch {
+    return null;
+  }
+}
+function writeCache(cacheDir, dist, payload) {
+  try {
+    mkdirSync3(cacheDir, { recursive: true });
+    writeFileAtomic(
+      pypiCacheFile(cacheDir, dist),
+      JSON.stringify({ fetchedAt: Date.now(), payload })
+    );
+  } catch {
+  }
+}
+var MAX_PAYLOAD_BYTES = 16 * 1024 * 1024;
+async function defaultFetch(url) {
+  const res = await fetch(url, {
+    headers: { accept: "application/json" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > MAX_PAYLOAD_BYTES) {
+    void res.body?.cancel();
+    throw new Error(`payload excede ${MAX_PAYLOAD_BYTES} bytes`);
+  }
+  const reader = res.body?.getReader();
+  if (!reader) {
+    const body = await res.text();
+    if (body.length > MAX_PAYLOAD_BYTES) {
+      throw new Error(`payload excede ${MAX_PAYLOAD_BYTES} bytes`);
+    }
+    return { status: res.status, body };
+  }
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > MAX_PAYLOAD_BYTES) {
+      await reader.cancel();
+      throw new Error(`payload excede ${MAX_PAYLOAD_BYTES} bytes`);
+    }
+    chunks.push(value);
+  }
+  return { status: res.status, body: new TextDecoder().decode(Buffer.concat(chunks)) };
+}
+var RETRYABLE = (status) => status === 429 || status >= 500;
+async function fetchWithRetry(fetchImpl, url) {
+  let lastError;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      const res = await fetchImpl(url);
+      if (!RETRYABLE(res.status) || attempt === 2) return res;
+    } catch (error) {
+      lastError = error;
+      if (attempt === 2) throw error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250 * 2 ** attempt));
+  }
+  throw lastError;
+}
+async function resolveRelease(dist, opts) {
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  let payload;
+  let fromCache = false;
+  let staleCache = false;
+  if (!opts.offline) {
+    try {
+      const res = await fetchWithRetry(fetchImpl, `${PYPI_JSON}/${encodeURIComponent(dist)}/json`);
+      if (res.status === 404) return { kind: "not-found", dist };
+      if (res.status !== 200) {
+        const cached = readCache(opts.cacheDir, dist);
+        if (cached) {
+          payload = cached.payload;
+          fromCache = true;
+          staleCache = !cached.fresh;
+        } else {
+          return { kind: "network", detail: `PyPI respondeu HTTP ${res.status}` };
+        }
+      } else {
+        const parsed = JSON.parse(res.body);
+        if (typeof parsed?.releases !== "object" || !parsed.releases) {
+          const cached = readCache(opts.cacheDir, dist);
+          if (cached) {
+            payload = cached.payload;
+            fromCache = true;
+            staleCache = !cached.fresh;
+          } else {
+            return { kind: "malformed", dist, detail: "resposta sem campo releases" };
+          }
+        } else {
+          if (!opts.ephemeral) writeCache(opts.cacheDir, dist, parsed);
+          payload = parsed;
+        }
+      }
+    } catch (error) {
+      const cached = readCache(opts.cacheDir, dist);
+      if (cached) {
+        payload = cached.payload;
+        fromCache = true;
+        staleCache = !cached.fresh;
+      } else {
+        return {
+          kind: "network",
+          detail: error instanceof Error ? error.message : String(error)
+        };
+      }
+    }
+  } else {
+    const cached = readCache(opts.cacheDir, dist);
+    if (!cached) return { kind: "offline-miss", dist };
+    payload = cached.payload;
+    fromCache = true;
+    staleCache = !cached.fresh;
+  }
+  const releases = payload?.releases;
+  if (!payload || typeof releases !== "object" || !releases) {
+    return { kind: "malformed", dist, detail: "resposta sem campo releases" };
+  }
+  const installable = Object.keys(releases).filter((v) => {
+    const files2 = parseFiles(releases[v]);
+    if (!files2.length) return false;
+    return files2.some((f) => !f.yanked);
+  });
+  const latest = latestStable(installable);
+  let version = opts.pin ?? latest;
+  if (!version) {
+    return { kind: "malformed", dist, detail: "nenhuma vers\xE3o est\xE1vel instal\xE1vel" };
+  }
+  if (!Object.hasOwn(releases, version) && opts.pin) {
+    const pinned = parseVersion2(version);
+    if (pinned) {
+      const canonical2 = Object.keys(releases).filter((k) => {
+        const parsed = parseVersion2(k);
+        return parsed !== null && compareVersions3(parsed, pinned) === 0;
+      }).sort().at(0);
+      if (canonical2) version = canonical2;
+    }
+  }
+  if (!Object.hasOwn(releases, version)) {
+    return {
+      kind: "version-not-found",
+      dist,
+      requested: opts.pin ?? version,
+      available: Object.keys(releases).filter((v) => parseVersion2(v)).sort((a3, b) => compareVersions3(parseVersion2(a3), parseVersion2(b)))
+    };
+  }
+  const files = parseFiles(releases[version]);
+  const requiresPython = files.find((f) => f.packagetype === "bdist_wheel" && f.requiresPython)?.requiresPython ?? files.find((f) => f.requiresPython)?.requiresPython ?? (version === latest ? asString(payload.info?.requires_python) : void 0);
+  return {
+    dist,
+    version,
+    requiresPython,
+    files,
+    source: opts.pin ? "pinned" : fromCache ? "cache" : "latest-stable",
+    staleCache: staleCache || void 0,
+    yanked: files.length && files.every((f) => f.yanked) ? true : void 0
+  };
+}
+
+// src/registry/install.ts
+function forgesRoot(home) {
+  return path18.join(home, ".forge-cli", "forges");
+}
+function forgeStatePath(home) {
+  return path18.join(forgesRoot(home), "state.json");
+}
+function forgeVenv(home, name) {
+  return path18.join(forgesRoot(home), name, "venv");
+}
+function receiptPath(home, name) {
+  return path18.join(forgesRoot(home), name, "install.json");
+}
+function loadForgeState(home) {
+  const file = forgeStatePath(home);
+  if (!existsSync10(file)) return { forges: {} };
+  try {
+    const raw = JSON.parse(readFileSync9(file, "utf8"));
+    if (typeof raw.forges !== "object" || !raw.forges || Array.isArray(raw.forges)) {
+      return { forges: {} };
+    }
+    const forges = {};
+    for (const [k, v] of Object.entries(raw.forges)) {
+      if (v && typeof v === "object" && !Array.isArray(v)) forges[k] = v;
+    }
+    return { ...raw, forges };
+  } catch {
+    try {
+      writeFileSync4(`${file}.corrupt`, readFileSync9(file), { flag: "wx" });
+    } catch {
+    }
+    return { forges: {} };
+  }
+}
+function ghostEntry(name, receipt) {
+  return {
+    name,
+    dist: receipt.dist,
+    bin: path18.basename(receipt.bin).replace(/\.exe$/i, ""),
+    minPython: receipt.python.split(".").slice(0, 2).join("."),
+    origin: "official"
+  };
+}
+function saveForgeState(home, state) {
+  mkdirSync4(forgesRoot(home), { recursive: true });
+  if (process.platform !== "win32") {
+    try {
+      chmodSync2(forgesRoot(home), 448);
+      chmodSync2(path18.dirname(forgesRoot(home)), 448);
+    } catch {
+    }
+  }
+  writeFileAtomic(forgeStatePath(home), `${JSON.stringify(state, null, 2)}
+`);
+}
+function wheelCacheDir(cacheDir, dist) {
+  return path18.join(path18.dirname(cacheDir), "wheels", dist);
+}
+function venvBin(venvDir, platform2 = process.platform) {
+  return platform2 === "win32" ? path18.join(venvDir, "Scripts") : path18.join(venvDir, "bin");
+}
+function venvPython(venvDir, platform2 = process.platform) {
+  return path18.join(venvBin(venvDir, platform2), platform2 === "win32" ? "python.exe" : "python");
+}
+async function execaRun(cmd, args, opts = {}) {
+  const res = await execa(cmd, args, {
+    reject: false,
+    timeout: opts.timeoutMs ?? 3e5
+  });
+  return {
+    exitCode: res.exitCode ?? 1,
+    stdout: res.stdout,
+    // Timeout preserva o stderr real quando o processo já escreveu algo.
+    stderr: res.timedOut ? `timeout ap\xF3s ${opts.timeoutMs ?? 3e5}ms${res.stderr ? `: ${res.stderr}` : ""}` : res.stderr
+  };
+}
+function selectInterpreter(entry2, resolved, pythons) {
+  const floor = parseVersion2(entry2.minPython);
+  let sawUnknownSpec = false;
+  const usable = pythons.filter((p) => {
+    if (floor && compareVersions3(p.parsed, floor) < 0) return false;
+    if (!resolved.requiresPython) return true;
+    const sat = satisfiesRequiresPython(resolved.requiresPython, p.parsed);
+    if (sat === null) {
+      sawUnknownSpec = true;
+      return false;
+    }
+    return sat;
+  });
+  usable.sort((a3, b) => compareVersions3(b.parsed, a3.parsed));
+  const stable = usable.filter((p) => !isPrerelease(p.parsed));
+  const candidates = stable.length ? stable : usable;
+  if (!candidates.length) {
+    return {
+      error: sawUnknownSpec ? {
+        kind: "specifier-unknown",
+        dist: entry2.dist,
+        version: resolved.version,
+        requires: resolved.requiresPython
+      } : {
+        kind: "python-incompatible",
+        dist: entry2.dist,
+        version: resolved.version,
+        requires: [resolved.requiresPython, `>=${entry2.minPython} (piso forge-cli)`].filter(Boolean).join(" e "),
+        have: pythons.map((p) => p.version).join(", ")
+      }
+    };
+  }
+  return { python: candidates[0] };
+}
+function checkDistHashes(distFiles, wheels) {
+  const have = existsSync10(wheels) ? readdirSync3(wheels) : [];
+  let verifiedHash;
+  let verifiedFile;
+  for (const f of distFiles) {
+    if (!have.includes(f.filename) || !f.sha256) continue;
+    const digest = createHash("sha256").update(readFileSync9(path18.join(wheels, f.filename))).digest("hex");
+    if (digest !== f.sha256) {
+      const culprit = path18.join(wheels, f.filename);
+      try {
+        rmSync2(`${culprit}.rejected`, { force: true });
+        renameSync2(culprit, `${culprit}.rejected`);
+      } catch {
+      }
+      return {
+        detail: `${f.filename}: sha256 ${digest.slice(0, 12)}\u2026 != PyPI ${f.sha256.slice(0, 12)}\u2026 \u2014 artefato movido para ${f.filename}.rejected`
+      };
+    }
+    if (f.packagetype === "bdist_wheel" || verifiedFile === void 0) {
+      verifiedFile = f.filename;
+      verifiedHash = digest;
+    }
+  }
+  return { verifiedHash, verifiedFile };
+}
+function distArtifactFiles(files, dist) {
+  const norm2 = dist.toLowerCase();
+  const prefixes = [`${norm2.replace(/[-_.]/g, "_")}-`, `${norm2.replace(/[-_.]/g, "-")}-`];
+  return files.filter((f) => prefixes.some((p) => f.filename.toLowerCase().startsWith(p)));
+}
+async function registryInstall(entry2, pin, deps) {
+  const run = deps.run ?? execaRun;
+  const platform2 = deps.platform ?? process.platform;
+  if (!deps.pythons.length) {
+    return { stage: "no-python", detail: "nenhum interpretador Python detectado" };
+  }
+  const venvDir = forgeVenv(deps.home, entry2.name);
+  if (!deps.clean && existsSync10(venvDir)) {
+    return {
+      stage: "already-installed",
+      detail: `${entry2.name}: j\xE1 instalado em ${venvDir} \u2014 reinstale com --clean`
+    };
+  }
+  const resolved = await resolveRelease(entry2.dist, {
+    pin,
+    offline: deps.offline,
+    cacheDir: deps.cacheDir,
+    fetchImpl: deps.fetchImpl
+  });
+  if ("kind" in resolved) return { stage: "resolve", error: resolved };
+  const picked = selectInterpreter(entry2, resolved, deps.pythons);
+  if ("error" in picked) return { stage: "resolve", error: picked.error };
+  const python = picked.python;
+  if (deps.clean) {
+    rmSync2(path18.join(forgesRoot(deps.home), entry2.name), { recursive: true, force: true });
+    const st = loadForgeState(deps.home);
+    if (st.forges[entry2.name]) {
+      delete st.forges[entry2.name];
+      saveForgeState(deps.home, st);
+    }
+  }
+  const wheels = wheelCacheDir(deps.cacheDir, entry2.dist);
+  const forgeDir = path18.join(forgesRoot(deps.home), entry2.name);
+  const cleanup = () => {
+    rmSync2(venvDir, { recursive: true, force: true });
+    if (existsSync10(forgeDir) && !readdirSync3(forgeDir).length) {
+      rmSync2(forgeDir, { recursive: true, force: true });
+    }
+  };
+  const venv = await run(python.exe[0], [...python.exe.slice(1), "-m", "venv", venvDir]);
+  if (venv.exitCode !== 0) {
+    cleanup();
+    return {
+      stage: "venv",
+      detail: redactSecrets(venv.stderr ?? venv.stdout ?? "falha ao criar venv")
+    };
+  }
+  const vpy = venvPython(venvDir, platform2);
+  const spec = `${entry2.dist}==${resolved.version}`;
+  mkdirSync4(wheels, { recursive: true });
+  const distFiles = distArtifactFiles(resolved.files, entry2.dist);
+  let verifiedHash;
+  let verifiedFile;
+  if (deps.offline) {
+    const have = existsSync10(wheels) ? readdirSync3(wheels) : [];
+    if (!distFiles.length || !distFiles.some((f) => have.includes(f.filename))) {
+      cleanup();
+      return {
+        stage: "offline-missing-artifact",
+        detail: `${spec}: sem wheel/sdist em ${wheels} \u2014 instale online uma vez`
+      };
+    }
+    const check = checkDistHashes(distFiles, wheels);
+    if ("detail" in check) {
+      cleanup();
+      return { stage: "hash-mismatch", detail: check.detail };
+    }
+    verifiedHash = check.verifiedHash;
+    verifiedFile = check.verifiedFile;
+  } else {
+    const dl = await run(vpy, [
+      "-m",
+      "pip",
+      "download",
+      "--disable-pip-version-check",
+      "--no-input",
+      "--dest",
+      wheels,
+      spec
+    ]);
+    if (dl.exitCode !== 0) {
+      cleanup();
+      return {
+        stage: "download",
+        // stderr do pip pode ecoar credenciais de PIP_INDEX_URL — redação
+        // vale para stdout-JSON, --report e log humano.
+        detail: redactSecrets((dl.stderr ?? dl.stdout ?? "falha no pip download").trim())
+      };
+    }
+    const check = checkDistHashes(distFiles, wheels);
+    if ("detail" in check) {
+      cleanup();
+      return { stage: "hash-mismatch", detail: check.detail };
+    }
+    verifiedHash = check.verifiedHash;
+    verifiedFile = check.verifiedFile;
+  }
+  if (!verifiedFile) {
+    cleanup();
+    return {
+      stage: "hash-mismatch",
+      detail: `${spec}: nenhum artefato da dist com sha256 verific\xE1vel nos metadados`
+    };
+  }
+  const pipArgs = [
+    "-m",
+    "pip",
+    "install",
+    "--disable-pip-version-check",
+    "--no-input",
+    // `--find-links` só no offline: online as dependências resolvem no
+    // índice, não em wheels cacheadas potencialmente velhas/adulteradas.
+    // Limite conhecido (§11.2): offline, deps transitivas resolvem por
+    // nome no --find-links sem pin de hash.
+    ...deps.offline ? ["--no-index", "--find-links", wheels] : [],
+    // Caminho explícito do artefato verificado — pip não resolve por nome,
+    // então um arquivo plantado com a mesma dist==versão nunca é escolhido.
+    path18.join(wheels, verifiedFile)
+  ];
+  const pip = await run(vpy, pipArgs);
+  if (pip.exitCode !== 0) {
+    cleanup();
+    return {
+      stage: "pip",
+      detail: redactSecrets((pip.stderr ?? pip.stdout ?? "falha no pip install").trim())
+    };
+  }
+  const binPath = path18.join(
+    venvBin(venvDir, platform2),
+    platform2 === "win32" ? `${entry2.bin}.exe` : entry2.bin
+  );
+  const verifyCmd = [binPath, "--help"];
+  const verify = await run(binPath, ["--help"]);
+  const receipt = {
+    forge: entry2.name,
+    method: "pypi",
+    dist: entry2.dist,
+    version: resolved.version,
+    requiresPython: resolved.requiresPython,
+    python: python.version,
+    source: resolved.source,
+    venv: venvDir,
+    bin: binPath,
+    installedAt: (deps.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))(),
+    verify: { command: verifyCmd, ok: verify.exitCode === 0 },
+    files: resolved.files.map((f) => ({
+      filename: f.filename,
+      sha256: f.sha256,
+      packagetype: f.packagetype
+    })),
+    verifiedHash,
+    provenance: {
+      registry: "pypi.org",
+      file: verifiedFile,
+      url: resolved.files.find((f) => f.filename === verifiedFile)?.url,
+      resolvedVia: deps.offline ? "offline-cache" : "pypi"
+    },
+    yanked: resolved.yanked,
+    staleCache: resolved.staleCache
+  };
+  mkdirSync4(path18.dirname(receiptPath(deps.home, entry2.name)), { recursive: true });
+  writeFileAtomic(receiptPath(deps.home, entry2.name), `${JSON.stringify(receipt, null, 2)}
+`);
+  const state = loadForgeState(deps.home);
+  state.forges[entry2.name] = receipt;
+  saveForgeState(deps.home, state);
+  if (verify.exitCode !== 0) {
+    return { stage: "verify", detail: `${entry2.bin} --help saiu com c\xF3digo ${verify.exitCode}` };
+  }
+  return receipt;
+}
+function registryUninstall(target, deps) {
+  const dir = resolveInside(forgesRoot(deps.home), target.name);
+  if (!dir)
+    return { removed: false, receiptRemoved: false, cacheRemoved: false, refused: "unsafe-name" };
+  const removed = existsSync10(dir);
+  if (removed) rmSync2(dir, { recursive: true, force: true });
+  const wheels = target.dist && isSafeRepoName(target.dist) ? resolveInside(path18.join(deps.home, ".forge-cli", "cache", "wheels"), target.dist) : null;
+  const cacheRemoved = wheels !== null && existsSync10(wheels);
+  if (wheels) rmSync2(wheels, { recursive: true, force: true });
+  const state = loadForgeState(deps.home);
+  const hadReceipt = Object.hasOwn(state.forges, target.name);
+  if (hadReceipt) delete state.forges[target.name];
+  saveForgeState(deps.home, state);
+  return { removed, receiptRemoved: hadReceipt, cacheRemoved };
+}
+
+// src/compat.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import path19 from "path";
 var ECOSYSTEM_SCHEMA = "forge/EcosystemCompatibility/v1";
 function isRecord(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -15349,10 +16078,10 @@ function manifestProblems(doc) {
   return problems;
 }
 function loadCompatManifest(manifestPath) {
-  if (!existsSync10(manifestPath)) return null;
+  if (!existsSync11(manifestPath)) return null;
   let raw;
   try {
-    raw = readFileSync8(manifestPath, "utf-8");
+    raw = readFileSync10(manifestPath, "utf-8");
   } catch {
     return null;
   }
@@ -15369,12 +16098,12 @@ function loadCompatManifest(manifestPath) {
     release: d.release,
     components: d.components,
     contracts: d.contracts,
-    fileSha256: createHash("sha256").update(raw).digest("hex"),
+    fileSha256: createHash2("sha256").update(raw).digest("hex"),
     path: manifestPath
   };
 }
 function defaultManifestPath(workspaceDir) {
-  return path17.join(workspaceDir, "the-forge", "ecosystem-compatibility.json");
+  return path19.join(workspaceDir, "the-forge", "ecosystem-compatibility.json");
 }
 function compatVerdict(manifest, component, version) {
   const entry2 = manifest.components.find((c4) => c4.component === component);
@@ -15382,21 +16111,21 @@ function compatVerdict(manifest, component, version) {
   return entry2.version === version ? "certified" : "incompatible";
 }
 function readDeclaredVersion(repoDir) {
-  const pkg = path17.join(repoDir, "package.json");
-  if (existsSync10(pkg)) {
+  const pkg = path19.join(repoDir, "package.json");
+  if (existsSync11(pkg)) {
     try {
-      const parsed = JSON.parse(readFileSync8(pkg, "utf-8"));
+      const parsed = JSON.parse(readFileSync10(pkg, "utf-8"));
       if (isRecord(parsed) && typeof parsed.version === "string" && parsed.version) {
         return parsed.version;
       }
     } catch {
     }
   }
-  const pyproject = path17.join(repoDir, "pyproject.toml");
-  if (existsSync10(pyproject)) {
+  const pyproject = path19.join(repoDir, "pyproject.toml");
+  if (existsSync11(pyproject)) {
     try {
       const table = /^\[project\][^\n]*\n((?:(?!\[)[^\n]*(?:\n|$))*)/m.exec(
-        readFileSync8(pyproject, "utf-8")
+        readFileSync10(pyproject, "utf-8")
       );
       const m3 = table && /^version\s*=\s*"([^"]+)"/m.exec(table[1]);
       if (m3) return m3[1];
@@ -15410,25 +16139,49 @@ function readDeclaredVersion(repoDir) {
 async function runListCommand(cli) {
   const targetDir = resolveTargetDir(cli.dir);
   const state = loadState(targetDir);
-  const body = catalogFor(targetDir).map((repo) => listLine(repo, state?.repos[repo.name])).join("\n");
+  const registry = loadForgeState(os2.homedir()).forges;
+  const body = catalogFor(targetDir).map((repo) => {
+    const line = listLine(repo, state?.repos[repo.name]);
+    const reg = registry[repo.name];
+    return reg ? `${line} ${theme.dim(`+ pypi ${reg.dist}==${reg.version}`)}` : line;
+  }).join("\n");
   if (cli.jsonReport) {
     emitJson(
       catalogFor(targetDir).map((repo) => ({
         name: repo.name,
         url: repo.url,
         description: repo.description,
-        last: state?.repos[repo.name] ?? null
+        last: state?.repos[repo.name] ?? null,
+        registry: registry[repo.name] ? { dist: registry[repo.name].dist, version: registry[repo.name].version } : null
       }))
     );
   }
   note(body, S.listTitle);
   process.exit(0);
 }
+function mergeRegistryPhase(infos, registry) {
+  for (const i3 of infos) {
+    const reg = Object.hasOwn(registry, i3.name) ? registry[i3.name] : void 0;
+    if (!reg || typeof reg !== "object") continue;
+    const tag2 = `pypi ${reg.dist ?? "?"}==${reg.version ?? "?"}`;
+    const binMissing = typeof reg.bin !== "string" || !existsSync12(reg.bin);
+    if (binMissing) {
+      if (i3.phase === "not-installed" || i3.phase === "installed") i3.phase = "drifted";
+      i3.describe = [i3.describe, `${tag2} (bin ausente)`].filter(Boolean).join(" + ");
+    } else if (i3.phase === "not-installed") {
+      i3.phase = "installed";
+      i3.describe = `${tag2}${reg.verify?.ok ? "" : " (verify falhou)"}`;
+    } else {
+      i3.describe = [i3.describe, tag2].filter(Boolean).join(" + ");
+    }
+  }
+}
 async function runStatusCommand(cli, names) {
   const targetDir = resolveTargetDir(cli.dir);
   const catalog = catalogFor(targetDir);
   const wanted = names.length ? catalog.filter((r2) => names.includes(r2.name)) : catalog;
   const infos = await collectStatus(wanted, targetDir, loadState(targetDir));
+  mergeRegistryPhase(infos, loadForgeState(os2.homedir()).forges);
   const label = {
     "not-installed": S.statusNotInstalled,
     cloned: S.statusCloned,
@@ -15477,7 +16230,8 @@ async function runUpdateCheckCommand(cli, names) {
     const compat = compatOf(repo.name, dir);
     const check = await updateCheck(dir);
     if (check.failure) {
-      lines.push(`${repo.name} \u2014 ${theme.warn(`${S.updateCheckFailed} (${check.failure})`)}`);
+      const label = check.failure === "no-upstream" ? S.updateNoUpstream : `${S.updateCheckFailed} (${check.failure})`;
+      lines.push(`${repo.name} \u2014 ${theme.warn(label)}`);
       rows.push({ name: repo.name, state: "unknown", behind: 0, ahead: 0, failure: check.failure });
     } else if (check.behind > 0) {
       pending++;
@@ -15548,21 +16302,21 @@ async function runVersionsCommand(cli, names) {
 }
 
 // src/doctor2/index.ts
-import os3 from "os";
-import path28 from "path";
+import os5 from "os";
+import path30 from "path";
 
 // src/hosts/claude.ts
-import path19 from "path";
+import path21 from "path";
 
 // src/hosts/types.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync as readdirSync3, rmSync as rmSync2 } from "fs";
-import os from "os";
-import path18 from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync11, readdirSync as readdirSync4, rmSync as rmSync3 } from "fs";
+import os3 from "os";
+import path20 from "path";
 var defaultProbe = {
   output: (command, args) => commandOutput(command, args)
 };
 function hostHome(home) {
-  return home || os.homedir();
+  return home || os3.homedir();
 }
 function parseVersionOutput(out) {
   if (!out) return null;
@@ -15572,7 +16326,7 @@ function parseVersionOutput(out) {
   return first && first !== "ok" ? first : null;
 }
 function existingConfigPaths(home, rels) {
-  return rels.map((rel2) => path18.join(home, rel2)).filter((p) => existsSync11(p));
+  return rels.map((rel2) => path20.join(home, rel2)).filter((p) => existsSync13(p));
 }
 async function detectHost(home, spec) {
   let binary = false;
@@ -15615,9 +16369,9 @@ async function detectHost(home, spec) {
   };
 }
 function readJsonObject(file) {
-  if (!existsSync11(file)) return null;
+  if (!existsSync13(file)) return null;
   try {
-    const parsed = JSON.parse(readFileSync9(file, "utf8"));
+    const parsed = JSON.parse(readFileSync11(file, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : "invalid";
   } catch {
     return "invalid";
@@ -15653,22 +16407,22 @@ function backupTimestamp(d = /* @__PURE__ */ new Date()) {
   return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}${p(d.getMilliseconds(), 3)}`;
 }
 function backupsRoot(home) {
-  return path18.join(artifactsRoot(home), "backups");
+  return path20.join(artifactsRoot(home), "backups");
 }
 function backupDirFor(home, hostId) {
-  return path18.join(backupsRoot(home), `hosts-${hostId}-${backupTimestamp()}`);
+  return path20.join(backupsRoot(home), `hosts-${hostId}-${backupTimestamp()}`);
 }
 function backupTargets(dir, hostId, targets) {
-  mkdirSync3(dir, { recursive: true });
+  mkdirSync5(dir, { recursive: true });
   const files = targets.map((target) => {
-    const name = path18.basename(target);
-    const absent = !existsSync11(target);
-    if (absent) writeFileAtomic(path18.join(dir, `${name}.absent`), "");
-    else copyFileSync2(target, path18.join(dir, name));
+    const name = path20.basename(target);
+    const absent = !existsSync13(target);
+    if (absent) writeFileAtomic(path20.join(dir, `${name}.absent`), "");
+    else copyFileSync2(target, path20.join(dir, name));
     return { backup: name, target, absent };
   });
   writeFileAtomic(
-    path18.join(dir, "manifest.json"),
+    path20.join(dir, "manifest.json"),
     `${JSON.stringify({ host: hostId, files }, null, 2)}
 `
   );
@@ -15676,23 +16430,23 @@ function backupTargets(dir, hostId, targets) {
 function latestBackupDir(home, hostId) {
   let names;
   try {
-    names = readdirSync3(backupsRoot(home));
+    names = readdirSync4(backupsRoot(home));
   } catch {
     return null;
   }
   const hit = names.filter((n4) => n4.startsWith(`hosts-${hostId}-`)).sort().reverse()[0];
-  return hit ? path18.join(backupsRoot(home), hit) : null;
+  return hit ? path20.join(backupsRoot(home), hit) : null;
 }
 function restoreBackupDir(dir) {
-  const manifest = JSON.parse(readFileSync9(path18.join(dir, "manifest.json"), "utf8"));
+  const manifest = JSON.parse(readFileSync11(path20.join(dir, "manifest.json"), "utf8"));
   const restored = [];
   const removed = [];
   for (const entry2 of manifest.files ?? []) {
     if (entry2.absent) {
-      rmSync2(entry2.target, { force: true });
+      rmSync3(entry2.target, { force: true });
       removed.push(entry2.target);
     } else {
-      writeFileAtomic(entry2.target, readFileSync9(path18.join(dir, entry2.backup), "utf8"));
+      writeFileAtomic(entry2.target, readFileSync11(path20.join(dir, entry2.backup), "utf8"));
       restored.push(entry2.target);
     }
   }
@@ -15741,7 +16495,7 @@ async function applyHostPlan(home, plan, resolveWrite, opts = {}) {
   );
   for (const w of writes) {
     try {
-      mkdirSync3(path18.dirname(w.target), { recursive: true });
+      mkdirSync5(path20.dirname(w.target), { recursive: true });
       writeFileAtomic(w.target, w.content);
       applied.push(w.target);
     } catch (error) {
@@ -15788,9 +16542,9 @@ async function rollbackHostPlan(home, plan, backup) {
 
 // src/hosts/claude.ts
 var CONFIG_FILE = ".claude.json";
-var CONFIG_REL = [CONFIG_FILE, ".claude", path19.join(".claude", "settings.json")];
+var CONFIG_REL = [CONFIG_FILE, ".claude", path21.join(".claude", "settings.json")];
 function targetFor(home) {
-  return path19.join(home, CONFIG_FILE);
+  return path21.join(home, CONFIG_FILE);
 }
 function createClaudeAdapter(probe = defaultProbe) {
   return {
@@ -15858,12 +16612,12 @@ function createClaudeAdapter(probe = defaultProbe) {
 var claudeAdapter = createClaudeAdapter();
 
 // src/hosts/codex.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import path20 from "path";
-var CONFIG_FILE2 = path20.join(".codex", "config.toml");
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import path22 from "path";
+var CONFIG_FILE2 = path22.join(".codex", "config.toml");
 var CONFIG_REL2 = [CONFIG_FILE2, ".codex"];
 function targetFor2(home) {
-  return path20.join(home, CONFIG_FILE2);
+  return path22.join(home, CONFIG_FILE2);
 }
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -15929,7 +16683,7 @@ function createCodexAdapter(probe = defaultProbe) {
         authArgv: ["codex", "login", "status"],
         hasIntegration: (dir) => {
           const file = targetFor2(dir);
-          return existsSync12(file) && hasAnyCodexMcpSection(readFileSync10(file, "utf8"));
+          return existsSync14(file) && hasAnyCodexMcpSection(readFileSync12(file, "utf8"));
         }
       });
     },
@@ -15938,7 +16692,7 @@ function createCodexAdapter(probe = defaultProbe) {
       if (!argv?.length) return null;
       const h3 = hostHome(home);
       const target = targetFor2(h3);
-      const existing = existsSync12(target) ? readFileSync10(target, "utf8") : null;
+      const existing = existsSync14(target) ? readFileSync12(target, "utf8") : null;
       if (existing !== null && hasCodexMcpSection(existing, forge.forge_id)) {
         return {
           host: "codex",
@@ -15969,7 +16723,7 @@ function createCodexAdapter(probe = defaultProbe) {
       plan,
       (action) => {
         if (!action.target || !action.argv?.length) return "skip";
-        const existing = existsSync12(action.target) ? readFileSync10(action.target, "utf8") : null;
+        const existing = existsSync14(action.target) ? readFileSync12(action.target, "utf8") : null;
         if (existing !== null && hasCodexMcpSection(existing, plan.forge_id)) {
           return "duplicate";
         }
@@ -15986,13 +16740,13 @@ ${block2}
     validateIntegration: async (forge_id, home) => {
       const file = targetFor2(hostHome(home));
       const checks = [];
-      if (!existsSync12(file)) {
+      if (!existsSync14(file)) {
         checks.push({ id: "config-file", result: "fail", detail: "absent" });
         checks.push({ id: "mcp-section", result: "fail", detail: forge_id });
         return { ok: false, checks };
       }
       checks.push({ id: "config-file", result: "pass", detail: file });
-      const content = readFileSync10(file, "utf8");
+      const content = readFileSync12(file, "utf8");
       if (!hasCodexMcpSection(content, forge_id)) {
         checks.push({ id: "mcp-section", result: "fail", detail: forge_id });
         return { ok: false, checks };
@@ -16013,12 +16767,12 @@ ${block2}
 var codexAdapter = createCodexAdapter();
 
 // src/hosts/copilot.ts
-import path21 from "path";
-import { existsSync as existsSync13 } from "fs";
-var CONFIG_FILE3 = path21.join(".copilot", "mcp-config.json");
-var CONFIG_REL3 = [".copilot", CONFIG_FILE3, path21.join(".config", "gh")];
+import path23 from "path";
+import { existsSync as existsSync15 } from "fs";
+var CONFIG_FILE3 = path23.join(".copilot", "mcp-config.json");
+var CONFIG_REL3 = [".copilot", CONFIG_FILE3, path23.join(".config", "gh")];
 function targetFor3(home) {
-  return path21.join(home, CONFIG_FILE3);
+  return path23.join(home, CONFIG_FILE3);
 }
 function createCopilotAdapter(probe = defaultProbe) {
   return {
@@ -16042,7 +16796,7 @@ function createCopilotAdapter(probe = defaultProbe) {
       if (!argv?.length) return null;
       const h3 = hostHome(home);
       const target = targetFor3(h3);
-      if (!existsSync13(target)) return null;
+      if (!existsSync15(target)) return null;
       if (hasMcpEntry(target, forge.forge_id)) {
         return {
           host: "copilot",
@@ -16088,11 +16842,11 @@ function createCopilotAdapter(probe = defaultProbe) {
 var copilotAdapter = createCopilotAdapter();
 
 // src/hosts/cursor.ts
-import path22 from "path";
-var CONFIG_FILE4 = path22.join(".cursor", "mcp.json");
+import path24 from "path";
+var CONFIG_FILE4 = path24.join(".cursor", "mcp.json");
 var CONFIG_REL4 = [CONFIG_FILE4, ".cursor"];
 function targetFor4(home) {
-  return path22.join(home, CONFIG_FILE4);
+  return path24.join(home, CONFIG_FILE4);
 }
 function createCursorAdapter(probe = defaultProbe) {
   return {
@@ -16158,8 +16912,8 @@ function createCursorAdapter(probe = defaultProbe) {
 var cursorAdapter = createCursorAdapter();
 
 // src/hosts/devin.ts
-import path23 from "path";
-var CONFIG_REL5 = [".devin", path23.join(".config", "devin")];
+import path25 from "path";
+var CONFIG_REL5 = [".devin", path25.join(".config", "devin")];
 function createDevinAdapter(probe = defaultProbe) {
   return {
     id: "devin",
@@ -16210,7 +16964,7 @@ async function detectAll(home) {
 }
 
 // src/doctor2/context.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync11 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync13 } from "fs";
 var DEFAULT_MAX_RECEIPTS = 20;
 var DEFAULT_MAX_ENTRIES = 50;
 function mkCheck(now, check) {
@@ -16218,14 +16972,14 @@ function mkCheck(now, check) {
 }
 function listDir(dir) {
   try {
-    return readdirSync4(dir).sort();
+    return readdirSync5(dir).sort();
   } catch {
     return null;
   }
 }
 function readJson(file) {
   try {
-    return { ok: true, value: JSON.parse(readFileSync11(file, "utf8")) };
+    return { ok: true, value: JSON.parse(readFileSync13(file, "utf8")) };
   } catch (error) {
     return { ok: false, error: errMsg(error) };
   }
@@ -16240,13 +16994,13 @@ function errMsg(error) {
 }
 
 // src/doctor2/domains.ts
-import { existsSync as existsSync17, readdirSync as readdirSync6, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import os2 from "os";
-import path27 from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync7, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import os4 from "os";
+import path29 from "path";
 
 // src/envintel/validate.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
-import path25 from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import path27 from "path";
 
 // src/envintel/parse.ts
 var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -16332,8 +17086,8 @@ function formatEntry(key, value) {
 }
 
 // src/envintel/schema.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
-import path24 from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import path26 from "path";
 var SECRET_RE = /KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL/;
 var KIND_RULES = [
   { kind: "port", re: /(^|_)PORT($|_)/ },
@@ -16380,10 +17134,10 @@ function validPattern(p) {
   }
 }
 function readSchemaFile(repoDir) {
-  const file = path24.join(repoDir, "forge.env.schema.json");
-  if (!existsSync14(file)) return [];
+  const file = path26.join(repoDir, "forge.env.schema.json");
+  if (!existsSync16(file)) return [];
   try {
-    const parsed = JSON.parse(readFileSync12(file, "utf8"));
+    const parsed = JSON.parse(readFileSync14(file, "utf8"));
     const list = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.vars) ? parsed.vars : parsed && typeof parsed === "object" ? Object.entries(parsed).map(([key, v]) => ({
       key,
       ...v && typeof v === "object" ? v : {}
@@ -16395,9 +17149,9 @@ function readSchemaFile(repoDir) {
 }
 function deriveSchema(repoDir, envKeys) {
   const specs = /* @__PURE__ */ new Map();
-  const exampleFile = path24.join(repoDir, ".env.example");
-  if (existsSync14(exampleFile)) {
-    for (const entry2 of parseEnv(readFileSync12(exampleFile, "utf8")).entries) {
+  const exampleFile = path26.join(repoDir, ".env.example");
+  if (existsSync16(exampleFile)) {
+    for (const entry2 of parseEnv(readFileSync14(exampleFile, "utf8")).entries) {
       if (specs.has(entry2.key)) continue;
       const kind = inferKind(entry2.key, entry2.value || void 0);
       const secret = kind === "secret";
@@ -16460,8 +17214,8 @@ function checkValue(spec, value, opts = {}) {
     case "path": {
       if (!value.trim()) return false;
       if (!opts.checkPaths) return true;
-      const p = path25.isAbsolute(value) ? value : path25.resolve(opts.baseDir ?? ".", value);
-      return existsSync15(p);
+      const p = path27.isAbsolute(value) ? value : path27.resolve(opts.baseDir ?? ".", value);
+      return existsSync17(p);
     }
     case "bool":
       return /^(true|false|0|1|yes|no)$/i.test(value.trim());
@@ -16512,9 +17266,9 @@ function analyzeKey(key, spec, entries, opts) {
 }
 function analyzeEnv(repoDir, envKeys, opts = {}) {
   const schema = deriveSchema(repoDir, envKeys);
-  const envPath = path25.join(repoDir, ".env");
+  const envPath = path27.join(repoDir, ".env");
   const specByKey = new Map(schema.vars.map((v) => [v.key, v]));
-  const envFile = existsSync15(envPath) ? parseEnv(readFileSync13(envPath, "utf8")) : null;
+  const envFile = existsSync17(envPath) ? parseEnv(readFileSync15(envPath, "utf8")) : null;
   const findings = [];
   const vars = [];
   const byKey = /* @__PURE__ */ new Map();
@@ -16595,9 +17349,9 @@ function inspectEnv(repoDir, envKeys) {
 }
 
 // src/maintenance.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "fs";
-import { createHash as createHash2 } from "crypto";
-import path26 from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync16, readdirSync as readdirSync6 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import path28 from "path";
 function envLockDigest(repoDir) {
   const names = [
     ".env.example",
@@ -16607,12 +17361,12 @@ function envLockDigest(repoDir) {
     "pyproject.toml"
   ];
   const files = [];
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   for (const name of names) {
-    const file = path26.join(repoDir, name);
-    if (!existsSync16(file)) continue;
+    const file = path28.join(repoDir, name);
+    if (!existsSync18(file)) continue;
     files.push(name);
-    const content = readFileSync14(file);
+    const content = readFileSync16(file);
     hash.update(name).update("\0").update(content).update("\0");
   }
   return { files, digest: hash.digest("hex") };
@@ -16624,31 +17378,31 @@ function writeEnvLock(targetDir, repos) {
     forges: {}
   };
   for (const repo of repos) {
-    const dir = path26.join(targetDir, repo.name);
-    if (!existsSync16(dir)) continue;
+    const dir = path28.join(targetDir, repo.name);
+    if (!existsSync18(dir)) continue;
     const { files, digest } = envLockDigest(dir);
     const head = loadState(targetDir)?.repos[repo.name]?.head;
     lock.forges[repo.name] = { env_files: files, digest, ...head ? { head } : {} };
   }
-  const file = path26.join(artifactsRoot(targetDir), "env.lock.json");
-  mkdirSync4(path26.dirname(file), { recursive: true });
+  const file = path28.join(artifactsRoot(targetDir), "env.lock.json");
+  mkdirSync6(path28.dirname(file), { recursive: true });
   writeFileAtomic(file, JSON.stringify(lock, null, 2));
   return lock;
 }
 function checkEnvLock(targetDir, repos) {
-  const file = path26.join(artifactsRoot(targetDir), "env.lock.json");
-  if (!existsSync16(file)) return repos.map((r2) => ({ forge: r2.name, state: "untracked" }));
+  const file = path28.join(artifactsRoot(targetDir), "env.lock.json");
+  if (!existsSync18(file)) return repos.map((r2) => ({ forge: r2.name, state: "untracked" }));
   let lock;
   try {
-    lock = JSON.parse(readFileSync14(file, "utf8"));
+    lock = JSON.parse(readFileSync16(file, "utf8"));
   } catch {
     return repos.map((r2) => ({ forge: r2.name, state: "untracked" }));
   }
   return repos.map((repo) => {
     const entry2 = lock.forges?.[repo.name];
     if (!entry2) return { forge: repo.name, state: "untracked" };
-    const dir = path26.join(targetDir, repo.name);
-    if (!existsSync16(dir)) return { forge: repo.name, state: "absent" };
+    const dir = path28.join(targetDir, repo.name);
+    if (!existsSync18(dir)) return { forge: repo.name, state: "absent" };
     const { digest } = envLockDigest(dir);
     return { forge: repo.name, state: digest === entry2.digest ? "match" : "drifted" };
   });
@@ -16666,13 +17420,13 @@ function exportProfile(targetDir, dest) {
       ])
     )
   };
-  mkdirSync4(path26.dirname(path26.resolve(dest)), { recursive: true });
+  mkdirSync6(path28.dirname(path28.resolve(dest)), { recursive: true });
   writeFileAtomic(dest, JSON.stringify(profile, null, 2));
   return profile;
 }
 function importProfile(file) {
   try {
-    const parsed = JSON.parse(readFileSync14(file, "utf8"));
+    const parsed = JSON.parse(readFileSync16(file, "utf8"));
     if (parsed?.schema !== "forge-cli/Profile/v1" || typeof parsed.repos !== "object") {
       return { error: "invalid-profile" };
     }
@@ -16750,7 +17504,7 @@ function systemChecks(ctx) {
       result: "pass",
       severity: "info",
       diagnosis: "plataforma detectada",
-      evidence: [`platform=${process.platform}`, `arch=${os2.arch()}`, `release=${os2.release()}`],
+      evidence: [`platform=${process.platform}`, `arch=${os4.arch()}`, `release=${os4.release()}`],
       reversible: null
     })
   );
@@ -16760,23 +17514,23 @@ function systemChecks(ctx) {
   let readEvidence;
   let writeEvidence = "write=n\xE3o sondado (leitura falhou)";
   try {
-    readdirSync6(dir);
+    readdirSync7(dir);
     readable2 = true;
     readEvidence = "read=ok";
   } catch (error) {
     readEvidence = `read=falha (${errMsg(error)})`;
   }
   if (readable2) {
-    const probe = path27.join(dir, `.forge-doctor2-probe-${process.pid}`);
+    const probe = path29.join(dir, `.forge-doctor2-probe-${process.pid}`);
     try {
-      writeFileSync4(probe, "probe\n", "utf8");
-      rmSync3(probe, { force: true });
+      writeFileSync5(probe, "probe\n", "utf8");
+      rmSync4(probe, { force: true });
       writable2 = true;
       writeEvidence = "write=ok";
     } catch (error) {
       writeEvidence = `write=falha (${errMsg(error)})`;
       try {
-        rmSync3(probe, { force: true });
+        rmSync4(probe, { force: true });
       } catch {
       }
     }
@@ -16797,12 +17551,12 @@ function systemChecks(ctx) {
   );
   const required = [
     { label: "home", dir: ctx.home },
-    { label: "tmpdir", dir: os2.tmpdir() }
+    { label: "tmpdir", dir: os4.tmpdir() }
   ];
   const dirEvidence = [];
   let dirFailed = 0;
   for (const { label, dir: d } of required) {
-    if (!existsSync17(d)) {
+    if (!existsSync19(d)) {
       dirFailed += 1;
       dirEvidence.push(`${label}=${d}: ausente`);
       continue;
@@ -16860,7 +17614,7 @@ function backupScan(ctx) {
         over = true;
         break;
       }
-      const full = path27.join(dir, name);
+      const full = path29.join(dir, name);
       try {
         if (!statSync3(full).isDirectory()) continue;
       } catch {
@@ -16869,16 +17623,16 @@ function backupScan(ctx) {
       if (restorableIf(full)) restorable.push(`${kind}: ${full}`);
     }
   };
-  scan(path27.join(artifactsRoot(ctx.root), "backups"), "workspace-backup", dirHasFiles);
+  scan(path29.join(artifactsRoot(ctx.root), "backups"), "workspace-backup", dirHasFiles);
   scan(
-    path27.join(ctx.home, ".forge-cli", "backups"),
+    path29.join(ctx.home, ".forge-cli", "backups"),
     "host-backup",
-    (full) => existsSync17(path27.join(full, "manifest.json"))
+    (full) => existsSync19(path29.join(full, "manifest.json"))
   );
   for (const repo of ctx.catalog) {
     const dir = resolveInside(ctx.root, repo.name);
     if (!dir || over) continue;
-    scan(path27.join(dir, ".forge-cli", "backups"), `env-backup(${repo.name})`, dirHasFiles);
+    scan(path29.join(dir, ".forge-cli", "backups"), `env-backup(${repo.name})`, dirHasFiles);
   }
   if (over) ctx.truncated.value = true;
   return { restorable, scanned };
@@ -16886,7 +17640,7 @@ function backupScan(ctx) {
 function installationChecks(ctx) {
   const checks = [];
   const forgeDir = artifactsRoot(ctx.root);
-  const forgeDirPresent = existsSync17(forgeDir);
+  const forgeDirPresent = existsSync19(forgeDir);
   const stateFile = stateFileFor(ctx.root);
   checks.push(
     mkCheck(
@@ -16899,7 +17653,7 @@ function installationChecks(ctx) {
         diagnosis: "diret\xF3rio de estado .forge-cli presente",
         evidence: [
           `${forgeDir} presente`,
-          existsSync17(stateFile) ? "state.json presente" : "state.json ausente"
+          existsSync19(stateFile) ? "state.json presente" : "state.json ausente"
         ],
         reversible: null
       } : {
@@ -16914,8 +17668,8 @@ function installationChecks(ctx) {
       }
     )
   );
-  const forgeJson = path27.join(ctx.root, "forge.json");
-  if (!existsSync17(forgeJson)) {
+  const forgeJson = path29.join(ctx.root, "forge.json");
+  if (!existsSync19(forgeJson)) {
     checks.push(
       mkCheck(ctx.now, {
         id: "installation.forge-json.present",
@@ -16964,10 +17718,10 @@ function installationChecks(ctx) {
       );
     }
   }
-  const lockFile = path27.join(forgeDir, "env.lock.json");
-  const lockParsed = existsSync17(lockFile) ? readJson(lockFile) : null;
+  const lockFile = path29.join(forgeDir, "env.lock.json");
+  const lockParsed = existsSync19(lockFile) ? readJson(lockFile) : null;
   const lockObj = lockParsed?.ok && lockParsed.value !== null && typeof lockParsed.value === "object" ? lockParsed.value : null;
-  if (!forgeDirPresent || !existsSync17(lockFile)) {
+  if (!forgeDirPresent || !existsSync19(lockFile)) {
     checks.push(
       mkCheck(ctx.now, {
         id: "installation.lockfile.present",
@@ -17012,7 +17766,7 @@ function installationChecks(ctx) {
     );
   }
   const trackedForges = lockObj ? Object.keys(lockObj.forges ?? {}) : [];
-  if (!existsSync17(lockFile) || !lockObj || !trackedForges.length) {
+  if (!existsSync19(lockFile) || !lockObj || !trackedForges.length) {
     checks.push(
       mkCheck(ctx.now, {
         id: "installation.lockfile.drift",
@@ -17021,7 +17775,7 @@ function installationChecks(ctx) {
         severity: "info",
         diagnosis: "deriva do lockfile n\xE3o verific\xE1vel",
         evidence: [
-          !existsSync17(lockFile) ? "sem lockfile para recomputar (.forge-cli/env.lock.json ausente)" : !lockObj ? "lockfile ileg\xEDvel \u2014 digest n\xE3o pode ser recomputado" : "lockfile n\xE3o cobre nenhuma Forja \u2014 nada para recomputar"
+          !existsSync19(lockFile) ? "sem lockfile para recomputar (.forge-cli/env.lock.json ausente)" : !lockObj ? "lockfile ileg\xEDvel \u2014 digest n\xE3o pode ser recomputado" : "lockfile n\xE3o cobre nenhuma Forja \u2014 nada para recomputar"
         ],
         reversible: null
       })
@@ -17043,17 +17797,17 @@ function installationChecks(ctx) {
       })
     );
   }
-  const ledgerDir = path27.join(ctx.home, ".forge", "installations");
+  const ledgerDir = path29.join(ctx.home, ".forge", "installations");
   const ledgerNames = listDir(ledgerDir);
   if (ledgerNames === null) {
     checks.push(
       mkCheck(ctx.now, {
         id: "installation.ledger.readable",
         domain: "installation",
-        result: existsSync17(ledgerDir) ? "warn" : "skip",
-        severity: existsSync17(ledgerDir) ? "medium" : "info",
-        diagnosis: existsSync17(ledgerDir) ? "ledger de instala\xE7\xF5es existe mas n\xE3o p\xF4de ser lido" : "sem ledger de instala\xE7\xF5es (~/.forge/installations ausente)",
-        evidence: [`${ledgerDir} ${existsSync17(ledgerDir) ? "ileg\xEDvel" : "ausente"}`],
+        result: existsSync19(ledgerDir) ? "warn" : "skip",
+        severity: existsSync19(ledgerDir) ? "medium" : "info",
+        diagnosis: existsSync19(ledgerDir) ? "ledger de instala\xE7\xF5es existe mas n\xE3o p\xF4de ser lido" : "sem ledger de instala\xE7\xF5es (~/.forge/installations ausente)",
+        evidence: [`${ledgerDir} ${existsSync19(ledgerDir) ? "ileg\xEDvel" : "ausente"}`],
         reversible: null
       })
     );
@@ -17181,7 +17935,7 @@ function environmentChecks(ctx) {
   const targets = [{ label: "<workspace>", dir: ctx.root }];
   for (const repo of ctx.catalog) {
     const dir = resolveInside(ctx.root, repo.name);
-    if (dir && existsSync17(dir)) targets.push({ label: repo.name, dir, envKeys: repo.envKeys });
+    if (dir && existsSync19(dir)) targets.push({ label: repo.name, dir, envKeys: repo.envKeys });
   }
   const inspected = targets.map((t2) => ({
     ...t2,
@@ -17393,16 +18147,16 @@ async function hostsChecks(ctx) {
 }
 function operationsChecks(ctx) {
   const checks = [];
-  const reportsDir = path27.join(artifactsRoot(ctx.root), "reports");
+  const reportsDir = path29.join(artifactsRoot(ctx.root), "reports");
   const allReports = (listDir(reportsDir) ?? []).filter((n4) => n4.endsWith(".json"));
   const capped = allReports.length > ctx.maxReceipts;
   if (capped) ctx.truncated.value = true;
   const scannedNames = [...allReports].sort().reverse().slice(0, ctx.maxReceipts);
-  const parsedReports = scannedNames.map((n4) => readJson(path27.join(reportsDir, n4))).filter((r2) => r2.ok).map((r2) => r2.value);
+  const parsedReports = scannedNames.map((n4) => readJson(path29.join(reportsDir, n4))).filter((r2) => r2.ok).map((r2) => r2.value);
   checks.push(
     mkCheck(
       ctx.now,
-      !existsSync17(reportsDir) ? {
+      !existsSync19(reportsDir) ? {
         id: "operations.receipts.recent",
         domain: "operations",
         result: "skip",
@@ -17438,7 +18192,7 @@ function operationsChecks(ctx) {
     if (entry2.status === "error") failures.set(name, (failures.get(name) ?? 0) + 1);
   }
   const recurring = [...failures.entries()].filter(([, n4]) => n4 >= 2);
-  const scannedAnything = existsSync17(reportsDir) || ctx.state !== null;
+  const scannedAnything = existsSync19(reportsDir) || ctx.state !== null;
   if (!scannedAnything) {
     checks.push(
       mkCheck(ctx.now, {
@@ -17474,7 +18228,7 @@ function operationsChecks(ctx) {
   );
   const recFiles = boundEntries(ctx, allRecFiles).shown;
   const recEvidence = recFiles.map((f) => {
-    const parsed = readJson(path27.join(artifactsRoot(ctx.root), f));
+    const parsed = readJson(path29.join(artifactsRoot(ctx.root), f));
     return `recovery file: ${f}${parsed.ok ? "" : " (ileg\xEDvel)"}`;
   });
   checks.push(
@@ -17654,10 +18408,10 @@ function defaultCatalog(root) {
 }
 async function runDoctor2(root, opts = {}) {
   const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const resolved = path28.resolve(root);
+  const resolved = path30.resolve(root);
   const ctx = {
     root: resolved,
-    home: opts.home ?? os3.homedir(),
+    home: opts.home ?? os5.homedir(),
     now,
     catalog: opts.catalog ?? defaultCatalog(resolved),
     adapters: opts.adapters ?? hostAdapters(),
@@ -17714,9 +18468,9 @@ async function runDoctor2(root, opts = {}) {
 }
 
 // src/heal/fixes.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readdirSync as readdirSync7, readFileSync as readFileSync15, statSync as statSync4 } from "fs";
-import path29 from "path";
-var rel = (root, abs) => path29.relative(root, abs) || ".";
+import { existsSync as existsSync20, mkdirSync as mkdirSync7, readdirSync as readdirSync8, readFileSync as readFileSync17, statSync as statSync4 } from "fs";
+import path31 from "path";
+var rel = (root, abs) => path31.relative(root, abs) || ".";
 function stampOf(iso) {
   const m3 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})/.exec(iso);
   return m3 ? `${m3[1]}${m3[2]}${m3[3]}-${m3[4]}${m3[5]}${m3[6]}` : iso.replace(/[^\d]/g, "").slice(0, 14);
@@ -17731,9 +18485,9 @@ var forgeDirRepair = {
   plan(ctx) {
     const base = artifactsRoot(ctx.root);
     return ["", ...FORGE_DIR_SUBDIRS].map((sub) => {
-      const dir = sub ? path29.join(base, sub) : base;
+      const dir = sub ? path31.join(base, sub) : base;
       return {
-        description: `create directory ${rel(ctx.root, dir)}${existsSync18(dir) ? " (already present)" : ""}`,
+        description: `create directory ${rel(ctx.root, dir)}${existsSync20(dir) ? " (already present)" : ""}`,
         touches: [rel(ctx.root, dir)]
       };
     });
@@ -17743,9 +18497,9 @@ var forgeDirRepair = {
     const base = artifactsRoot(ctx.root);
     const created = [];
     for (const sub of ["", ...FORGE_DIR_SUBDIRS]) {
-      const dir = sub ? path29.join(base, sub) : base;
-      if (existsSync18(dir)) continue;
-      mkdirSync5(dir, { recursive: true });
+      const dir = sub ? path31.join(base, sub) : base;
+      if (existsSync20(dir)) continue;
+      mkdirSync7(dir, { recursive: true });
       created.push(rel(ctx.root, dir));
     }
     return created.length ? `created ${created.length} directorie(s): ${created.join(", ")}` : "all directories already present";
@@ -17753,7 +18507,7 @@ var forgeDirRepair = {
   async verify(ctx) {
     const base = artifactsRoot(ctx.root);
     return ["", ...FORGE_DIR_SUBDIRS].every((sub) => {
-      const dir = sub ? path29.join(base, sub) : base;
+      const dir = sub ? path31.join(base, sub) : base;
       try {
         return statSync4(dir).isDirectory();
       } catch {
@@ -17764,12 +18518,12 @@ var forgeDirRepair = {
 };
 var EVIDENCE_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
 function envPathOf(root) {
-  return path29.join(root, ".env");
+  return path31.join(root, ".env");
 }
 function presentKeys(root) {
   const file = envPathOf(root);
-  if (!existsSync18(file)) return /* @__PURE__ */ new Set();
-  return new Set(parseEnv(readFileSync15(file, "utf8")).entries.map((e) => e.key));
+  if (!existsSync20(file)) return /* @__PURE__ */ new Set();
+  return new Set(parseEnv(readFileSync17(file, "utf8")).entries.map((e) => e.key));
 }
 function missingEnvKeys(root, check) {
   const missing = /* @__PURE__ */ new Set();
@@ -17789,9 +18543,9 @@ function keysToAppend(root, check) {
 }
 function backupEnvFile(ctx, current) {
   const stamp = stampOf(ctx.now?.() ?? (/* @__PURE__ */ new Date()).toISOString());
-  const dir = path29.join(artifactsRoot(ctx.root), "backups", `env-${stamp}`);
-  mkdirSync5(dir, { recursive: true });
-  writeFileAtomic(path29.join(dir, ".env"), current);
+  const dir = path31.join(artifactsRoot(ctx.root), "backups", `env-${stamp}`);
+  mkdirSync7(dir, { recursive: true });
+  writeFileAtomic(path31.join(dir, ".env"), current);
   return dir;
 }
 var envMissingKeyRepair = {
@@ -17804,9 +18558,9 @@ var envMissingKeyRepair = {
     const root = ctx.root;
     const toAppend = keysToAppend(root, ctx.check);
     const steps = [];
-    if (existsSync18(envPathOf(root))) {
+    if (existsSync20(envPathOf(root))) {
       steps.push({
-        description: `backup .env to ${rel(root, path29.join(artifactsRoot(root), "backups"))}/env-<ts>/.env`,
+        description: `backup .env to ${rel(root, path31.join(artifactsRoot(root), "backups"))}/env-<ts>/.env`,
         touches: [".env", `${rel(root, artifactsRoot(root))}/backups/`]
       });
     }
@@ -17823,8 +18577,8 @@ var envMissingKeyRepair = {
     const root = ctx.root;
     if (ctx.dryRun) return "dry-run \u2014 not applied";
     const file = envPathOf(root);
-    const exists = existsSync18(file);
-    const current = exists ? readFileSync15(file, "utf8") : "";
+    const exists = existsSync20(file);
+    const current = exists ? readFileSync17(file, "utf8") : "";
     const env = parseEnv(current);
     const present = new Set(env.entries.map((e) => e.key));
     const toAppend = keysToAppend(root, ctx.check).filter((k) => !present.has(k));
@@ -17841,8 +18595,8 @@ var envMissingKeyRepair = {
   },
   async verify(ctx) {
     const file = envPathOf(ctx.root);
-    if (!existsSync18(file)) return false;
-    const present = new Set(parseEnv(readFileSync15(file, "utf8")).entries.map((e) => e.key));
+    if (!existsSync20(file)) return false;
+    const present = new Set(parseEnv(readFileSync17(file, "utf8")).entries.map((e) => e.key));
     return missingEnvKeys(ctx.root, ctx.check).every((k) => present.has(k));
   }
 };
@@ -17858,7 +18612,7 @@ var lockfileDriftRepair = {
     return [
       {
         description: `run \`${LOCKFILE_REGEN_COMMAND}\` to regenerate .forge-cli/env.lock.json`,
-        touches: [path29.join(".forge-cli", "env.lock.json")]
+        touches: [path31.join(".forge-cli", "env.lock.json")]
       },
       {
         description: `run \`${LOCKFILE_CHECK_COMMAND}\` to confirm the drift cleared`,
@@ -17878,14 +18632,14 @@ var lockfileDriftRepair = {
 var ENV_BACKUP_RE = /^env-\d{8}-\d{6}$/;
 var REPO_BACKUP_RE = /^([a-z0-9][a-z0-9._-]*)-\d{10,}$/i;
 function listBackups(root) {
-  const base = path29.join(artifactsRoot(root), "backups");
-  if (!existsSync18(base)) return [];
+  const base = path31.join(artifactsRoot(root), "backups");
+  if (!existsSync20(base)) return [];
   const out = [];
-  for (const entry2 of readdirSync7(base, { withFileTypes: true })) {
+  for (const entry2 of readdirSync8(base, { withFileTypes: true })) {
     if (!entry2.isDirectory()) continue;
-    const dir = path29.join(base, entry2.name);
+    const dir = path31.join(base, entry2.name);
     try {
-      const files = readdirSync7(dir, { withFileTypes: true }).filter((f) => f.isFile()).map((f) => f.name).sort();
+      const files = readdirSync8(dir, { withFileTypes: true }).filter((f) => f.isFile()).map((f) => f.name).sort();
       if (!files.length) continue;
       out.push({ name: entry2.name, dir, files, mtimeMs: statSync4(dir).mtimeMs });
     } catch {
@@ -17901,18 +18655,18 @@ function restoreTargetFor(backupDirName, fileName) {
   return fileName;
 }
 function pickBackupFile(ctx) {
-  const backupsBase = path29.join(artifactsRoot(ctx.root), "backups");
+  const backupsBase = path31.join(artifactsRoot(ctx.root), "backups");
   if (ctx.backup) {
-    const abs = path29.resolve(ctx.root, ctx.backup);
-    const inside = path29.relative(backupsBase, abs);
-    if (inside.startsWith("..") || path29.isAbsolute(inside)) {
+    const abs = path31.resolve(ctx.root, ctx.backup);
+    const inside = path31.relative(backupsBase, abs);
+    if (inside.startsWith("..") || path31.isAbsolute(inside)) {
       throw new Error(`selected backup escapes .forge-cli/backups: ${ctx.backup}`);
     }
-    if (!existsSync18(abs) || !statSync4(abs).isFile()) {
+    if (!existsSync20(abs) || !statSync4(abs).isFile()) {
       throw new Error(`selected backup not found: ${ctx.backup}`);
     }
-    const dirName = inside.split(path29.sep)[0] ?? "";
-    const fileName2 = path29.basename(abs);
+    const dirName = inside.split(path31.sep)[0] ?? "";
+    const fileName2 = path31.basename(abs);
     return { src: abs, rel: inside, dest: restoreTargetFor(dirName, fileName2) };
   }
   const candidates = listBackups(ctx.root);
@@ -17921,7 +18675,7 @@ function pickBackupFile(ctx) {
   if (!cand) throw new Error("no backups available under .forge-cli/backups");
   const fileName = cand.files.includes(".env") ? ".env" : cand.files[0];
   return {
-    src: path29.join(cand.dir, fileName),
+    src: path31.join(cand.dir, fileName),
     rel: `${cand.name}/${fileName}`,
     dest: restoreTargetFor(cand.name, fileName)
   };
@@ -17937,7 +18691,7 @@ var backupRestoreRepair = {
     if (!candidates.length) {
       return [
         {
-          description: `no backups found under ${rel(ctx.root, path29.join(artifactsRoot(ctx.root), "backups"))}/`,
+          description: `no backups found under ${rel(ctx.root, path31.join(artifactsRoot(ctx.root), "backups"))}/`,
           touches: []
         }
       ];
@@ -17963,20 +18717,20 @@ var backupRestoreRepair = {
   async apply(ctx) {
     if (ctx.dryRun) return "dry-run \u2014 not applied";
     const picked = pickBackupFile(ctx);
-    const dest = path29.resolve(ctx.root, picked.dest);
-    const relDest = path29.relative(ctx.root, dest);
-    if (relDest.startsWith("..") || path29.isAbsolute(relDest)) {
+    const dest = path31.resolve(ctx.root, picked.dest);
+    const relDest = path31.relative(ctx.root, dest);
+    if (relDest.startsWith("..") || path31.isAbsolute(relDest)) {
       throw new Error(`restore target escapes root: ${picked.dest}`);
     }
-    mkdirSync5(path29.dirname(dest), { recursive: true });
-    writeFileAtomic(dest, readFileSync15(picked.src, "utf8"));
+    mkdirSync7(path31.dirname(dest), { recursive: true });
+    writeFileAtomic(dest, readFileSync17(picked.src, "utf8"));
     return `restored ${picked.rel} \u2192 ${relDest}`;
   },
   async verify(ctx) {
     try {
       const picked = pickBackupFile(ctx);
-      const dest = path29.resolve(ctx.root, picked.dest);
-      return existsSync18(dest) && readFileSync15(dest, "utf8") === readFileSync15(picked.src, "utf8");
+      const dest = path31.resolve(ctx.root, picked.dest);
+      return existsSync20(dest) && readFileSync17(dest, "utf8") === readFileSync17(picked.src, "utf8");
     } catch {
       return false;
     }
@@ -18006,11 +18760,11 @@ function classifyFindings(checks) {
 }
 
 // src/heal/flow.ts
-import { mkdirSync as mkdirSync6 } from "fs";
-import path30 from "path";
+import { mkdirSync as mkdirSync8 } from "fs";
+import path32 from "path";
 function healReceiptPath(root, generatedAt) {
   const stamp = generatedAt.replace(/[:.]/g, "-");
-  return path30.join(artifactsRoot(root), "receipts", `heal-${stamp}.json`);
+  return path32.join(artifactsRoot(root), "receipts", `heal-${stamp}.json`);
 }
 async function planRepairs(checks, opts) {
   const classified = classifyFindings(checks);
@@ -18144,7 +18898,7 @@ async function runHealFlow(checks, opts) {
     verifiedAll: entries.every((e) => e.verified === true)
   };
   const file = healReceiptPath(opts.root, generatedAt);
-  mkdirSync6(path30.dirname(file), { recursive: true });
+  mkdirSync8(path32.dirname(file), { recursive: true });
   writeFileAtomic(file, redactSecrets(JSON.stringify(receipt, null, 2)));
   return receipt;
 }
@@ -18227,46 +18981,1056 @@ async function runDoctor2Command(cli) {
   return runHealCommand({ ...cli, plan: cli.plan });
 }
 
-// src/lifecycle.ts
-import { copyFileSync as copyFileSync3, existsSync as existsSync19, mkdirSync as mkdirSync7, readdirSync as readdirSync8, rmSync as rmSync4 } from "fs";
-import path31 from "path";
-function configFilesToBackup(repoDir) {
-  const out = /* @__PURE__ */ new Set();
-  if (existsSync19(path31.join(repoDir, ".env"))) out.add(".env");
-  for (const file of readdirSync8(repoDir)) {
-    if (file === ".env.example" || !file.includes(".example.")) continue;
-    const real = file.replace(".example.", ".");
-    if (existsSync19(path31.join(repoDir, real))) out.add(real);
-  }
-  return [...out];
-}
-async function planUninstall(targetDir, repo) {
-  const dir = resolveInside(targetDir, repo.name);
-  if (!dir)
-    return { kind: "refused", dir: path31.join(targetDir, repo.name), reason: "invalid-name" };
-  if (isLinkOrJunction(dir)) return { kind: "refused", dir, reason: "symlink" };
-  if (!existsSync19(dir)) return { kind: "absent", dir };
-  if (!hasGitRepo(dir)) return { kind: "refused", dir, reason: "non-git" };
-  const remote = await commandOutput("git", ["-C", dir, "remote", "get-url", "origin"]);
-  if (remote && remote !== "ok" && !sameRemote(remote, repo.url)) {
-    return { kind: "refused", dir, reason: "remote-mismatch" };
-  }
-  if (await isGitDirty(dir)) return { kind: "refused", dir, reason: "dirty" };
-  return { kind: "ready", dir, backups: configFilesToBackup(dir) };
-}
-function executeUninstall(targetDir, repo, plan) {
-  const expected = resolveInside(targetDir, repo.name);
+// src/cmd/registry.ts
+import path33 from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9 } from "fs";
+
+// src/registry/catalog.ts
+var REGISTRY_PACKAGES = [
+  {
+    name: "the-forge",
+    dist: "theforge-core",
+    bin: "theforge",
+    minPython: "3.11",
+    origin: "official"
+  },
+  {
+    name: "api-forge",
+    dist: "apiforge-af",
+    bin: "apiforge",
+    minPython: "3.12",
+    mcp: ["{binDir}/apiforge-mcp"],
+    origin: "official"
+  },
+  {
+    name: "platform-forge",
+    dist: "platformforge",
+    bin: "platformforge",
+    minPython: "3.10",
+    mcp: ["{binDir}/platformforge-mcp"],
+    origin: "official"
+  },
+  {
+    name: "spark-forge-aws",
+    dist: "sparkforge-aws",
+    bin: "sparkforge-aws",
+    minPython: "3.10",
+    mcp: ["{bin}", "mcp", "serve"],
+    origin: "official"
+  },
+  {
+    name: "spark-forge-azure",
+    dist: "sparkforge-azure",
+    bin: "sparkforge-azure",
+    minPython: "3.10",
+    mcp: ["{bin}", "mcp", "serve"],
+    origin: "official"
+  },
+  {
+    name: "forge-doctor-data",
+    dist: "forge-doctor-data",
+    bin: "forge-doctor-data",
+    minPython: "3.11",
+    mcp: ["{bin}", "mcp"],
+    origin: "official"
+  },
+  {
+    name: "forge-doctor-api",
+    dist: "forge-doctor-api",
+    bin: "forge-doctor-api",
+    minPython: "3.11",
+    mcp: ["{bin}", "mcp"],
+    origin: "official"
+  }
+];
+var BY_NAME = new Map(REGISTRY_PACKAGES.map((e) => [e.name, e]));
+var BY_DIST = new Map(REGISTRY_PACKAGES.map((e) => [e.dist, e]));
+function registryEntry(nameOrDist) {
+  return BY_NAME.get(nameOrDist) ?? BY_DIST.get(nameOrDist) ?? null;
+}
+function registryNames() {
+  return REGISTRY_PACKAGES.map((e) => e.name);
+}
+
+// src/cmd/registry.ts
+async function probePythons(platform2 = process.platform, probe = commandOutput) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c4 of pythonCandidates(platform2)) {
+    const raw = await probe(c4.exe, [...c4.args, "--version"]);
+    const m3 = raw?.match(/Python\s+(\d+\.\d+\.\d+(?:[a-z]+\d+)?)/);
+    if (!m3) continue;
+    const parsed = parseVersion2(m3[1]);
+    if (!parsed || seen.has(m3[1])) continue;
+    seen.add(m3[1]);
+    out.push({ exe: [c4.exe, ...c4.args], version: m3[1], parsed });
+  }
+  out.sort((a3, b) => compareVersions3(b.parsed, a3.parsed));
+  return out;
+}
+function describeResolveError(e) {
+  switch (e.kind) {
+    case "not-found":
+      return `dist ${e.dist} n\xE3o existe no PyPI`;
+    case "version-not-found":
+      return `${e.dist}==${e.requested} n\xE3o existe \u2014 dispon\xEDveis: ${e.available.slice(-5).join(", ")}`;
+    case "python-incompatible":
+      return `${e.dist} ${e.version} exige python ${e.requires} (detectado ${e.have})`;
+    case "specifier-unknown":
+      return `${e.dist} ${e.version}: requires_python fora do subconjunto suportado (${e.requires})`;
+    case "offline-miss":
+      return `${e.dist}: sem cache local e --offline ativo \u2014 rode online uma vez`;
+    case "malformed":
+      return `${e.dist}: metadados fora do formato esperado (${e.detail})`;
+    case "network":
+      return `rede/PyPI: ${e.detail}`;
+  }
+}
+function describeInstallError(e) {
+  if (e.stage === "resolve") return describeResolveError(e.error);
+  if (e.stage === "offline-missing-artifact") return `${S.registryOfflineMissing}: ${e.detail}`;
+  if (e.stage === "hash-mismatch") return `${S.registryHashMismatch}: ${e.detail}`;
+  if (e.stage === "already-installed") return e.detail;
+  return `${e.stage}: ${e.detail}`;
+}
+function registryCacheDir(home = cliHome()) {
+  return path33.join(home, ".forge-cli", "cache", "pypi");
+}
+var REGISTRY_IGNORED_FLAGS = [
+  ["dir", "--dir"],
+  // --profile/--scope/--components/--host/--gateway-profile/--native são
+  // honrados via delegação ao instalador nativo da Forja (fase 2).
+  ["skipVerify", "--skip-verify"],
+  ["skipScripts", "--skip-scripts"],
+  ["retryFailed", "--retry-failed"],
+  ["shallow", "--shallow"],
+  ["fix", "--fix"],
+  ["rollback", "--rollback"],
+  ["trustCustom", "--trust-custom"],
+  ["runAfterSyncFailure", "--run-after-sync-failure"],
+  ["onlyChanged", "--only-changed"],
+  ["verbose", "--verbose"]
+];
+function ignoredRegistryFlags(cli) {
+  const out = [];
+  for (const [key, label] of REGISTRY_IGNORED_FLAGS) {
+    if (cli[key] === void 0 || cli[key] === false) continue;
+    out.push(label);
+  }
+  if (cli.timeoutSet) out.push("--timeout");
+  if (cli.jobsSet) out.push("--jobs");
+  return out;
+}
+function registryQuiet(cli) {
+  return cli.jsonReport && cli.reportPath === void 0;
+}
+function validateRegistryNativeFlags(cli) {
+  return validateNativeOptions({
+    profile: cli.profile,
+    scope: cli.scope,
+    components: cli.components,
+    host: cli.host,
+    gatewayProfile: cli.gatewayProfile
+  });
+}
+async function delegateNative(cli, entry2, receipt, op, run = execaRun) {
+  const wants = cli.native || hasNativeRequest({
+    profile: cli.profile,
+    scope: cli.scope,
+    components: cli.components,
+    host: cli.host,
+    gatewayProfile: cli.gatewayProfile
+  });
+  if (!wants) return void 0;
+  const repo = FORGE_REPOS.find((r2) => r2.name === entry2.name);
+  const built = repo && (op === "install" ? buildNativeInstall(repo, {
+    profile: cli.profile,
+    scope: cli.scope,
+    components: cli.components,
+    host: cli.host,
+    gatewayProfile: cli.gatewayProfile,
+    approve: cli.yes
+  }) : buildNativeOp(repo, "update", cli.yes ?? false));
+  if (!built) {
+    return { argv: [], ran: false, skipped: "sem instalador nativo documentado" };
+  }
+  if (built.argv[0] === "{python}") {
+    return {
+      argv: built.argv,
+      ran: false,
+      skipped: "instalador por script do reposit\xF3rio (scripts/forge_install.py) \u2014 indispon\xEDvel no m\xE9todo registry"
+    };
+  }
+  const argv = [receipt.bin, ...built.argv.slice(1)];
+  const res = await run(argv[0], argv.slice(1));
+  const ignored = "ignored" in built ? built.ignored : [];
+  return {
+    argv,
+    ran: true,
+    dryRun: built.dryRun,
+    exitCode: res.exitCode,
+    ...ignored.length ? { ignored } : {}
+  };
+}
+function persistReceipt(home, receipt) {
+  writeFileAtomic(receiptPath(home, receipt.forge), `${JSON.stringify(receipt, null, 2)}
+`);
+  const state = loadForgeState(home);
+  if (Object.hasOwn(state.forges, receipt.forge)) {
+    state.forges[receipt.forge] = receipt;
+    saveForgeState(home, state);
+  }
+}
+function writeRegistryReport(reportPath, doc) {
+  const file = path33.resolve(reportPath);
+  mkdirSync9(path33.dirname(file), { recursive: true });
+  writeFileAtomic(file, redactSecrets(JSON.stringify(doc, null, 2)));
+}
+async function runRegistryInstall(cli, names, deps = {}) {
+  const home = deps.home ?? cliHome();
+  const quiet = registryQuiet(cli);
+  const reportTo = (doc2) => {
+    if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, doc2);
+  };
+  const entries = names.map((n4) => ({ name: n4, entry: registryEntry(n4) }));
+  const unknown = entries.filter((e) => !e.entry);
+  for (const e of entries) if (e.entry) e.name = e.entry.name;
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = entries.filter((e) => {
+    const key = e.entry?.name ?? e.name;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  if (unknown.length) {
+    const msg = `${unknown.map((u4) => u4.name).join(", ")}: sem dist no cat\xE1logo registry \u2014 use o m\xE9todo git`;
+    reportTo({ error: msg });
+    if (quiet) emitJson({ error: msg }, 2);
+    log.error(msg);
+    process.exit(2);
+  }
+  const ignored = ignoredRegistryFlags(cli);
+  const warnings = ignored.length ? [`${S.registryIgnoredFlags}: ${ignored.join(", ")}`] : [];
+  if (warnings.length && !quiet) log.warn(warnings[0]);
+  const nativeErr = validateRegistryNativeFlags(cli);
+  if (nativeErr) {
+    reportTo({ error: nativeErr, warnings });
+    if (quiet) emitJson({ error: nativeErr, warnings }, 1);
+    log.error(nativeErr);
+    process.exit(1);
+    return [];
+  }
+  const pin = cli.ref?.replace(/^v(?=\d)/, "");
+  const pythons = deps.pythons ?? await probePythons();
+  if (!pythons.length) {
+    const msg = "Nenhum interpretador Python detectado \u2014 instale Python \u22653.10";
+    reportTo({ error: msg, warnings });
+    if (quiet) emitJson({ error: msg, warnings }, 1);
+    log.error(msg);
+    process.exit(1);
+  }
+  if (!quiet) log.info(`Python detectado: ${pythons.map((p) => p.version).join(", ")}`);
+  if (cli.plan || cli.check) {
+    const planned = [];
+    for (const { name, entry: entry2 } of deduped) {
+      const resolved = await resolveRelease(entry2.dist, {
+        pin,
+        offline: cli.offline,
+        cacheDir: registryCacheDir(home),
+        fetchImpl: deps.fetchImpl,
+        ephemeral: true
+        // P0-002: plan não persiste nem cache
+      });
+      if ("kind" in resolved) {
+        planned.push({ forge: name, ok: false, detail: describeResolveError(resolved) });
+        continue;
+      }
+      const picked = selectInterpreter(entry2, resolved, pythons);
+      if ("error" in picked) {
+        planned.push({ forge: name, ok: false, detail: describeResolveError(picked.error) });
+        continue;
+      }
+      planned.push({
+        forge: name,
+        ok: true,
+        dist: entry2.dist,
+        version: resolved.version,
+        requiresPython: resolved.requiresPython,
+        python: picked.python.version,
+        venv: forgeVenv(home, name),
+        wheels: wheelCacheDir(registryCacheDir(home), entry2.dist),
+        source: resolved.source,
+        staleCache: resolved.staleCache,
+        yanked: resolved.yanked
+      });
+    }
+    const planDoc = { method: "pypi", plan: true, planned, warnings };
+    reportTo(planDoc);
+    if (quiet) {
+      emitJson(planDoc, planned.every((p) => p.ok) ? 0 : 1);
+    }
+    note(
+      planned.map(
+        (p) => p.ok ? `${p.forge} \u2192 ${p.dist}==${p.version} (python ${p.python}, venv ${p.venv})` : `${p.forge} \u2192 falhou: ${p.detail}`
+      ).join("\n"),
+      // venv/receipt/state não são escritos; o cache de metadados do
+      // PyPI pode ser atualizado (mesma regra de `update --check`).
+      "Plano (venv e estado n\xE3o alterados)"
+    );
+    if (planned.some((p) => !p.ok)) process.exit(1);
+    outro(`${icons.ok} plano resolvido \u2014 execute sem --plan para instalar`);
+    return planned.map((p) => ({
+      forge: p.forge,
+      ok: p.ok,
+      detail: p.ok ? "planned" : p.detail ?? "falhou",
+      version: p.version
+    }));
+  }
+  if (!quiet && !cli.yes && process.stdout.isTTY && process.stdin.isTTY) {
+    const lines = [];
+    for (const { name, entry: entry2 } of deduped) {
+      const r2 = await resolveRelease(entry2.dist, {
+        pin,
+        offline: cli.offline,
+        cacheDir: registryCacheDir(home),
+        fetchImpl: deps.fetchImpl
+      });
+      lines.push(
+        "kind" in r2 ? `${name} \u2192 ${entry2.dist} (${describeResolveError(r2)})` : `${name} \u2192 ${r2.dist}==${r2.version} (venv isolada em ${forgeVenv(home, name)})`
+      );
+    }
+    note(lines.join("\n"), "Instala\xE7\xE3o registry-first");
+    const answer = await confirm({ message: S.confirmRun });
+    if (isCancel(answer) || !answer) {
+      if (isCancel(answer)) exitCancelled();
+      log.warn("Nada foi instalado.");
+      process.exit(0);
+      return [];
+    }
+  }
+  const results = [];
+  for (const { name, entry: entry2 } of deduped) {
+    const spin = spinner();
+    if (!quiet) spin.start(`${name}: resolvendo ${entry2.dist}\u2026`);
+    const receipt = await registryInstall(entry2, pin, {
+      home,
+      cacheDir: registryCacheDir(home),
+      offline: cli.offline,
+      pythons,
+      clean: cli.clean,
+      fetchImpl: deps.fetchImpl,
+      run: deps.run
+    });
+    if ("stage" in receipt) {
+      if (!quiet) spin.stop(`${name}: ${theme.err("falhou")}`);
+      results.push({ forge: name, ok: false, detail: describeInstallError(receipt) });
+      continue;
+    }
+    receipt.native = await delegateNative(cli, entry2, receipt, "install", deps.run);
+    if (receipt.native) {
+      persistReceipt(home, receipt);
+      const n4 = receipt.native;
+      if (!quiet) {
+        if (n4.skipped) log.warn(`${name}: ${n4.skipped}`);
+        else if (n4.exitCode !== 0) log.warn(`${name}: instalador nativo saiu ${n4.exitCode}`);
+        else
+          log.info(`${name}: nativo ${n4.dryRun ? "(dry-run)" : "aplicado"} \u2014 ${n4.argv.join(" ")}`);
+      }
+      if (n4.skipped) warnings.push(`${name}: ${n4.skipped}`);
+      if (n4.ran && n4.exitCode !== 0) warnings.push(`${name}: instalador nativo saiu ${n4.exitCode}`);
+    }
+    if (receipt.staleCache) {
+      const w = `${S.registryStaleCache} (${entry2.dist})`;
+      warnings.push(w);
+      if (!quiet) log.warn(w);
+    }
+    if (!quiet) {
+      spin.stop(
+        `${name}: ${theme.ok("instalado")} ${theme.dim(`${receipt.dist}==${receipt.version}`)}`
+      );
+    }
+    results.push({
+      forge: name,
+      ok: true,
+      version: receipt.version,
+      detail: `${receipt.dist}==${receipt.version} em ${receipt.venv}`,
+      ...receipt.native ? { native: receipt.native } : {}
+    });
+  }
+  const doc = { method: "pypi", results, warnings };
+  reportTo(doc);
+  if (cli.reportPath !== void 0) {
+    log.info(`${S.reportSaved}: ${theme.dim(path33.resolve(cli.reportPath))}`);
+  }
+  if (quiet) {
+    emitJson(doc, results.every((r2) => r2.ok) ? 0 : 1);
+  }
+  for (const r2 of results) {
+    if (!r2.ok) log.error(`${r2.forge}: ${r2.detail}`);
+  }
+  if (results.some((r2) => !r2.ok)) process.exit(1);
+  const bins = results.map((r2) => {
+    const inst = loadForgeState(home).forges[r2.forge];
+    return inst ? `${r2.forge} \u2192 ${inst.bin}` : "";
+  });
+  note(bins.filter(Boolean).join("\n"), "Para usar, adicione ao PATH ou invoque o caminho");
+  outro(`${icons.ok} instala\xE7\xE3o registry-first conclu\xEDda`);
+  return results;
+}
+function runRegistryList(cli, deps = {}) {
+  const home = deps.home ?? cliHome();
+  const state = loadForgeState(home);
+  const wanted = deps.names?.length ? new Set(deps.names.map((n4) => registryEntry(n4)?.name).filter((n4) => Boolean(n4))) : null;
+  if (deps.names?.length) {
+    const bad = deps.names.filter((n4) => !registryEntry(n4));
+    if (bad.length) {
+      const msg = `${bad.join(", ")}: fora do cat\xE1logo registry`;
+      if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, { error: msg });
+      if (registryQuiet(cli)) emitJson({ error: msg }, 2);
+      log.error(msg);
+      process.exit(2);
+    }
+  }
+  const rows = REGISTRY_PACKAGES.filter((e) => !wanted || wanted.has(e.name)).map((e) => {
+    const inst = state.forges[e.name];
+    const binOk = inst ? typeof inst.bin === "string" && existsSync21(inst.bin) : null;
+    return {
+      forge: e.name,
+      dist: e.dist,
+      installed: inst?.version ?? null,
+      method: inst?.method ?? null,
+      verifyOk: inst ? inst.verify?.ok ?? null : null,
+      binPresent: binOk,
+      bin: inst ? binOk ? inst.bin : `${inst.bin ?? "?"} (ausente)` : null,
+      minPython: e.minPython
+    };
+  });
+  if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, { forges: rows });
+  if (registryQuiet(cli)) emitJson({ forges: rows });
+  note(
+    rows.map(
+      (r2) => `${r2.installed ? icons.ok : "\xB7"} ${r2.forge.padEnd(20)} ${r2.dist.padEnd(20)} ${(r2.installed ?? "\u2014") + (r2.installed && r2.verifyOk === false ? ` ${S.registryVerifyFailed}` : "")}`
+    ).join("\n"),
+    "Forjas (registry)"
+  );
+}
+function resolveRegistryTargets(cli, names, installed) {
+  if (names.length) return names;
+  if (cli.only?.length) return cli.only;
+  if (cli.all) return installed;
+  return [];
+}
+async function runRegistryUninstall(cli, names, deps = {}) {
+  const home = deps.home ?? cliHome();
+  const quiet = registryQuiet(cli);
+  const reportTo = (doc2) => {
+    if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, doc2);
+  };
+  const state = loadForgeState(home).forges;
+  const installed = Object.keys(state);
+  const targets = resolveRegistryTargets(cli, names, installed);
+  if (!targets.length) {
+    reportTo({ error: S.errRegistryUninstallNeedsNames });
+    if (quiet) emitJson({ error: S.errRegistryUninstallNeedsNames }, 2);
+    log.error(S.errRegistryUninstallNeedsNames);
+    process.exit(2);
+  }
+  const ignored = ignoredRegistryFlags(cli);
+  const warnings = ignored.length ? [`${S.registryIgnoredFlags}: ${ignored.join(", ")}`] : [];
+  if (warnings.length && !quiet) log.warn(warnings[0]);
+  const plan = [];
+  const unsafe = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of targets) {
+    const entry2 = registryEntry(raw);
+    const name = entry2?.name ?? raw;
+    if (!isSafeRepoName(name)) {
+      unsafe.push(raw);
+      continue;
+    }
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const receipt = Object.hasOwn(state, name) ? state[name] : void 0;
+    plan.push({
+      name,
+      dist: entry2?.dist ?? receipt?.dist,
+      known: Boolean(entry2 ?? receipt),
+      installed: installed.includes(name)
+    });
+  }
+  const unknown = [...plan.filter((p) => !p.known).map((p) => p.name), ...unsafe];
+  const errText = [
+    ...plan.filter((p) => !p.known).map((p) => `${p.name}: sem dist no cat\xE1logo registry`),
+    ...unsafe.map((u4) => `${u4}: nome inseguro no state \u2014 recusado (path traversal)`)
+  ].join(" | ");
+  const removals = plan.filter((p) => p.installed);
+  const skipped = plan.filter((p) => p.known && !p.installed).map((p) => p.name);
+  warnings.push(...skipped.map((n4) => `${n4}: n\xE3o estava instalado via registry \u2014 ignorado`));
+  if (!quiet) {
+    for (const u4 of plan.filter((p) => !p.known).map((p) => p.name))
+      log.error(`${u4}: sem dist no cat\xE1logo registry`);
+    for (const u4 of unsafe) log.error(`${u4}: nome inseguro no state \u2014 recusado (path traversal)`);
+    for (const w of warnings.slice(ignored.length ? 1 : 0)) log.warn(w);
+  }
+  if (!removals.length) {
+    const doc2 = {
+      method: "pypi",
+      removed: [],
+      skipped,
+      warnings,
+      ...errText ? { error: errText } : {}
+    };
+    reportTo(doc2);
+    if (quiet) emitJson(doc2, unknown.length ? 2 : 0);
+    if (unknown.length) process.exit(2);
+    log.info("Nada a remover.");
+    return;
+  }
+  if (!quiet) {
+    note(
+      removals.map((r2) => `${r2.name} \u2192 ${r2.dist ?? "?"} (venv + wheel cache + receipt em ~/.forge-cli/)`).join("\n"),
+      S.registryUninstallConfirm
+    );
+  }
+  if (!cli.yes) {
+    const needYesDoc = {
+      error: S.registryUninstallNeedsYes,
+      planned: removals.map((r2) => r2.name),
+      skipped,
+      warnings
+    };
+    if (quiet) {
+      emitJson(needYesDoc, 2);
+    }
+    if (!(process.stdin.isTTY && process.stdout.isTTY)) {
+      reportTo(needYesDoc);
+      log.warn(S.registryUninstallNeedsYes);
+      process.exit(0);
+      return;
+    }
+    const answer = await confirm({ message: S.registryUninstallConfirm });
+    if (isCancel(answer) || !answer) {
+      if (isCancel(answer)) exitCancelled();
+      reportTo(needYesDoc);
+      log.warn(S.registryUninstallNeedsYes);
+      process.exit(0);
+      return;
+    }
+  }
+  const results = [];
+  for (const r2 of removals) {
+    let native;
+    if (cli.native) {
+      const repo = FORGE_REPOS.find((x) => x.name === r2.name);
+      const receipt = Object.hasOwn(state, r2.name) ? state[r2.name] : void 0;
+      const op = repo && buildNativeOp(repo, "uninstall", cli.yes ?? false);
+      if (!op) {
+        native = { argv: [], ran: false, skipped: "sem op nativa de uninstall documentada" };
+      } else if (op.argv[0] === "{python}" || !receipt) {
+        native = {
+          argv: op.argv,
+          ran: false,
+          skipped: "op nativa por script do reposit\xF3rio \u2014 indispon\xEDvel no m\xE9todo registry"
+        };
+      } else {
+        const argv = [receipt.bin, ...op.argv.slice(1)];
+        const res2 = await (deps.run ?? execaRun)(argv[0], argv.slice(1));
+        native = { argv, ran: true, dryRun: op.dryRun, exitCode: res2.exitCode };
+        if (res2.exitCode !== 0) warnings.push(`${r2.name}: uninstall nativo saiu ${res2.exitCode}`);
+      }
+    }
+    const res = registryUninstall({ name: r2.name, dist: r2.dist }, { home });
+    if (res.refused) log.error(`${r2.name}: recusado \u2014 ${res.refused}`);
+    results.push({
+      forge: r2.name,
+      removed: res.removed,
+      cacheRemoved: res.cacheRemoved,
+      ...native ? { native } : {}
+    });
+  }
+  const doc = {
+    method: "pypi",
+    results,
+    skipped,
+    warnings,
+    ...errText ? { error: errText } : {}
+  };
+  reportTo(doc);
+  if (quiet) emitJson(doc, unknown.length ? 2 : 0);
+  for (const r2 of results) {
+    if (r2.removed) log.success(`${r2.forge}: removido`);
+  }
+  if (unknown.length) process.exit(2);
+}
+function entryFor(name, receipt) {
+  return registryEntry(name) ?? ghostEntry(name, receipt);
+}
+function lifecycleTargets(cli, names, home) {
+  const state = loadForgeState(home).forges;
+  const targets = resolveRegistryTargets(cli, names, Object.keys(state));
+  const ok = [];
+  const unknown = [];
+  const skipped = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of targets) {
+    const entry2 = registryEntry(raw);
+    const name = entry2?.name ?? raw;
+    if (!isSafeRepoName(name) || seen.has(name)) {
+      if (!seen.has(name) && !isSafeRepoName(name)) unknown.push(raw);
+      continue;
+    }
+    seen.add(name);
+    const receipt = Object.hasOwn(state, name) ? state[name] : void 0;
+    if (!receipt) {
+      if (entry2) skipped.push(name);
+      else unknown.push(name);
+      continue;
+    }
+    ok.push({ name, receipt });
+  }
+  return { ok, unknown, skipped };
+}
+async function runRegistryLifecycle(cli, names, deps) {
+  const home = deps.home ?? cliHome();
+  const quiet = registryQuiet(cli);
+  const reportTo = (doc2) => {
+    if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, doc2);
+  };
+  const { ok: targets, unknown, skipped } = lifecycleTargets(cli, names, home);
+  if (!targets.length && !skipped.length && !unknown.length) {
+    const msg = "nenhuma Forja instalada via registry \u2014 nada a atualizar";
+    reportTo({ error: msg });
+    if (quiet) emitJson({ error: msg }, 2);
+    log.error(msg);
+    process.exit(2);
+    return;
+  }
+  const ignored = ignoredRegistryFlags(cli);
+  const warnings = [
+    ...skipped.map((n4) => `${n4}: n\xE3o estava instalado via registry \u2014 ignorado`),
+    ...ignored.length ? [`${S.registryIgnoredFlags}: ${ignored.join(", ")}`] : []
+  ];
+  const pinVersion2 = cli.ref?.replace(/^v(?=\d)/, "");
+  const isCheck = cli.plan || cli.check;
+  const items = [];
+  for (const t2 of targets) {
+    const entry2 = entryFor(t2.name, t2.receipt);
+    if (t2.receipt.pinned && !pinVersion2) {
+      items.push({
+        ...t2,
+        entry: entry2,
+        action: "update",
+        from: t2.receipt.version,
+        detail: `${S.registryPinnedAt} ${t2.receipt.pinned}`
+      });
+      continue;
+    }
+    const resolved = await resolveRelease(entry2.dist, {
+      pin: pinVersion2,
+      offline: cli.offline,
+      cacheDir: registryCacheDir(home),
+      fetchImpl: deps.fetchImpl,
+      ephemeral: isCheck
+      // P0-002: update --check não persiste nem cache
+    });
+    if ("kind" in resolved) {
+      items.push({
+        ...t2,
+        entry: entry2,
+        action: "update",
+        from: t2.receipt.version,
+        detail: describeResolveError(resolved)
+      });
+      continue;
+    }
+    const same = resolved.version === t2.receipt.version;
+    items.push({
+      ...t2,
+      entry: entry2,
+      action: "update",
+      from: t2.receipt.version,
+      to: resolved.version,
+      detail: same ? "j\xE1 na mais recente" : void 0
+    });
+  }
+  if (isCheck) {
+    const doc2 = {
+      method: "pypi",
+      plan: true,
+      updates: items.map((i3) => ({
+        forge: i3.name,
+        from: i3.from,
+        to: i3.to ?? null,
+        status: i3.detail ?? "update"
+      })),
+      skipped,
+      warnings,
+      ...unknown.length ? { error: `${unknown.join(", ")}: sem dist no cat\xE1logo registry` } : {}
+    };
+    reportTo(doc2);
+    if (quiet) emitJson(doc2, unknown.length ? 2 : 0);
+    note(
+      items.map((i3) => `${i3.name}: ${i3.from} \u2192 ${i3.to ?? "\u2014"}${i3.detail ? ` (${i3.detail})` : ""}`).join("\n"),
+      "Plano de update"
+    );
+    if (unknown.length) process.exit(2);
+    return;
+  }
+  const actionable = items.filter((i3) => i3.to && i3.to !== i3.from);
+  if (!quiet) {
+    for (const i3 of items.filter((i4) => i4.detail)) log.warn(`${i3.name}: ${i3.detail}`);
+    for (const w of warnings) log.warn(w);
+    note(
+      actionable.length ? actionable.map((i3) => `${i3.name}: ${i3.from} \u2192 ${i3.to}`).join("\n") : "nada a atualizar",
+      "Update registry-first"
+    );
+  }
+  if (!actionable.length) {
+    const doc2 = {
+      method: "pypi",
+      updated: [],
+      skipped,
+      warnings,
+      ...unknown.length ? { error: `${unknown.join(", ")}: sem dist no cat\xE1logo registry` } : {}
+    };
+    reportTo(doc2);
+    if (quiet) emitJson(doc2, unknown.length ? 2 : skipped.length && !items.length ? 1 : 0);
+    if (!quiet) log.info("Nada a atualizar.");
+    if (unknown.length) process.exit(2);
+    if (skipped.length && !items.length) process.exit(1);
+    return;
+  }
+  if (!quiet && !cli.yes && process.stdout.isTTY && process.stdin.isTTY) {
+    const answer = await confirm({ message: S.confirmRun });
+    if (isCancel(answer) || !answer) {
+      if (isCancel(answer)) exitCancelled();
+      reportTo({ error: S.registryUninstallNeedsYes });
+      log.warn(S.registryUninstallNeedsYes);
+      process.exit(0);
+      return;
+    }
+  }
+  const pythons = deps.pythons ?? await probePythons();
+  const results = [];
+  const state = loadForgeState(home);
+  for (const i3 of actionable) {
+    const spin = spinner();
+    if (!quiet) spin.start(`${i3.name}: ${i3.from} \u2192 ${i3.to}\u2026`);
+    const receipt = await registryInstall(i3.entry, i3.to, {
+      home,
+      cacheDir: registryCacheDir(home),
+      offline: cli.offline,
+      pythons,
+      clean: true,
+      fetchImpl: deps.fetchImpl,
+      run: deps.run
+    });
+    if ("stage" in receipt) {
+      if (!quiet) spin.stop(`${i3.name}: ${theme.err("falhou")} (${describeInstallError(receipt)})`);
+      results.push({
+        forge: i3.name,
+        ok: false,
+        from: i3.from,
+        to: i3.to,
+        detail: describeInstallError(receipt)
+      });
+      continue;
+    }
+    const prev = state.forges[i3.name];
+    receipt.history = [
+      ...i3.receipt.history ?? [],
+      { version: i3.from, installedAt: i3.receipt.installedAt }
+    ];
+    receipt.pinned = prev?.pinned;
+    receipt.native = await delegateNative(cli, i3.entry, receipt, "update", deps.run);
+    if (receipt.native?.skipped) warnings.push(`${i3.name}: ${receipt.native.skipped}`);
+    if (receipt.native?.ran && receipt.native.exitCode !== 0)
+      warnings.push(`${i3.name}: instalador nativo saiu ${receipt.native.exitCode}`);
+    state.forges[i3.name] = receipt;
+    if (!quiet) spin.stop(`${i3.name}: ${theme.ok(`${i3.from} \u2192 ${i3.to}`)}`);
+    results.push({ forge: i3.name, ok: true, from: i3.from, to: i3.to, bin: receipt.bin });
+  }
+  saveForgeState(home, state);
+  const doc = {
+    method: "pypi",
+    updated: results,
+    skipped,
+    warnings,
+    ...unknown.length ? { error: `${unknown.join(", ")}: sem dist no cat\xE1logo registry` } : {}
+  };
+  reportTo(doc);
+  if (quiet) emitJson(doc, results.every((r2) => r2.ok) ? unknown.length ? 2 : 0 : 1);
+  if (results.some((r2) => !r2.ok)) process.exit(1);
+  if (unknown.length) process.exit(2);
+}
+async function runRegistryUpdate(cli, names, deps = {}) {
+  await runRegistryLifecycle(cli, names, deps);
+}
+async function runRegistryReinstall(cli, names, deps = {}) {
+  const home = deps.home ?? cliHome();
+  const quiet = registryQuiet(cli);
+  const reportTo = (doc2) => {
+    if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, doc2);
+  };
+  const { ok: targets, unknown, skipped } = lifecycleTargets(cli, names, home);
+  const ignored = ignoredRegistryFlags(cli);
+  const warnings = [
+    ...skipped.map((n4) => `${n4}: n\xE3o instalado via registry \u2014 ignorado`),
+    ...ignored.length ? [`${S.registryIgnoredFlags}: ${ignored.join(", ")}`] : []
+  ];
+  if (!targets.length) {
+    const msg = S.errRegistryReinstallNeedsNames;
+    reportTo({ error: msg, warnings, ...unknown.length ? { unknown } : {} });
+    if (quiet) emitJson({ error: msg, warnings, unknown }, unknown.length ? 2 : 1);
+    log.error(msg);
+    process.exit(unknown.length ? 2 : 1);
+    return;
+  }
+  if (cli.plan || cli.check) {
+    const doc2 = {
+      method: "pypi",
+      plan: true,
+      reinstalls: targets.map((t2) => ({ forge: t2.name, version: t2.receipt.version })),
+      skipped,
+      warnings
+    };
+    reportTo(doc2);
+    if (quiet) emitJson(doc2, 0);
+    note(
+      targets.map((t2) => `${t2.name}==${t2.receipt.version} (reinstall limpo)`).join("\n"),
+      "Plano de reinstall"
+    );
+    return;
+  }
+  const pythons = deps.pythons ?? await probePythons();
+  const results = [];
+  const state = loadForgeState(home);
+  for (const t2 of targets) {
+    const spin = spinner();
+    if (!quiet) spin.start(`${t2.name}: reinstall ${t2.receipt.version}\u2026`);
+    const receipt = await registryInstall(entryFor(t2.name, t2.receipt), t2.receipt.version, {
+      home,
+      cacheDir: registryCacheDir(home),
+      offline: cli.offline,
+      pythons,
+      clean: true,
+      fetchImpl: deps.fetchImpl,
+      run: deps.run
+    });
+    if ("stage" in receipt) {
+      if (!quiet) spin.stop(`${t2.name}: ${theme.err("falhou")} (${describeInstallError(receipt)})`);
+      results.push({ forge: t2.name, ok: false, detail: describeInstallError(receipt) });
+      continue;
+    }
+    receipt.pinned = t2.receipt.pinned;
+    receipt.history = t2.receipt.history;
+    receipt.native = await delegateNative(
+      cli,
+      entryFor(t2.name, t2.receipt),
+      receipt,
+      "update",
+      deps.run
+    );
+    if (receipt.native?.skipped) warnings.push(`${t2.name}: ${receipt.native.skipped}`);
+    if (receipt.native?.ran && receipt.native.exitCode !== 0)
+      warnings.push(`${t2.name}: instalador nativo saiu ${receipt.native.exitCode}`);
+    state.forges[t2.name] = receipt;
+    if (!quiet) spin.stop(`${t2.name}: ${theme.ok("reinstalado")} (${receipt.version})`);
+    results.push({ forge: t2.name, ok: true, version: receipt.version, bin: receipt.bin });
+  }
+  saveForgeState(home, state);
+  const doc = {
+    method: "pypi",
+    reinstalled: results,
+    skipped,
+    warnings,
+    ...unknown.length ? { error: `${unknown.join(", ")}: sem dist no cat\xE1logo registry` } : {}
+  };
+  reportTo(doc);
+  if (quiet) emitJson(doc, results.every((r2) => r2.ok) ? unknown.length ? 2 : 0 : 1);
+  if (results.some((r2) => !r2.ok)) process.exit(1);
+  if (unknown.length) process.exit(2);
+}
+async function runRegistryRollback(cli, names, deps = {}) {
+  const home = deps.home ?? cliHome();
+  const quiet = registryQuiet(cli);
+  const reportTo = (doc2) => {
+    if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, doc2);
+  };
+  const { ok: targets, unknown, skipped } = lifecycleTargets(cli, names, home);
+  const ignored = ignoredRegistryFlags(cli);
+  const warnings = [
+    ...skipped.map((n4) => `${n4}: n\xE3o instalado via registry \u2014 ignorado`),
+    ...ignored.length ? [`${S.registryIgnoredFlags}: ${ignored.join(", ")}`] : []
+  ];
+  const plan = targets.map((t2) => {
+    const prev = t2.receipt.history?.at(-1);
+    return {
+      name: t2.name,
+      receipt: t2.receipt,
+      to: prev?.version,
+      detail: prev ? void 0 : S.rollbackNoPrevious
+    };
+  });
+  const actionable = plan.filter((p) => p.to);
+  if (cli.plan || cli.check) {
+    const doc2 = {
+      method: "pypi",
+      plan: true,
+      rollbacks: plan.map((p) => ({
+        forge: p.name,
+        from: p.receipt.version,
+        to: p.to ?? null,
+        status: p.detail ?? "rollback"
+      })),
+      skipped,
+      warnings
+    };
+    reportTo(doc2);
+    if (quiet) emitJson(doc2, 0);
+    note(
+      plan.map(
+        (p) => `${p.name}: ${p.receipt.version} \u2192 ${p.to ?? "\u2014"}${p.detail ? ` (${p.detail})` : ""}`
+      ).join("\n"),
+      "Plano de rollback"
+    );
+    return;
+  }
+  if (!actionable.length) {
+    const msg = targets.length ? `${S.rollbackNoPrevious} \u2014 ${targets.map((t2) => t2.name).join(", ")}` : S.errRegistryRollbackNeedsNames;
+    reportTo({ error: msg, warnings, ...unknown.length ? { unknown } : {} });
+    if (quiet) emitJson({ error: msg, warnings, unknown }, 1);
+    log.error(msg);
+    process.exit(1);
+    return;
+  }
+  const pythons = deps.pythons ?? await probePythons();
+  const results = [];
+  const state = loadForgeState(home);
+  for (const p of actionable) {
+    const spin = spinner();
+    if (!quiet) spin.start(`${p.name}: ${p.receipt.version} \u2192 ${p.to}\u2026`);
+    const receipt = await registryInstall(entryFor(p.name, p.receipt), p.to, {
+      home,
+      cacheDir: registryCacheDir(home),
+      offline: cli.offline,
+      pythons,
+      clean: true,
+      fetchImpl: deps.fetchImpl,
+      run: deps.run
+    });
+    if ("stage" in receipt) {
+      if (!quiet) spin.stop(`${p.name}: ${theme.err("falhou")} (${describeInstallError(receipt)})`);
+      results.push({ forge: p.name, ok: false, detail: describeInstallError(receipt) });
+      continue;
+    }
+    const rest = (p.receipt.history ?? []).slice(0, -1);
+    receipt.history = [...rest, { version: p.receipt.version, installedAt: p.receipt.installedAt }];
+    receipt.pinned = p.receipt.pinned;
+    state.forges[p.name] = receipt;
+    if (!quiet) spin.stop(`${p.name}: ${theme.ok(`${p.receipt.version} \u2192 ${p.to}`)}`);
+    results.push({ forge: p.name, ok: true, from: p.receipt.version, to: p.to, bin: receipt.bin });
+  }
+  saveForgeState(home, state);
+  const doc = {
+    method: "pypi",
+    rolledBack: results,
+    skipped,
+    warnings,
+    ...unknown.length ? { error: `${unknown.join(", ")}: sem dist no cat\xE1logo registry` } : {}
+  };
+  reportTo(doc);
+  if (quiet) emitJson(doc, results.every((r2) => r2.ok) ? unknown.length ? 2 : 0 : 1);
+  if (results.some((r2) => !r2.ok)) process.exit(1);
+  if (unknown.length) process.exit(2);
+}
+async function runRegistryPin(cli, names, pin, deps = {}) {
+  const home = deps.home ?? cliHome();
+  const quiet = registryQuiet(cli);
+  const reportTo = (doc2) => {
+    if (cli.reportPath !== void 0) writeRegistryReport(cli.reportPath, doc2);
+  };
+  const { ok: targets, unknown, skipped } = lifecycleTargets(cli, names, home);
+  const ignored = ignoredRegistryFlags(cli);
+  const warnings = [
+    ...skipped.map((n4) => `${n4}: n\xE3o instalado via registry \u2014 ignorado`),
+    ...ignored.length ? [`${S.registryIgnoredFlags}: ${ignored.join(", ")}`] : []
+  ];
+  if (!targets.length) {
+    const msg = pin ? S.errRegistryPinNeedsNames : S.errRegistryUnpinNeedsNames;
+    reportTo({ error: msg, warnings, unknown });
+    if (quiet) emitJson({ error: msg, warnings, unknown }, unknown.length ? 2 : 1);
+    log.error(msg);
+    process.exit(unknown.length ? 2 : 1);
+    return;
+  }
+  const state = loadForgeState(home);
+  const done = [];
+  for (const t2 of targets) {
+    if (pin) {
+      state.forges[t2.name].pinned = t2.receipt.version;
+      done.push({ forge: t2.name, pinned: t2.receipt.version });
+    } else {
+      delete state.forges[t2.name].pinned;
+      done.push({ forge: t2.name, pinned: null });
+    }
+  }
+  saveForgeState(home, state);
+  const doc = {
+    method: "pypi",
+    [pin ? "pinned" : "unpinned"]: done,
+    skipped,
+    warnings,
+    ...unknown.length ? { error: `${unknown.join(", ")}: sem dist no cat\xE1logo registry` } : {}
+  };
+  reportTo(doc);
+  if (quiet) emitJson(doc, unknown.length ? 2 : 0);
+  for (const d of done) {
+    log.success(pin ? `${d.forge}: ${S.pinDone} ${d.pinned}` : `${d.forge}: ${S.unpinDone}`);
+  }
+  if (unknown.length) process.exit(2);
+}
+
+// src/lifecycle.ts
+import { copyFileSync as copyFileSync3, existsSync as existsSync22, mkdirSync as mkdirSync10, readdirSync as readdirSync9, rmSync as rmSync5 } from "fs";
+import path34 from "path";
+function configFilesToBackup(repoDir) {
+  const out = /* @__PURE__ */ new Set();
+  if (existsSync22(path34.join(repoDir, ".env"))) out.add(".env");
+  for (const file of readdirSync9(repoDir)) {
+    if (file === ".env.example" || !file.includes(".example.")) continue;
+    const real = file.replace(".example.", ".");
+    if (existsSync22(path34.join(repoDir, real))) out.add(real);
+  }
+  return [...out];
+}
+async function planUninstall(targetDir, repo) {
+  const dir = resolveInside(targetDir, repo.name);
+  if (!dir)
+    return { kind: "refused", dir: path34.join(targetDir, repo.name), reason: "invalid-name" };
+  if (isLinkOrJunction(dir)) return { kind: "refused", dir, reason: "symlink" };
+  if (!existsSync22(dir)) return { kind: "absent", dir };
+  if (!hasGitRepo(dir)) return { kind: "refused", dir, reason: "non-git" };
+  const remote = await commandOutput("git", ["-C", dir, "remote", "get-url", "origin"]);
+  if (remote && remote !== "ok" && !sameRemote(remote, repo.url)) {
+    return { kind: "refused", dir, reason: "remote-mismatch" };
+  }
+  if (await isGitDirty(dir)) return { kind: "refused", dir, reason: "dirty" };
+  return { kind: "ready", dir, backups: configFilesToBackup(dir) };
+}
+function executeUninstall(targetDir, repo, plan) {
+  const expected = resolveInside(targetDir, repo.name);
   if (!expected || expected !== plan.dir) throw new Error("plano de remo\xE7\xE3o inconsistente");
   let backupDir = null;
   if (plan.backups.length) {
-    backupDir = path31.join(artifactsRoot(targetDir), "backups", `${repo.name}-${Date.now()}`);
+    backupDir = path34.join(artifactsRoot(targetDir), "backups", `${repo.name}-${Date.now()}`);
     for (const file of plan.backups) {
-      const dest = path31.join(backupDir, file);
-      mkdirSync7(path31.dirname(dest), { recursive: true });
-      copyFileSync3(path31.join(plan.dir, file), dest);
+      const dest = path34.join(backupDir, file);
+      mkdirSync10(path34.dirname(dest), { recursive: true });
+      copyFileSync3(path34.join(plan.dir, file), dest);
     }
   }
-  rmSync4(plan.dir, { recursive: true, force: true });
+  rmSync5(plan.dir, { recursive: true, force: true });
   forgetRepo(targetDir, repo.name);
   return backupDir;
 }
@@ -18286,13 +20050,13 @@ async function rollbackRepo(targetDir, repo) {
 }
 
 // src/self.ts
-import path32 from "path";
+import path35 from "path";
 function norm(p) {
-  return path32.resolve(p).replace(/\\/g, "/").toLowerCase();
+  return path35.resolve(p).replace(/\\/g, "/").toLowerCase();
 }
 function detectInstallMethod(scriptPath, home) {
   const script = norm(scriptPath);
-  if (script.startsWith(`${norm(path32.join(home, ".forge-cli", "bin"))}/`)) return "shim";
+  if (script.startsWith(`${norm(path35.join(home, ".forge-cli", "bin"))}/`)) return "shim";
   if (script.includes("/node_modules/")) return "npm-global";
   return "source";
 }
@@ -18474,14 +20238,14 @@ async function runUninstallCommand() {
 }
 
 // src/config.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "fs";
-import path33 from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync18 } from "fs";
+import path36 from "path";
 function loadConfig(targetDir) {
-  const file = path33.join(targetDir, "forge-cli.config.json");
-  if (!existsSync20(file)) return null;
+  const file = path36.join(targetDir, "forge-cli.config.json");
+  if (!existsSync23(file)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(file, "utf8"));
+    parsed = JSON.parse(readFileSync18(file, "utf8"));
   } catch {
     return { error: "invalid-json" };
   }
@@ -18524,12 +20288,12 @@ function loadConfig(targetDir) {
 }
 
 // src/plan.ts
-import { existsSync as existsSync21, readdirSync as readdirSync9 } from "fs";
-import path34 from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync10 } from "fs";
+import path37 from "path";
 function planLines(repo, targetDir) {
-  const repoDir = path34.join(targetDir, repo.name);
+  const repoDir = path37.join(targetDir, repo.name);
   const lines = [];
-  if (!existsSync21(repoDir)) {
+  if (!existsSync24(repoDir)) {
     lines.push(`${S.planSync}: git clone (${S.planDetectAfter})`);
     for (const step of [
       S.phaseEnv,
@@ -18552,7 +20316,7 @@ function planLines(repo, targetDir) {
   lines.push(
     `${S.phaseEnv}: ${envAction === "exists" ? S.planEnvKeep : envAction === "copied" ? S.planEnvCopy : S.planEnvStub}`
   );
-  const examples = readdirSync9(repoDir).filter(
+  const examples = readdirSync10(repoDir).filter(
     (f) => f !== ".env.example" && f.includes(".example.")
   );
   lines.push(
@@ -18568,11 +20332,11 @@ function planLines(repo, targetDir) {
   return lines;
 }
 async function executionSummary(repo, targetDir, native, platform2 = process.platform) {
-  const repoDir = path34.join(targetDir, repo.name);
+  const repoDir = path37.join(targetDir, repo.name);
   const trust = repo.origin === "custom" ? "custom" : "builtin";
   const commands = [];
   let revision;
-  if (!existsSync21(repoDir) || !hasGitRepo(repoDir)) {
+  if (!existsSync24(repoDir) || !hasGitRepo(repoDir)) {
     commands.push(`git clone -- ${repo.url}`, S.planScriptsAfterClone);
   } else {
     revision = (await currentHead(repoDir))?.slice(0, 7);
@@ -18802,8 +20566,8 @@ ${planLines(repo, targetDir).map((line) => `  ${theme.dim(line)}`).join("\n")}`
 }
 
 // src/cmd/env.ts
-import { existsSync as existsSync23, readdirSync as readdirSync11 } from "fs";
-import path36 from "path";
+import { existsSync as existsSync26, readdirSync as readdirSync12 } from "fs";
+import path39 from "path";
 
 // src/envintel/doctor.ts
 function envDoctor(repoDir, envKeys) {
@@ -18852,8 +20616,8 @@ function envDoctor(repoDir, envKeys) {
 
 // src/envintel/migrate.ts
 import { randomBytes } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync10, readFileSync as readFileSync17 } from "fs";
-import path35 from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync11, readdirSync as readdirSync11, readFileSync as readFileSync19 } from "fs";
+import path38 from "path";
 function timestamp2(d = /* @__PURE__ */ new Date()) {
   const p = (n4) => String(n4).padStart(2, "0");
   return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
@@ -18867,13 +20631,13 @@ function addValue(spec, exampleEmpty) {
 }
 function planMigration(repoDir, targetSchema) {
   const schema = targetSchema ?? deriveSchema(repoDir);
-  const envPath = path35.join(repoDir, ".env");
-  const env = existsSync22(envPath) ? parseEnv(readFileSync17(envPath, "utf8")) : null;
+  const envPath = path38.join(repoDir, ".env");
+  const env = existsSync25(envPath) ? parseEnv(readFileSync19(envPath, "utf8")) : null;
   const present = new Set(env?.entries.map((e) => e.key) ?? []);
-  const examplePath = path35.join(repoDir, ".env.example");
+  const examplePath = path38.join(repoDir, ".env.example");
   const exampleEmpty = /* @__PURE__ */ new Set();
-  if (existsSync22(examplePath)) {
-    for (const e of parseEnv(readFileSync17(examplePath, "utf8")).entries) {
+  if (existsSync25(examplePath)) {
+    for (const e of parseEnv(readFileSync19(examplePath, "utf8")).entries) {
       if (e.value === "") exampleEmpty.add(e.key);
     }
   }
@@ -18901,19 +20665,19 @@ function planMigration(repoDir, targetSchema) {
   return { actions, removesRequireApproval: true };
 }
 function backupDirFor2(repoDir, ts) {
-  return path35.join(artifactsRoot(repoDir), "backups", `env-${ts}`);
+  return path38.join(artifactsRoot(repoDir), "backups", `env-${ts}`);
 }
 function backupEnv(repoDir, content) {
   const dir = backupDirFor2(repoDir, timestamp2());
-  mkdirSync8(dir, { recursive: true });
-  const file = path35.join(dir, ".env");
+  mkdirSync11(dir, { recursive: true });
+  const file = path38.join(dir, ".env");
   writeFileAtomic(file, content);
   return dir;
 }
 function applyMigration(repoDir, plan, opts = {}) {
-  const envPath = path35.join(repoDir, ".env");
-  const exists = existsSync22(envPath);
-  const current = exists ? readFileSync17(envPath, "utf8") : "";
+  const envPath = path38.join(repoDir, ".env");
+  const exists = existsSync25(envPath);
+  const current = exists ? readFileSync19(envPath, "utf8") : "";
   const env = parseEnv(current);
   const present = new Set(env.entries.map((e) => e.key));
   const removes = plan.actions.filter((a3) => a3.kind === "remove-requested" && present.has(a3.key));
@@ -18943,16 +20707,16 @@ function applyMigration(repoDir, plan, opts = {}) {
   };
 }
 function latestEnvBackup(repoDir) {
-  const root = path35.join(artifactsRoot(repoDir), "backups");
-  if (!existsSync22(root)) return null;
-  const candidates = readdirSync10(root, { withFileTypes: true }).filter((d) => d.isDirectory() && /^env-\d{8}-\d{6}$/.test(d.name)).map((d) => d.name).sort();
+  const root = path38.join(artifactsRoot(repoDir), "backups");
+  if (!existsSync25(root)) return null;
+  const candidates = readdirSync11(root, { withFileTypes: true }).filter((d) => d.isDirectory() && /^env-\d{8}-\d{6}$/.test(d.name)).map((d) => d.name).sort();
   const last = candidates.at(-1);
-  return last ? path35.join(root, last) : null;
+  return last ? path38.join(root, last) : null;
 }
 function rollbackEnv(repoDir, backupDir) {
-  const src = path35.join(backupDir, ".env");
-  if (!existsSync22(src)) return false;
-  writeFileAtomic(path35.join(repoDir, ".env"), readFileSync17(src, "utf8"));
+  const src = path38.join(backupDir, ".env");
+  if (!existsSync25(src)) return false;
+  writeFileAtomic(path38.join(repoDir, ".env"), readFileSync19(src, "utf8"));
   return true;
 }
 
@@ -18960,9 +20724,9 @@ function rollbackEnv(repoDir, backupDir) {
 var VERBS = /* @__PURE__ */ new Set(["inspect", "plan", "init", "validate", "migrate", "doctor"]);
 function envCandidates(dir) {
   try {
-    return readdirSync11(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).filter((name) => {
+    return readdirSync12(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).filter((name) => {
       const r2 = resolveInside(dir, name);
-      return r2 !== null && (existsSync23(path36.join(r2, ".env")) || existsSync23(path36.join(r2, ".env.example")));
+      return r2 !== null && (existsSync26(path39.join(r2, ".env")) || existsSync26(path39.join(r2, ".env.example")));
     }).sort();
   } catch {
     return [];
@@ -19009,7 +20773,7 @@ async function runEnvCommand(cli, args) {
     envKeys = catalogFor(targetDir).find((r2) => r2.name === name)?.envKeys;
   } else {
     const cwd = process.cwd();
-    if (existsSync23(path36.join(cwd, ".env")) || existsSync23(path36.join(cwd, ".env.example"))) {
+    if (existsSync26(path39.join(cwd, ".env")) || existsSync26(path39.join(cwd, ".env.example"))) {
       repoDir = cwd;
     }
   }
@@ -19019,7 +20783,7 @@ async function runEnvCommand(cli, args) {
     if (found.length) note(found.join("\n"), S.envTitle);
     return 2;
   }
-  const repo = name ?? path36.basename(repoDir);
+  const repo = name ?? path39.basename(repoDir);
   if (verb === "inspect") {
     const res2 = inspectEnv(repoDir, envKeys);
     if (json) {
@@ -19061,13 +20825,13 @@ async function runEnvCommand(cli, args) {
     note(lines.join("\n"), `${S.envDoctorTitle} \u2014 ${repo}`);
     return res2.checks.some((c4) => c4.result === "fail") ? 1 : 0;
   }
-  if (!existsSync23(repoDir)) {
+  if (!existsSync26(repoDir)) {
     log.error(`${repo}: ${S.statusNotInstalled}`);
     return 2;
   }
   const schema = deriveSchema(repoDir, envKeys);
   const secretKeys = new Set(schema.vars.filter((v) => v.secret).map((v) => v.key));
-  const envPath = path36.join(repoDir, ".env");
+  const envPath = path39.join(repoDir, ".env");
   if (verb === "plan") {
     const plan2 = planMigration(repoDir, schema);
     const shown = maskedActions(plan2, secretKeys);
@@ -19090,7 +20854,7 @@ async function runEnvCommand(cli, args) {
     return 0;
   }
   if (verb === "init") {
-    if (existsSync23(envPath)) {
+    if (existsSync26(envPath)) {
       if (json) console.log(JSON.stringify({ command: "env init", repo, created: false }));
       else log.info(S.envInitExists);
       return 0;
@@ -19163,6 +20927,165 @@ async function runEnvCommand(cli, args) {
   return 0;
 }
 
+// src/cmd/hosts.ts
+import path40 from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync13 } from "fs";
+
+// src/mcp/handshake.ts
+import { spawn as spawn2 } from "child_process";
+import { createInterface as createInterface2 } from "readline";
+var PROTOCOL_VERSION = "2024-11-05";
+var STEP_MS = 8e3;
+var MAX_LINE = 1 << 20;
+var MAX_LINES = 64;
+var err = (code, detail) => ({
+  ok: false,
+  levels: [],
+  tools: null,
+  serverInfo: null,
+  protocolVersion: null,
+  error: { code, detail: detail.slice(0, 300) }
+});
+function probeMcpServer(argv) {
+  return new Promise((resolve) => {
+    if (!argv.length || !argv[0]) {
+      resolve(err("argv-empty", "comando MCP vazio"));
+      return;
+    }
+    let child;
+    try {
+      child = spawn2(argv[0], argv.slice(1), { stdio: ["pipe", "pipe", "pipe"], shell: false });
+    } catch (e) {
+      resolve(err("spawn-failed", e instanceof Error ? e.message : String(e)));
+      return;
+    }
+    const levels = [];
+    let tools = null;
+    let serverInfo = null;
+    let protocolVersion = null;
+    let stdoutGarbage = false;
+    let done = false;
+    const finish = (r2) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      child.kill("SIGTERM");
+      resolve(r2);
+    };
+    const timer = setTimeout(() => {
+      finish({
+        ...err("timeout", `sem resposta em ${STEP_MS}ms (n\xEDveis: ${levels.join(",") || "nenhum"})`),
+        levels
+      });
+    }, STEP_MS);
+    const pending = /* @__PURE__ */ new Map();
+    const rl = createInterface2({ input: child.stdout, crlfDelay: Infinity });
+    let lines = 0;
+    rl.on("line", (line) => {
+      if (line.length > MAX_LINE || ++lines > MAX_LINES) {
+        stdoutGarbage = true;
+        finish({
+          ...err("stdout-oversized", "sa\xEDda stdout excedeu limites \u2014 n\xE3o \xE9 um MCP stdio limpo"),
+          levels
+        });
+        return;
+      }
+      let msg;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        stdoutGarbage = true;
+        finish({
+          ...err("stdout-non-json", "server escreveu n\xE3o-JSON no stdout (logs indevidos?)"),
+          levels
+        });
+        return;
+      }
+      const id = msg.id;
+      if (typeof id === "number" && pending.has(id)) {
+        pending.get(id)(msg);
+        pending.delete(id);
+      }
+    });
+    child.on("error", (e) => finish({ ...err("spawn-failed", e.message), levels }));
+    child.on("exit", (code) => {
+      if (!done)
+        finish({ ...err("server-exit", `exit ${code} antes do handshake completar`), levels });
+    });
+    const stderr = [];
+    child.stderr?.on("data", (d) => {
+      if (stderr.join("").length < 4096) stderr.push(d.toString("utf8"));
+    });
+    const request = (method, params, id) => new Promise((ok, bad) => {
+      pending.set(id, ok);
+      const stepTimer = setTimeout(() => {
+        pending.delete(id);
+        bad(new Error(`${method}: timeout por etapa`));
+      }, STEP_MS);
+      setTimeout(() => clearTimeout(stepTimer), STEP_MS + 50);
+      child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}
+`);
+    });
+    const notify = (method) => child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method })}
+`);
+    void (async () => {
+      try {
+        const init = await request(
+          "initialize",
+          {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: "forge-cli", version: "0.1.0" }
+          },
+          1
+        );
+        const res = init.result ?? {};
+        if (init.error || typeof res !== "object" || !res.protocolVersion) {
+          finish(
+            err(
+              "initialize-invalid",
+              `resposta initialize inv\xE1lida: ${JSON.stringify(init).slice(0, 200)}`
+            )
+          );
+          return;
+        }
+        protocolVersion = String(res.protocolVersion);
+        const si = res.serverInfo;
+        serverInfo = si ? { name: String(si.name ?? ""), version: String(si.version ?? "") } : null;
+        levels.push("MCP_INITIALIZED");
+        notify("notifications/initialized");
+        const list = await request("tools/list", {}, 2);
+        const tl = (list.result ?? {}).tools;
+        if (list.error || !Array.isArray(tl)) {
+          finish({
+            ...err("tools-list-invalid", "tools/list ausente ou malformado"),
+            levels,
+            protocolVersion,
+            serverInfo
+          });
+          return;
+        }
+        for (const t2 of tl) {
+          if (typeof t2.name !== "string") {
+            finish({
+              ...err("tool-schema-invalid", "tool sem name:string"),
+              levels,
+              protocolVersion,
+              serverInfo
+            });
+            return;
+          }
+        }
+        tools = tl.length;
+        levels.push("TOOLS_DISCOVERED");
+        finish({ ok: !stdoutGarbage, levels, tools, serverInfo, protocolVersion, error: null });
+      } catch (e) {
+        finish({ ...err("handshake-failed", e instanceof Error ? e.message : String(e)), levels });
+      }
+    })();
+  });
+}
+
 // src/cmd/hosts.ts
 var STATE_LABEL = {
   absent: S.hostAbsent,
@@ -19189,9 +21112,26 @@ function planLines3(plan) {
   if (plan.copyable_command) lines.push(`${S.hostCopyCommand} ${plan.copyable_command}`);
   return lines.join("\n");
 }
-function forgeDescriptor(targetDir, name) {
+function forgeDescriptor(targetDir, name, home = cliHome()) {
   const dir = resolveInside(targetDir, name);
   const manifest = dir ? readForgeManifest(dir) : null;
+  if (manifest?.mcpCommand?.length) {
+    return { forge_id: manifest.forgeId ?? name, mcp_command: manifest.mcpCommand };
+  }
+  const receipt = loadForgeState(home).forges[name];
+  const entry2 = registryEntry(name);
+  if (receipt?.bin && entry2?.mcp?.length) {
+    const binDir = path40.dirname(receipt.bin);
+    const mcp_command = entry2.mcp.map((tok) => {
+      if (tok === "{bin}") return receipt.bin;
+      if (tok.startsWith("{binDir}/")) {
+        const script = tok.slice("{binDir}/".length);
+        return path40.join(binDir, process.platform === "win32" ? `${script}.exe` : script);
+      }
+      return tok;
+    });
+    return { forge_id: name, mcp_command };
+  }
   return { forge_id: manifest?.forgeId ?? name, mcp_command: manifest?.mcpCommand };
 }
 async function runHostsCommand(cli, args, home) {
@@ -19214,7 +21154,7 @@ async function runHostsCommand(cli, args, home) {
     return 2;
   }
   const targetDir = resolveTargetDir(cli.dir);
-  const forge = forgeDescriptor(targetDir, forgeName);
+  const forge = forgeDescriptor(targetDir, forgeName, home);
   if (verb === "plan" || verb === "register") {
     const plan = await adapter.planIntegration(forge, targetDir, hostHome(home));
     if (!plan) {
@@ -19287,11 +21227,79 @@ async function runHostsCommand(cli, args, home) {
   log.error(`${S.errUnknownCommand}: ${args.join(" ")}`);
   return 2;
 }
+async function runMcpCommand(cli, args, home = cliHome()) {
+  const json = cli.jsonReport;
+  const verify = cli.verify;
+  const names = args.filter((a3) => !a3.startsWith("-"));
+  const targetDir = resolveTargetDir(cli.dir);
+  const candidates = names.length > 0 ? names : [
+    .../* @__PURE__ */ new Set([
+      ...Object.keys(loadForgeState(home).forges),
+      ...existsSync27(targetDir) ? readdirSync13(targetDir, { withFileTypes: true }).filter((d) => d.isDirectory() && isSafeRepoName(d.name)).map((d) => d.name) : []
+    ])
+  ].sort();
+  if (candidates.length === 0) {
+    if (json) process.stdout.write(`${JSON.stringify({ mcp: [] })}
+`);
+    else log.warn("nenhuma Forja instalada/encontrada para MCP");
+    return 1;
+  }
+  const results = [];
+  for (const name of candidates) {
+    if (!isSafeRepoName(name)) {
+      results.push({ forge: name, ok: false, detail: "nome inseguro" });
+      continue;
+    }
+    const forge = forgeDescriptor(targetDir, name, home);
+    const argv = forge.mcp_command;
+    if (!argv?.length) {
+      results.push({ forge: name, ok: false, detail: "sem mcp_command" });
+      continue;
+    }
+    const binPresent = path40.isAbsolute(argv[0]) ? existsSync27(argv[0]) : true;
+    const item = {
+      forge: name,
+      forge_id: forge.forge_id,
+      mcp_command: argv,
+      binPresent,
+      ok: binPresent
+    };
+    if (!binPresent) item.detail = "bin\xE1rio MCP ausente na venv";
+    if (verify && binPresent && path40.isAbsolute(argv[0])) {
+      const probe = await probeMcpServer(argv);
+      item.probe = {
+        ok: probe.ok,
+        levels: probe.levels,
+        tools: probe.tools,
+        server: probe.serverInfo,
+        protocol: probe.protocolVersion,
+        error: probe.error
+      };
+      if (!probe.ok) {
+        item.ok = false;
+        item.detail = probe.error ? `${probe.error.code}: ${probe.error.detail}` : "probe falhou";
+      }
+    }
+    results.push(item);
+  }
+  if (json) {
+    process.stdout.write(`${JSON.stringify({ mcp: results }, null, 2)}
+`);
+  } else {
+    for (const r2 of results) {
+      const rec = r2;
+      if (rec.ok) log.info(`${icons.ok} ${rec.forge}: ${rec.mcp_command?.join(" ")}`);
+      else log.warn(`${rec.forge}: ${rec.detail ?? "indispon\xEDvel"}`);
+    }
+  }
+  const okCount = results.filter((r2) => r2.ok).length;
+  return okCount === results.length ? 0 : okCount > 0 ? 0 : 1;
+}
 
 // src/discovery.ts
-import { existsSync as existsSync24, readdirSync as readdirSync12, readFileSync as readFileSync18, statSync as statSync5 } from "fs";
-import os4 from "os";
-import path37 from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync14, readFileSync as readFileSync20, statSync as statSync5 } from "fs";
+import os6 from "os";
+import path41 from "path";
 var DEFAULT_LIMITS = {
   maxDepth: 3,
   maxEntriesPerDir: 500,
@@ -19384,7 +21392,7 @@ function readBoundedText(file) {
   try {
     const st = statSync5(file);
     if (!st.isFile() || st.size > MAX_FILE_BYTES) return null;
-    const text2 = readFileSync18(file, "utf8");
+    const text2 = readFileSync20(file, "utf8");
     if (text2.includes(String.fromCharCode(0))) return null;
     return text2;
   } catch {
@@ -19440,7 +21448,7 @@ function walkWorkspace(root, limits, budgetLeft) {
     const { dir, rel: rel2, depth } = current;
     let entries;
     try {
-      entries = readdirSync12(dir, { withFileTypes: true }).sort(
+      entries = readdirSync14(dir, { withFileTypes: true }).sort(
         (a3, b) => a3.name < b.name ? -1 : a3.name > b.name ? 1 : 0
       );
     } catch {
@@ -19456,7 +21464,7 @@ function walkWorkspace(root, limits, budgetLeft) {
         return { markers, envFiles, topDirs, signals: signals2, truncated };
       }
       const lower = entry2.name.toLowerCase();
-      const full = path37.join(dir, entry2.name);
+      const full = path41.join(dir, entry2.name);
       const relPath = rel2 ? `${rel2}/${entry2.name}` : entry2.name;
       if (entry2.isDirectory()) {
         if (skip.has(lower) || isLinkOrJunction(full)) continue;
@@ -19579,10 +21587,10 @@ function registryState(entry2) {
 function discoverForge(name, dir, state) {
   const sources = [];
   const git = !!dir && hasGitRepo(dir);
-  const manifest = dir && existsSync24(dir) ? readForgeManifest(dir) : null;
+  const manifest = dir && existsSync28(dir) ? readForgeManifest(dir) : null;
   const entry2 = state?.repos[name];
   if (entry2 && entry2.phase !== "not-installed") {
-    const dirExists = !!dir && existsSync24(dir);
+    const dirExists = !!dir && existsSync28(dir);
     sources.push({
       origin: "manifest",
       // registro diz instalada mas o checkout sumiu → evidência falhando
@@ -19625,7 +21633,7 @@ async function discoverEnvironment(targetDir, opts) {
   const start = now();
   const limits = { ...DEFAULT_LIMITS, ...opts?.limits };
   const budgetLeft = () => limits.timeoutMs - (now() - start);
-  const root = path37.resolve(targetDir);
+  const root = path41.resolve(targetDir);
   const walk = walkWorkspace(root, limits, budgetLeft);
   const tools = await probeTools(process.platform, budgetLeft);
   const hosts = await probeHosts(budgetLeft);
@@ -19642,7 +21650,7 @@ async function discoverEnvironment(targetDir, opts) {
     const dir = resolveInside(root, dirName);
     if (!dir) continue;
     const git = hasGitRepo(dir);
-    const manifest = existsSync24(path37.join(dir, "forge.json"));
+    const manifest = existsSync28(path41.join(dir, "forge.json"));
     if (!git && !manifest) continue;
     presence.push({ name: dirName, path: dirName, git, manifest });
     if (!catalogNames.has(dirName) && manifest) {
@@ -19659,8 +21667,8 @@ async function discoverEnvironment(targetDir, opts) {
     generated_at: new Date(now()).toISOString(),
     os: {
       platform: process.platform,
-      release: os4.release(),
-      arch: os4.arch(),
+      release: os6.release(),
+      arch: os6.arch(),
       shell: process.env.SHELL ?? process.env.ComSpec ?? null
     },
     tools,
@@ -20289,11 +22297,11 @@ async function answerRepair(targetDir, repos, opts = {}) {
 }
 
 // src/intel/context.ts
-import { existsSync as existsSync25, readdirSync as readdirSync13, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
-import path38 from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync15, readFileSync as readFileSync21, statSync as statSync6 } from "fs";
+import path42 from "path";
 
 // src/planner.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var PLAN_TTL_MS = 15 * 60 * 1e3;
 var SELECTABLE_STEPS = [
   "clone",
@@ -20319,7 +22327,7 @@ function canonicalJson(doc) {
   return JSON.stringify(canonicalize(doc));
 }
 function planHash(plan) {
-  return createHash3("sha256").update(canonicalJson(plan), "utf8").digest("hex");
+  return createHash4("sha256").update(canonicalJson(plan), "utf8").digest("hex");
 }
 function buildPlan(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
@@ -20388,10 +22396,10 @@ function safeScalar(value) {
   return redactSecrets(value) === value ? value : null;
 }
 function safeConfig(targetDir) {
-  const file = path38.join(targetDir, "forge-cli.config.json");
+  const file = path42.join(targetDir, "forge-cli.config.json");
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(file, "utf8"));
+    raw = JSON.parse(readFileSync21(file, "utf8"));
   } catch {
     return {};
   }
@@ -20405,10 +22413,10 @@ function safeConfig(targetDir) {
   return out;
 }
 function readManifestObject(repoDir) {
-  const file = path38.join(repoDir, "forge.json");
+  const file = path42.join(repoDir, "forge.json");
   try {
-    if (!existsSync25(file) || statSync6(file).size > MAX_MANIFEST_BYTES) return null;
-    const raw = JSON.parse(readFileSync19(file, "utf8"));
+    if (!existsSync29(file) || statSync6(file).size > MAX_MANIFEST_BYTES) return null;
+    const raw = JSON.parse(readFileSync21(file, "utf8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
   } catch {
     return null;
@@ -20441,10 +22449,10 @@ function manifestCapabilities(repoDir, repoName, out) {
   }
 }
 function activePlans(targetDir, nowIso) {
-  const dir = path38.join(artifactsRoot(targetDir), "plans");
+  const dir = path42.join(artifactsRoot(targetDir), "plans");
   let names;
   try {
-    names = readdirSync13(dir).filter((n4) => n4.endsWith(".json")).sort();
+    names = readdirSync15(dir).filter((n4) => n4.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -20452,7 +22460,7 @@ function activePlans(targetDir, nowIso) {
   const out = [];
   for (const name of names.slice(0, MAX_PLAN_FILES)) {
     try {
-      const doc = JSON.parse(readFileSync19(path38.join(dir, name), "utf8"));
+      const doc = JSON.parse(readFileSync21(path42.join(dir, name), "utf8"));
       if (!doc || typeof doc !== "object" || Array.isArray(doc)) continue;
       const plan = doc;
       if (typeof plan.plan_id !== "string" || !plan.plan_id) continue;
@@ -20523,7 +22531,7 @@ async function buildForgeContext(targetDir, repos, opts = {}) {
   const byName = new Map(report.forges.map((f) => [f.name, f]));
   const capabilities = {};
   const forjas = [...repos].sort((a3, b) => cmp2(a3.name, b.name)).map((repo) => {
-    const dir = path38.join(targetDir, repo.name);
+    const dir = path42.join(targetDir, repo.name);
     manifestCapabilities(dir, repo.name, capabilities);
     const discovered = byName.get(repo.name);
     return {
@@ -20577,8 +22585,8 @@ async function buildForgeContext(targetDir, repos, opts = {}) {
 }
 
 // src/intel/predict.ts
-import { existsSync as existsSync26, readFileSync as readFileSync20, statSync as statSync7 } from "fs";
-import path39 from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync22, statSync as statSync7 } from "fs";
+import path43 from "path";
 var MAX_MANIFEST_BYTES2 = 64 * 1024;
 var SEMVERISH = /^v?\d+\.\d+\.\d+/;
 var ev2 = (source, fact) => ({
@@ -20588,10 +22596,10 @@ var ev2 = (source, fact) => ({
 var cmp3 = (a3, b) => a3 < b ? -1 : a3 > b ? 1 : 0;
 var mk2 = (id, kind, subject, certainty, version, evidence, explanation) => ({ id, kind, subject, certainty, version, evidence, explanation });
 function readManifest(repoDir) {
-  const file = path39.join(repoDir, "forge.json");
+  const file = path43.join(repoDir, "forge.json");
   try {
-    if (!existsSync26(file) || statSync7(file).size > MAX_MANIFEST_BYTES2) return null;
-    const raw = JSON.parse(readFileSync20(file, "utf8"));
+    if (!existsSync30(file) || statSync7(file).size > MAX_MANIFEST_BYTES2) return null;
+    const raw = JSON.parse(readFileSync22(file, "utf8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
   } catch {
     return null;
@@ -20640,7 +22648,7 @@ function declaredRefs(targetDir, repoName, m3) {
   }
   try {
     const lock = JSON.parse(
-      readFileSync20(path39.join(artifactsRoot(targetDir), "env.lock.json"), "utf8")
+      readFileSync22(path43.join(artifactsRoot(targetDir), "env.lock.json"), "utf8")
     );
     const head = lock?.forges?.[repoName]?.head;
     if (typeof head === "string" && SEMVERISH.test(head)) {
@@ -20907,7 +22915,7 @@ async function predictCompatibility(targetDir, repos, opts = {}) {
   const allClaims = [];
   for (const repo of sorted) {
     const dir = resolveInside(targetDir, repo.name);
-    if (!dir || !existsSync26(dir)) continue;
+    if (!dir || !existsSync30(dir)) continue;
     const m3 = readManifest(dir);
     manifests.set(repo.name, m3);
     if (m3) out.push(...schemaChange(repo.name, m3));
@@ -20919,7 +22927,7 @@ async function predictCompatibility(targetDir, repos, opts = {}) {
   out.push(...envVarFindings("<workspace>", targetDir));
   for (const repo of sorted) {
     const dir = resolveInside(targetDir, repo.name);
-    if (!dir || !existsSync26(dir)) continue;
+    if (!dir || !existsSync30(dir)) continue;
     out.push(...envVarFindings(repo.name, dir, repo.envKeys));
   }
   out.push(...installConflict(allClaims));
@@ -20927,13 +22935,13 @@ async function predictCompatibility(targetDir, repos, opts = {}) {
 }
 
 // src/ai/bridge.ts
-import { mkdirSync as mkdirSync10 } from "fs";
-import path41 from "path";
+import { mkdirSync as mkdirSync13 } from "fs";
+import path45 from "path";
 
 // src/ai/cache.ts
-import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync9, readFileSync as readFileSync21, readdirSync as readdirSync14, rmSync as rmSync5 } from "fs";
-import path40 from "path";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync31, mkdirSync as mkdirSync12, readFileSync as readFileSync23, readdirSync as readdirSync16, rmSync as rmSync6 } from "fs";
+import path44 from "path";
 
 // src/ai/types.ts
 var AI_PROPOSAL_SCHEMA = "forge/AiProposal/v1";
@@ -21016,7 +23024,7 @@ function validateProposal(proposal, catalog) {
 var AI_CACHE_MAX_ENTRIES = 32;
 var KEY_RE = /^[a-f0-9]{64}$/;
 function aiCacheDir(rootDir) {
-  return path40.join(artifactsRoot(rootDir), "ai", "cache");
+  return path44.join(artifactsRoot(rootDir), "ai", "cache");
 }
 function canonical(value) {
   if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
@@ -21027,18 +23035,18 @@ function canonical(value) {
   return JSON.stringify(value) ?? "null";
 }
 function aiCacheKey(payload) {
-  return createHash4("sha256").update(canonical(payload)).digest("hex");
+  return createHash5("sha256").update(canonical(payload)).digest("hex");
 }
 function entryFile(rootDir, key) {
   if (!KEY_RE.test(key)) return null;
-  return path40.join(aiCacheDir(rootDir), `${key}.json`);
+  return path44.join(aiCacheDir(rootDir), `${key}.json`);
 }
 function aiCacheGet(rootDir, key, opts) {
   if (opts.ttlMs <= 0) return null;
   const file = entryFile(rootDir, key);
-  if (!file || !existsSync27(file)) return null;
+  if (!file || !existsSync31(file)) return null;
   try {
-    const entry2 = JSON.parse(readFileSync21(file, "utf8"));
+    const entry2 = JSON.parse(readFileSync23(file, "utf8"));
     const now = opts.now ?? Date.now();
     if (typeof entry2?.at !== "number" || now - entry2.at > opts.ttlMs || now < entry2.at) {
       return null;
@@ -21052,7 +23060,7 @@ function aiCacheSet(rootDir, key, proposal, opts = {}) {
   const file = entryFile(rootDir, key);
   if (!file) return;
   const dir = aiCacheDir(rootDir);
-  mkdirSync9(dir, { recursive: true });
+  mkdirSync12(dir, { recursive: true });
   const entry2 = { at: opts.now ?? Date.now(), proposal };
   writeFileAtomic(file, JSON.stringify(entry2));
   evictOldest(dir, opts.maxEntries ?? AI_CACHE_MAX_ENTRIES);
@@ -21061,19 +23069,19 @@ function evictOldest(dir, maxEntries) {
   if (maxEntries < 1) return;
   let files;
   try {
-    files = readdirSync14(dir).filter((f) => KEY_RE.test(path40.basename(f, ".json")));
+    files = readdirSync16(dir).filter((f) => KEY_RE.test(path44.basename(f, ".json")));
   } catch {
     return;
   }
   if (files.length <= maxEntries) return;
-  const aged = files.map((file) => ({ file, at: entryAge(path40.join(dir, file)) })).sort((a3, b) => a3.at - b.at || a3.file.localeCompare(b.file));
+  const aged = files.map((file) => ({ file, at: entryAge(path44.join(dir, file)) })).sort((a3, b) => a3.at - b.at || a3.file.localeCompare(b.file));
   for (const { file } of aged.slice(0, aged.length - maxEntries)) {
-    rmSync5(path40.join(dir, file), { force: true });
+    rmSync6(path44.join(dir, file), { force: true });
   }
 }
 function entryAge(file) {
   try {
-    const entry2 = JSON.parse(readFileSync21(file, "utf8"));
+    const entry2 = JSON.parse(readFileSync23(file, "utf8"));
     return typeof entry2?.at === "number" ? entry2.at : 0;
   } catch {
     return 0;
@@ -21125,18 +23133,18 @@ function sanitizeForAi(input) {
 }
 function assertNoSecrets(input) {
   const hits = /* @__PURE__ */ new Set();
-  const visit = (value, path45) => {
+  const visit = (value, path49) => {
     if (typeof value === "string") {
-      if (redactSecrets(value) !== value) hits.add(path45 || "<root>");
+      if (redactSecrets(value) !== value) hits.add(path49 || "<root>");
       return;
     }
     if (Array.isArray(value)) {
-      value.forEach((item, index) => visit(item, `${path45}[${index}]`));
+      value.forEach((item, index) => visit(item, `${path49}[${index}]`));
       return;
     }
     if (value && typeof value === "object") {
       for (const [key, child] of Object.entries(value)) {
-        const childPath = path45 ? `${path45}.${key}` : key;
+        const childPath = path49 ? `${path49}.${key}` : key;
         if (isDeniedKey(key)) {
           hits.add(childPath);
           continue;
@@ -21193,16 +23201,16 @@ async function runAiBridge(req, cfg, deps) {
   if (Buffer.byteLength(body, "utf8") > cfg.maxContextBytes) {
     return { ok: false, reason: "bridge-error", detail: "context-too-large" };
   }
-  const aiDir = path41.join(artifactsRoot(rootDir), "ai");
-  mkdirSync10(aiDir, { recursive: true });
-  const contextFile = path41.join(aiDir, `context-${digest}.json`);
+  const aiDir = path45.join(artifactsRoot(rootDir), "ai");
+  mkdirSync13(aiDir, { recursive: true });
+  const contextFile = path45.join(aiDir, `context-${digest}.json`);
   writeFileAtomic(contextFile, body);
   const argv = command.map((part) => part === "{context}" ? contextFile : part);
   if (!command.includes("{context}")) argv.push(contextFile);
-  const spawn2 = deps.spawnFn ?? execaSpawn;
+  const spawn3 = deps.spawnFn ?? execaSpawn;
   let res;
   try {
-    res = await spawn2(argv, { timeoutMs: cfg.timeoutMs, cwd: rootDir });
+    res = await spawn3(argv, { timeoutMs: cfg.timeoutMs, cwd: rootDir });
   } catch (error) {
     return { ok: false, reason: "bridge-error", detail: cap(errorDetail(error)) };
   }
@@ -21236,18 +23244,18 @@ async function runAiBridge(req, cfg, deps) {
 }
 
 // src/portability/bundle.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync11, readFileSync as readFileSync22 } from "fs";
-import path42 from "path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync14, readFileSync as readFileSync24 } from "fs";
+import path46 from "path";
 
 // src/portability/manifest.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var INTEGRITY_MANIFEST_SCHEMA = "forge/IntegrityManifest/v1";
 var SAFE_ENTRY_PATH = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/;
 function isSafeEntryPath(p) {
   return typeof p === "string" && SAFE_ENTRY_PATH.test(p) && !p.split("/").includes("..");
 }
 function sha256(data) {
-  return createHash5("sha256").update(data).digest("hex");
+  return createHash6("sha256").update(data).digest("hex");
 }
 function entryDigest(entries) {
   return sha256(canonicalJson({ entries }));
@@ -21324,19 +23332,19 @@ var SecretKeysRefusedError = class extends Error {
 function writeJson(dest, doc) {
   const content = JSON.stringify(doc, null, 2);
   writeFileAtomic(dest, content);
-  return { path: path42.basename(dest), content };
+  return { path: path46.basename(dest), content };
 }
 function pinVersion(repoDir) {
   for (const file of ["forge.json", "package.json"]) {
     try {
-      const parsed = JSON.parse(readFileSync22(path42.join(repoDir, file), "utf8"));
+      const parsed = JSON.parse(readFileSync24(path46.join(repoDir, file), "utf8"));
       const v = parsed?.version;
       if (typeof v === "string" && v) return v;
     } catch {
     }
   }
   try {
-    const pyproject = readFileSync22(path42.join(repoDir, "pyproject.toml"), "utf8");
+    const pyproject = readFileSync24(path46.join(repoDir, "pyproject.toml"), "utf8");
     const m3 = /^version\s*=\s*"([^"]+)"/m.exec(pyproject);
     if (m3) return m3[1];
   } catch {
@@ -21347,8 +23355,8 @@ function collectPins(targetDir, repos) {
   const state = loadState(targetDir);
   const pins = /* @__PURE__ */ new Map();
   for (const repo of repos) {
-    const repoDir = path42.join(targetDir, repo.name);
-    const version = existsSync28(repoDir) ? pinVersion(repoDir) : void 0;
+    const repoDir = path46.join(targetDir, repo.name);
+    const version = existsSync32(repoDir) ? pinVersion(repoDir) : void 0;
     const head = state?.repos[repo.name]?.head;
     const ref = state?.pins?.[repo.name] ?? head;
     pins.set(repo.name, {
@@ -21374,15 +23382,15 @@ async function exportBundle(targetDir, repos, dest, opts) {
   }
   const schemaByRepo = /* @__PURE__ */ new Map();
   for (const repo of repos) {
-    const repoDir = path42.join(targetDir, repo.name);
-    const schema = existsSync28(repoDir) ? deriveSchema(repoDir, repo.envKeys) : { vars: [] };
+    const repoDir = path46.join(targetDir, repo.name);
+    const schema = existsSync32(repoDir) ? deriveSchema(repoDir, repo.envKeys) : { vars: [] };
     schemaByRepo.set(repo.name, schema);
     for (const v of schema.vars) {
       if (v.secret && whitelist.includes(v.key)) refused.add(v.key);
     }
   }
   if (refused.size) throw new SecretKeysRefusedError([...refused]);
-  mkdirSync11(dest, { recursive: true });
+  mkdirSync14(dest, { recursive: true });
   const inputs = [];
   const produced = [
     BUNDLE_FILES.envelope,
@@ -21395,30 +23403,30 @@ async function exportBundle(targetDir, repos, dest, opts) {
     BUNDLE_FILES.integrity
   ].sort();
   inputs.push(
-    writeJson(path42.join(dest, BUNDLE_FILES.envelope), {
+    writeJson(path46.join(dest, BUNDLE_FILES.envelope), {
       schema: BUNDLE_SCHEMA,
       generatedAt: now,
       files: produced
     })
   );
-  const profile = { ...exportProfile(targetDir, path42.join(dest, BUNDLE_FILES.profile)) };
+  const profile = { ...exportProfile(targetDir, path46.join(dest, BUNDLE_FILES.profile)) };
   const normalizedProfile = { ...profile, exported_at: now };
-  inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.profile), normalizedProfile));
+  inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.profile), normalizedProfile));
   const lock = { ...writeEnvLock(targetDir, repos), generated_at: now };
-  inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.lock), lock));
-  inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.lockCheck), checkEnvLock(targetDir, repos)));
+  inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.lock), lock));
+  inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.lockCheck), checkEnvLock(targetDir, repos)));
   const envKeys = {};
   for (const repo of repos) {
     const keys = [...new Set((schemaByRepo.get(repo.name)?.vars ?? []).map((v) => v.key))].sort();
     envKeys[repo.name] = keys;
   }
-  inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.envKeys), envKeys));
+  inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.envKeys), envKeys));
   if (whitelist.length) {
     const values = {};
     for (const repo of repos) {
-      const envFile = path42.join(targetDir, repo.name, ".env");
-      if (!existsSync28(envFile)) continue;
-      const entries = parseEnv(readFileSync22(envFile, "utf8")).entries;
+      const envFile = path46.join(targetDir, repo.name, ".env");
+      if (!existsSync32(envFile)) continue;
+      const entries = parseEnv(readFileSync24(envFile, "utf8")).entries;
       const found = {};
       for (const key of whitelist) {
         const entry2 = entries.find((e) => e.key === key);
@@ -21426,16 +23434,16 @@ async function exportBundle(targetDir, repos, dest, opts) {
       }
       if (Object.keys(found).length) values[repo.name] = found;
     }
-    inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.envValues), values));
+    inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.envValues), values));
   }
-  inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.pins), collectPins(targetDir, repos)));
+  inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.pins), collectPins(targetDir, repos)));
   const manifest = buildIntegrityManifest(inputs, { now });
-  inputs.push(writeJson(path42.join(dest, BUNDLE_FILES.integrity), manifest));
+  inputs.push(writeJson(path46.join(dest, BUNDLE_FILES.integrity), manifest));
   return { ok: true, dir: dest, files: produced, manifest };
 }
 function readJsonFile(file) {
   try {
-    return JSON.parse(readFileSync22(file, "utf8"));
+    return JSON.parse(readFileSync24(file, "utf8"));
   } catch {
     return null;
   }
@@ -21484,40 +23492,40 @@ function readPins(file) {
 function importBundle(src, opts) {
   const read = (p) => {
     try {
-      return readFileSync22(path42.join(src, p));
+      return readFileSync24(path46.join(src, p));
     } catch {
       return null;
     }
   };
-  const manifestRaw = readJsonFile(path42.join(src, BUNDLE_FILES.integrity));
+  const manifestRaw = readJsonFile(path46.join(src, BUNDLE_FILES.integrity));
   const manifest = manifestRaw && typeof manifestRaw === "object" && manifestRaw.schema === "forge/IntegrityManifest/v1" ? manifestRaw : null;
   const verify = opts?.verifyIntegrity === false ? { ok: true } : verifyIntegrityManifest(manifest, read);
-  const profile = importProfile(path42.join(src, BUNDLE_FILES.profile));
+  const profile = importProfile(path46.join(src, BUNDLE_FILES.profile));
   return {
     dir: src,
     verify,
     manifest,
     profile: "error" in profile ? null : profile,
-    lockfile: readLockfile(path42.join(src, BUNDLE_FILES.lock)),
-    lockCheck: readLockCheck(path42.join(src, BUNDLE_FILES.lockCheck)),
-    envKeys: readStringMap(path42.join(src, BUNDLE_FILES.envKeys)),
-    envValues: readValueMap(path42.join(src, BUNDLE_FILES.envValues)),
-    pins: readPins(path42.join(src, BUNDLE_FILES.pins))
+    lockfile: readLockfile(path46.join(src, BUNDLE_FILES.lock)),
+    lockCheck: readLockCheck(path46.join(src, BUNDLE_FILES.lockCheck)),
+    envKeys: readStringMap(path46.join(src, BUNDLE_FILES.envKeys)),
+    envValues: readValueMap(path46.join(src, BUNDLE_FILES.envValues)),
+    pins: readPins(path46.join(src, BUNDLE_FILES.pins))
   };
 }
 
 // src/intel/learning.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync12, readFileSync as readFileSync23 } from "fs";
-import path43 from "path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync15, readFileSync as readFileSync25 } from "fs";
+import path47 from "path";
 var LEARNING_SCHEMA = "forge-cli/LearningStore/v1";
 function learningFile(targetDir) {
-  return path43.join(artifactsRoot(targetDir), "learning.json");
+  return path47.join(artifactsRoot(targetDir), "learning.json");
 }
 function readStore(targetDir) {
   const file = learningFile(targetDir);
-  if (!existsSync29(file)) return { schema: LEARNING_SCHEMA, enabled: false, observations: [] };
+  if (!existsSync33(file)) return { schema: LEARNING_SCHEMA, enabled: false, observations: [] };
   try {
-    const parsed = JSON.parse(readFileSync23(file, "utf8"));
+    const parsed = JSON.parse(readFileSync25(file, "utf8"));
     if (parsed?.schema !== LEARNING_SCHEMA || !Array.isArray(parsed.observations)) {
       return { schema: LEARNING_SCHEMA, enabled: false, observations: [] };
     }
@@ -21534,7 +23542,7 @@ function readStore(targetDir) {
 }
 function writeStore(targetDir, store) {
   const file = learningFile(targetDir);
-  mkdirSync12(path43.dirname(file), { recursive: true });
+  mkdirSync15(path47.dirname(file), { recursive: true });
   writeFileAtomic(file, JSON.stringify(store, null, 2));
 }
 function learningStatus(targetDir) {
@@ -21689,12 +23697,12 @@ async function runBundleCommand(cli) {
       if (cli.jsonReport) emitJson(result);
       log.success(`${S.bundleExported}: ${dest}`);
       return 0;
-    } catch (err) {
-      if (err instanceof SecretKeysRefusedError) {
-        log.error(`${S.bundleSecretRefused}: ${err.keys.join(", ")}`);
+    } catch (err2) {
+      if (err2 instanceof SecretKeysRefusedError) {
+        log.error(`${S.bundleSecretRefused}: ${err2.keys.join(", ")}`);
         return 1;
       }
-      throw err;
+      throw err2;
     }
   }
   if (verb === "import" || verb === "verify") {
@@ -21705,8 +23713,8 @@ async function runBundleCommand(cli) {
     let result;
     try {
       result = importBundle(dest);
-    } catch (err) {
-      log.error(`${S.bundleInvalid}: ${err instanceof Error ? err.message : String(err)}`);
+    } catch (err2) {
+      log.error(`${S.bundleInvalid}: ${err2 instanceof Error ? err2.message : String(err2)}`);
       return 1;
     }
     if (cli.jsonReport) emitJson(result);
@@ -21755,8 +23763,8 @@ async function runLearningCommand(cli) {
 }
 
 // src/wizard.ts
-import { existsSync as existsSync30 } from "fs";
-import path44 from "path";
+import { existsSync as existsSync34 } from "fs";
+import path48 from "path";
 var STEP_LABELS = [
   S.wizardStepDetect,
   S.wizardStepRecommend,
@@ -21795,8 +23803,8 @@ function renderOperationPlan(plan) {
   return lines.join("\n");
 }
 function planActionsFor(repo, targetDir, steps) {
-  const repoDir = path44.join(targetDir, repo.name);
-  const cloned = existsSync30(repoDir) && hasGitRepo(repoDir);
+  const repoDir = path48.join(targetDir, repo.name);
+  const cloned = existsSync34(repoDir) && hasGitRepo(repoDir);
   const actions = [
     {
       kind: "clone",
@@ -21816,7 +23824,7 @@ function planActionsFor(repo, targetDir, steps) {
   actions.push({
     kind: "env",
     label: "provisionar .env (nunca sobrescreve)",
-    paths: [path44.join(repo.name, ".env")],
+    paths: [path48.join(repo.name, ".env")],
     reversible: false
   });
   if (steps.includes("skills")) {
@@ -21917,7 +23925,7 @@ async function runWizard(cli) {
   const planForges = repos.map((repo) => ({
     forge_id: repo.name,
     repo: repo.name,
-    target_dir: path44.join(targetDir, repo.name),
+    target_dir: path48.join(targetDir, repo.name),
     actions: filterSteps(planActionsFor(repo, targetDir, steps), steps)
   }));
   const plan = buildPlan({
@@ -21965,12 +23973,16 @@ var JSON_QUERY_COMMANDS = /* @__PURE__ */ new Set([
   "recommend",
   "env",
   "hosts",
+  "mcp",
   "lock",
   "profile",
   "recover",
   "ask",
   "predict",
   "context",
+  "install",
+  "uninstall",
+  "registry",
   "ai",
   "bundle",
   "learning"
@@ -21997,7 +24009,7 @@ async function main() {
   }
   if (shouldShowMenu(cli, Boolean(process.stdin.isTTY && process.stdout.isTTY))) {
     const next = await applyMenu(cli, {
-      ask: () => askMenu(),
+      ask: () => askMenu({}, menuItemsFor(cli)),
       workspace: askWorkspace,
       resolveDir: resolveTargetDir,
       pickRepos: async (dir) => {
@@ -22008,6 +24020,33 @@ async function main() {
           status: new Map(infos.map((i3) => [i3.name, i3]))
         });
         return chosen.map((r2) => r2.name);
+      },
+      pickRegistryCatalog: async () => {
+        const picked = await multiselect({
+          message: "Forjas para instalar do PyPI (registry-first)",
+          options: REGISTRY_PACKAGES.map((e) => ({
+            value: e.name,
+            label: e.name,
+            hint: `${e.dist} \xB7 python >=${e.minPython}`
+          })),
+          required: true
+        });
+        if (isCancel(picked)) exitCancelled();
+        return picked;
+      },
+      pickRegistryInstalled: async () => {
+        const installed = Object.keys(loadForgeState(cliHome()).forges);
+        if (!installed.length) {
+          log.warn("Nenhuma Forja instalada via registry ainda \u2014 instale primeiro.");
+          return [];
+        }
+        const picked = await multiselect({
+          message: "Forjas instaladas (registry)",
+          options: installed.map((n4) => ({ value: n4, label: n4 })),
+          required: true
+        });
+        if (isCancel(picked)) exitCancelled();
+        return picked;
       }
     });
     if (!next) {
@@ -22023,6 +24062,54 @@ async function main() {
     console.log(usage());
     process.exit(2);
   }
+  const REGISTRY_COMMANDS = /* @__PURE__ */ new Set([
+    "install",
+    "uninstall",
+    "update",
+    "reinstall",
+    "rollback",
+    "pin",
+    "unpin"
+  ]);
+  if (cli.method === "registry" && !REGISTRY_COMMANDS.has(resolved.command)) {
+    log.error(S.errMethodUnsupported);
+    process.exit(2);
+  }
+  if (cli.method === "registry" && resolved.command === "update") {
+    await runRegistryUpdate(cli, resolved.names);
+    return;
+  }
+  if (cli.method === "registry" && resolved.command === "reinstall") {
+    await runRegistryReinstall(cli, resolved.names);
+    return;
+  }
+  if (cli.method === "registry" && resolved.command === "rollback") {
+    await runRegistryRollback(cli, resolved.names);
+    return;
+  }
+  if (cli.method === "registry" && resolved.command === "pin") {
+    await runRegistryPin(cli, resolved.names, true);
+    return;
+  }
+  if (cli.method === "registry" && resolved.command === "unpin") {
+    await runRegistryPin(cli, resolved.names, false);
+    return;
+  }
+  const METHOD_COMMANDS = /* @__PURE__ */ new Set([
+    "run",
+    "install",
+    "clone",
+    "uninstall",
+    "update",
+    "reinstall",
+    "pin",
+    "unpin",
+    "rollback",
+    "wizard"
+  ]);
+  if (cli.method === "git" && !METHOD_COMMANDS.has(resolved.command)) {
+    log.warn(`--method git n\xE3o tem efeito em "${resolved.command}" \u2014 ignorado`);
+  }
   if (resolved.command === "doctor") {
     process.exitCode = await runDoctor2Command(cli);
     return;
@@ -22047,6 +24134,10 @@ async function main() {
     process.exitCode = await runHostsCommand(cli, resolved.names);
     return;
   }
+  if (resolved.command === "mcp") {
+    process.exitCode = await runMcpCommand(cli, resolved.names);
+    return;
+  }
   if (resolved.command === "wizard") {
     if (isNonInteractive(cli)) {
       log.error(S.errCloneNeedsNames);
@@ -22087,6 +24178,10 @@ async function main() {
     process.exitCode = await runBundleCommand(cli);
     return;
   }
+  if (resolved.command === "registry") {
+    runRegistryList(cli, { names: resolved.names });
+    return;
+  }
   if (resolved.command === "learning") {
     process.exitCode = await runLearningCommand(cli);
     return;
@@ -22151,6 +24246,10 @@ async function main() {
     await runUninstallCommand();
     return;
   }
+  if (resolved.command === "uninstall" && cli.method === "registry") {
+    await runRegistryUninstall(cli, resolved.names);
+    return;
+  }
   if (resolved.command === "uninstall" && !resolved.names.length && !isNonInteractive(cli)) {
     log.warn(S.warnLegacyUninstall);
     await runUninstallCommand();
@@ -22176,6 +24275,19 @@ async function main() {
     log.error(S.errReinstallNeedsNames);
     process.exit(2);
   }
+  if (resolved.command === "install" && cli.method === "registry") {
+    const names = resolved.names.length ? resolved.names : cli.all ? registryNames() : cli.only ?? [];
+    if (!names.length) {
+      log.error(S.errRegistryNeedsNames);
+      process.exit(2);
+    }
+    if (cli.ref && new Set(names.map((n4) => registryEntry(n4)?.name ?? n4)).size !== 1) {
+      log.error(S.errRefNeedsOne);
+      process.exit(2);
+    }
+    await runRegistryInstall(cli, names);
+    return;
+  }
   if (resolved.names.length) cli = { ...cli, only: [...cli.only ?? [], ...resolved.names] };
   const cloneOnly = resolved.command === "clone";
   if (cloneOnly && !isNonInteractive(cli)) {