@mutmutco/claude-plugin 4.5.163 → 4.5.165

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.163",
+  "version": "4.5.165",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -14631,6 +14631,15 @@ function latestClaimMarker(comments) {
   }
   return void 0;
 }
+function latestClaimRelease(comments) {
+  for (let i = comments.length - 1; i >= 0; i -= 1) {
+    const body = comments[i].body;
+    const releases = parseClaimReleases(body);
+    if (!parseClaimMarkers(body).length && !releases.length) continue;
+    return latestClaimMarker([comments[i]]) ? void 0 : releases[releases.length - 1];
+  }
+  return void 0;
+}
 function formatClaimAge(ageMs) {
   if (ageMs === void 0 || !Number.isFinite(ageMs) || ageMs < 0) return "unknown age";
   const minutes = Math.floor(ageMs / 6e4);
@@ -14838,6 +14847,7 @@ async function gatherClaimLiveness(client, repo, number, fetchOpenPulls) {
     const comments = await client.restPaginate(`repos/${repo}/issues/${number}/comments`);
     const rows = comments.map((comment) => ({ body: comment.body ?? "", login: comment.user?.login ?? void 0 }));
     out.marker = latestClaimMarker(rows);
+    if (!out.marker) out.releasedAt = latestClaimRelease(rows)?.ts;
     for (let i = comments.length - 1; i >= 0; i -= 1) {
       if (comments[i].created_at && !latestClaimMarker([rows[i]])) {
         out.lastCommentAt = comments[i].created_at;
@@ -14919,8 +14929,9 @@ function liveEvidenceLines(evidence, repo) {
       live.push(evidence.lastCommentAt && Date.parse(evidence.lastCommentAt) > Date.parse(evidence.marker.ts) ? `claim marker from ${marker} is ${formatClaimAge(evidence.markerAgeMs)} old but the issue was commented ${formatClaimAge(idleMs)} ago (session not locally probeable)` : `claim marker from ${marker} is only ${formatClaimAge(evidence.markerAgeMs)} old (session not locally probeable)`);
     }
   }
-  if (evidence.openPr && workIsLive(evidence.openPrAt)) live.push(evidence.openPr);
-  if (evidence.branch && workIsLive(evidence.branchAt)) live.push(`live branch ${evidence.branch} on ${repo}`);
+  const sinceRelease = (at) => !evidence.releasedAt || at === void 0 || Date.parse(at) > Date.parse(evidence.releasedAt);
+  if (evidence.openPr && workIsLive(evidence.openPrAt) && sinceRelease(evidence.openPrAt)) live.push(evidence.openPr);
+  if (evidence.branch && workIsLive(evidence.branchAt) && sinceRelease(evidence.branchAt)) live.push(`live branch ${evidence.branch} on ${repo}`);
   return live;
 }
 function staleWorkLines(evidence) {
@@ -19051,10 +19062,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.163",
-    tag: "v4.5.163",
-    commit: "0d3f3c9549d7",
-    npm: "@mutmutco/cli@4.5.163"
+    version: "4.5.165",
+    tag: "v4.5.165",
+    commit: "e50afbd193c3",
+    npm: "@mutmutco/cli@4.5.165"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19071,14 +19082,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.163"
+          v3Target: "v4.5.165"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.163 and redeploy the Hub Lambda from tag v4.5.163 (0d3f3c9549d7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.163 (@mutmutco/cli@4.5.163, tag commit 0d3f3c9549d7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.165 and redeploy the Hub Lambda from tag v4.5.165 (e50afbd193c3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.165 (@mutmutco/cli@4.5.165, tag commit e50afbd193c3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -33317,7 +33328,7 @@ function parseGateVar(raw) {
 }
 var SECRET_OUTPUT_PATH_RE = /^\/[A-Za-z0-9._/-]+$/;
 var SECRET_OUTPUT_REPO_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/;
-var SECRET_OUTPUT_KEY_RE = /^[A-Z][A-Z0-9_]*$/;
+var SECRET_OUTPUT_KEY_RE = /^(?:(?:dev|rc|main)\/)?[A-Z][A-Z0-9_]*$/;
 function parseTenantTaskSecretOutput(raw, label) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
     throw new Error(`org project set: ${label} must be an object {path,vault:{repo,key},overwrite?}`);
@@ -33341,7 +33352,7 @@ function parseTenantTaskSecretOutput(raw, label) {
     throw new Error(`org project set: ${label}.vault.repo must be owner/name`);
   }
   if (typeof vaultMap.key !== "string" || !SECRET_OUTPUT_KEY_RE.test(vaultMap.key)) {
-    throw new Error(`org project set: ${label}.vault.key must be UPPER_SNAKE`);
+    throw new Error(`org project set: ${label}.vault.key must be UPPER_SNAKE or <dev|rc|main>/UPPER_SNAKE`);
   }
   if (value.overwrite !== void 0 && typeof value.overwrite !== "boolean") {
     throw new Error(`org project set: ${label}.overwrite must be true or false`);
@@ -40963,13 +40974,30 @@ async function runPrLand(prNumber, options, deps) {
   }
   const ciPolicy = await deps.resolveCiPolicy(repo);
   base.ciPolicy = ciPolicy;
+  const pinned = options.expectHead;
+  if (pinned) base.pinnedHead = { expected: pinned };
+  const headDrift = async (stage) => {
+    if (!pinned) return void 0;
+    if (!deps.readHeadSha) throw new Error("pinned head reader unavailable");
+    const observed = await deps.readHeadSha(prNumber, repo);
+    base.pinnedHead = { expected: pinned, observed };
+    if (observed === pinned) return void 0;
+    return {
+      ...base,
+      pinnedHead: { ...base.pinnedHead, refused: "drift" },
+      error: `pr land #${prNumber}: head ${observed} is not the pinned ${pinned} (${stage}) \u2014 refusing to land a head that was not checked (--expect-head)`
+    };
+  };
+  const drift = await headDrift("before landing");
+  if (drift) return drift;
   const hasQueue = await deps.hasMergeQueue?.(repo, resolved.base) ?? false;
   let queueSnapshot;
+  const queued = { base: resolved.base, state: "queued" };
   if (hasQueue) {
-    base.mergeQueue = { base: resolved.base, state: "queued" };
     if (!deps.readMergeQueue) throw new Error("merge queue reader unavailable");
     queueSnapshot = await deps.readMergeQueue(prNumber, repo);
     if (queueSnapshot.isInMergeQueue || queueSnapshot.state === "MERGED") {
+      base.mergeQueue = queued;
       base.mergeStatus = "auto-merge-enqueued";
       return pollPrMergeQueue(prNumber, options, deps, base, queueSnapshot);
     }
@@ -40986,7 +41014,16 @@ async function runPrLand(prNumber, options, deps) {
   base.checksWait = await deps.waitForChecks(prNumber, repo);
   const waitError = checksWaitError(base.checksWait);
   if (waitError) return { ...base, error: waitError };
+  const driftAfterChecks = await headDrift("after checks");
+  if (driftAfterChecks) return driftAfterChecks;
   let prState = await deps.readPrState(prNumber, repo);
+  if (pinned && prState.mergeStateStatus === "BEHIND") {
+    return {
+      ...base,
+      pinnedHead: { ...base.pinnedHead, refused: "behind" },
+      error: `pr land #${prNumber}: head is BEHIND ${resolved.base} and pinned by --expect-head \u2014 refusing to update it. Update and re-check the head yourself, then land with the new SHA`
+    };
+  }
   if (prState.mergeStateStatus === "BEHIND" && deps.updateBranch) {
     try {
       base.branchUpdated = await deps.updateBranch(prNumber, repo);
@@ -41010,6 +41047,7 @@ async function runPrLand(prNumber, options, deps) {
     return { ...base, error: merge.error ?? "merge failed" };
   }
   if (hasQueue) {
+    base.mergeQueue = queued;
     if (merge.mergeStatus === "merged") {
       return queueMerged(base, deps);
     }
@@ -41080,6 +41118,7 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
       const result2 = {
         ...base,
         mergeQueue: { ...base.mergeQueue, state: "ejected", ...run ? { ejectedRun: run } : {} },
+        ...base.pinnedHead ? { pinnedHead: { ...base.pinnedHead, refused: "ejected" } } : {},
         error: `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}`
       };
       deps.queueProgress?.(result2);
@@ -41105,7 +41144,7 @@ async function landMany(prs, landOne, cleanup, hooks) {
   const safe = async (pr) => landOne(pr).catch((e) => ({ status: "failed", repo: "", pr, base: "", error: e.message }));
   return Promise.all(prs.map(async (pr) => {
     let result = await safe(pr);
-    if (prLandOutcome(result) === "ejected") {
+    if (prLandOutcome(result) === "ejected" && !result.pinnedHead) {
       hooks?.onRetry?.(pr, result);
       result = { ...await safe(pr), retriedAfterEjection: true };
     }
@@ -41985,6 +42024,7 @@ function buildPrMergeArgs(input) {
   const args = ["pr", "merge", input.number, ...input.repoArgs, input.method];
   if (input.deleteBranch !== false) args.push("--delete-branch");
   if (input.bodyFile) args.push("--body-file", input.bodyFile);
+  if (input.matchHeadCommit) args.push("--match-head-commit", input.matchHeadCommit);
   if (input.auto) args.push("--auto");
   return args;
 }
@@ -42226,12 +42266,12 @@ async function ghMergeAutoEnqueue(prNumber, repo, method, extra) {
     bodyText: method === "--squash" ? extra?.bodyText : void 0
   });
   try {
-    return await mergeAutoEnqueueWithBody(prNumber, args, method, io, overrideBody?.path, extra?.mergeQueue);
+    return await mergeAutoEnqueueWithBody(prNumber, args, method, io, overrideBody?.path, extra?.mergeQueue, extra?.matchHeadCommit);
   } finally {
     overrideBody?.cleanup();
   }
 }
-async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, mergeQueue = false) {
+async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, mergeQueue = false, matchHeadCommit) {
   const headRef = (await io.gh(["pr", "view", prNumber, ...args, "--json", "headRefName", "--jq", ".headRefName"], GC_GH_TIMEOUT_MS).catch(() => "")).trim();
   const deleteBranch = !mergeQueue && !isProtectedBranch(headRef);
   const readMergeState = () => readGhPrStateWithRetry(
@@ -42251,7 +42291,7 @@ async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, me
         return s.ok && s.state === "MERGED";
       },
       reEnqueue: async () => {
-        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
+        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile, matchHeadCommit }), GH_MUTATION_TIMEOUT_MS);
       }
     });
     if (confirmation === "merged") return { mergeStatus: "merged" };
@@ -42259,7 +42299,7 @@ async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, me
     return { mergeStatus: "failed", error: "auto-merge did not stick \u2014 GitHub reported no autoMergeRequest after enqueue; retry once the PR has a pending check" };
   };
   try {
-    await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
+    await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile, matchHeadCommit }), GH_MUTATION_TIMEOUT_MS);
   } catch (e) {
     const message2 = String(e.message || "");
     if (/already been merged/i.test(message2)) return { mergeStatus: "merged" };
@@ -42267,7 +42307,7 @@ async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, me
     if (note) return { mergeStatus: "failed", error: note };
     if (mergeAutoRejectedPrAlreadyClean(message2)) {
       try {
-        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: false, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
+        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: false, deleteBranch, bodyFile, matchHeadCommit }), GH_MUTATION_TIMEOUT_MS);
       } catch (e2) {
         const m2 = String(e2.message || "");
         if (/already been merged/i.test(m2)) return { mergeStatus: "merged" };
@@ -42278,7 +42318,7 @@ async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, me
             return { mergeStatus: "failed", error: `could not confirm PR state after clean-status fallback: ${afterDirect.error}` };
           }
           try {
-            await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
+            await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile, matchHeadCommit }), GH_MUTATION_TIMEOUT_MS);
           } catch (e3) {
             const m3 = String(e3.message || "");
             if (/already been merged/i.test(m3)) return { mergeStatus: "merged" };
@@ -47844,9 +47884,14 @@ ${list}`);
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 the queue's own check timeout is 60)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").action(async (numbers, opts) => {
+  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 the queue's own check timeout is 60)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
     const timeoutMinutes = opts.timeout === void 0 ? void 0 : Number(opts.timeout);
     if (timeoutMinutes !== void 0 && !(timeoutMinutes > 0)) return fail("pr land: --timeout must be a positive number of minutes");
+    if (opts.expectHead !== void 0) {
+      if (!/^[0-9a-f]{40}$/i.test(opts.expectHead)) return fail("pr land: --expect-head needs the full 40-hex head SHA");
+      if (numbers.length !== 1) return fail("pr land: --expect-head pins one PR head; land one PR per call");
+      opts.expectHead = opts.expectHead.toLowerCase();
+    }
     const queueTimeoutMs = timeoutMinutes !== void 0 ? Math.round(timeoutMinutes * 6e4) : PR_LAND_QUEUE_TIMEOUT_MS * Math.ceil(numbers.length / PR_LAND_QUEUE_BATCH_SIZE);
     let inFlight = numbers.length;
     const landOne = async (numberArg) => {
@@ -47887,7 +47932,12 @@ ${list}`);
       }
       if (landClosingGuardVerdict.message) console.warn(landClosingGuardVerdict.message);
       let mergeQueueEnabled = false;
-      const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false, enqueueOnly: o.enqueueOnly, queueTimeoutMs }, {
+      const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false, enqueueOnly: o.enqueueOnly, queueTimeoutMs, expectHead: o.expectHead }, {
+        readHeadSha: async (prNumber, repo) => {
+          const sha = (await fetchRestPrSnapshot(prNumber, repo)).headSha;
+          if (!sha) throw new Error(`pr land: could not read the head SHA of PR #${prNumber}`);
+          return sha.toLowerCase();
+        },
         pollDelayMs: (attempt) => prLandPollDelayMs(attempt, inFlight),
         hasMergeQueue: async (repo, base) => mergeQueueEnabled = await hasPrMergeQueue(repo, base),
         readMergeQueue: readPrMergeQueue,
@@ -47985,9 +48035,11 @@ ${list}`);
         mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--squash", {
           allowedClosing: landClosingGuardInput?.closing,
           bodyText: landSquashBody,
-          mergeQueue: mergeQueueEnabled
+          mergeQueue: mergeQueueEnabled,
+          matchHeadCommit: o.expectHead
         }),
-        updateBranch: (prNumber, repo) => prLandUpdateBranch(prNumber, repo, Boolean(o.repo)),
+        // #8456: a pinned land has no update lane at all.
+        ...o.expectHead ? {} : { updateBranch: (prNumber, repo) => prLandUpdateBranch(prNumber, repo, Boolean(o.repo)) },
         pollMerged: async (prNumber, repo, deadlineMs) => {
           let lastFailure;
           while (Date.now() < deadlineMs) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.163",
+  "version": "4.5.165",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.163",
+  "version": "4.5.165",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",