@mutmutco/claude-plugin 4.6.4 → 4.6.5

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.6.4",
+  "version": "4.6.5",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1355,6 +1355,7 @@ __export(cli_shared_exports, {
   fail: () => fail,
   failGraceful: () => failGraceful,
   failGracefulEnvelope: () => failGracefulEnvelope,
+  ghFilingAppEnv: () => ghFilingAppEnv,
   gitOut: () => gitOut,
   githubLogin: () => githubLogin,
   hubHeaders: () => hubHeaders,
@@ -1385,10 +1386,10 @@ function setGhReadTokenProvider(provider) {
 function setGhWriteTokenProvider(provider) {
   ghWriteTokenProvider = provider;
 }
-async function ghFilingAppEnv(file, args) {
-  if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
+async function ghFilingAppEnv(file, args, requireApp = false) {
+  if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || !requireApp && process.env.MMI_ACTOR?.trim() === "personal") return void 0;
   if (!isAppFilingWrite(args)) return void 0;
-  const explicitApp = process.env.MMI_ACTOR?.trim() === "app";
+  const explicitApp = requireApp || process.env.MMI_ACTOR?.trim() === "app";
   let token;
   try {
     token = await ghWriteTokenProvider();
@@ -1616,7 +1617,7 @@ var init_cli_shared = __esm({
         const pool = appEnv ? "app" : !callerEnv ? ambientPool() : !callerEnv.GH_TOKEN ? "personal" : callerEnv.MMI_GH_POOL === "app" ? "app" : callerEnv.GH_TOKEN === process.env.GH_TOKEN ? ambientPool() : "caller";
         recordGhUsage("gh", pool, args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" "));
       }
-      if (!appEnv) return tag(run(), "user");
+      if (!appEnv) return tag(run(), options.env?.MMI_GH_POOL === "app" ? "app_installation" : "user");
       try {
         return await tag(run(appEnv), "app_installation");
       } catch (e) {
@@ -23741,10 +23742,14 @@ async function claimOneBoardItem(ctx, selector, options) {
       return;
     }
     if (!options.force) {
+      if (options.bulk) {
+        const { holder: holder2, why } = laneContestParts(contest);
+        throw new Error(isUnknownHold(contest) ? `${item.ref} cannot be verified as free: ${holder2} (${why}); the liveness reads failed so the claim is refused fail-closed \u2014 ${CONTESTED_CLAIM_RECOVERY}` : `${item.ref} is already claimed by ${holder2} with live evidence of active work (${why}); ${CONTESTED_CLAIM_RECOVERY}`);
+      }
       const candidateRefs = [...report.primary.claimable, ...report.secondary.claimable].filter((candidate) => candidate.contentType === "Issue" && candidate.state === "OPEN" && !candidate.claim?.currentlyClaimed && !ctx.selectedRefs.has(candidate.ref.toLowerCase())).map((candidate) => candidate.ref);
       const alternatives = candidateRefs.length ? `Board snapshot candidates (not guaranteed free): ${candidateRefs.join(", ")}` : "Board snapshot candidates: none in this read";
       const refusal = `${laneContestMessage(item.ref, contest, "claim")}. ${alternatives}; refresh mmi-cli oracle board read before claiming.`;
-      throw new Error(options.bulk ? refusal : withGatedWriteChainHint(refusal));
+      throw new Error(withGatedWriteChainHint(refusal));
     }
     previousHolder = displaced();
   };
@@ -23799,6 +23804,13 @@ async function claimBoardIssue(options, deps = {}) {
   const result = await claimOneBoardItem(ctx, selector, options);
   return ctx.report.warnings.length ? { ...result, warnings: [...ctx.report.warnings] } : result;
 }
+function formatBulkClaimSummary(results) {
+  const skipped = results.filter((r) => !r.claimed);
+  if (skipped.length === 0) return void 0;
+  const landed = results.filter((r) => r.claimed).map((r) => r.ref);
+  const notClaimed = skipped.map((r) => `${r.ref}${/already claimed by /i.test(r.reason) ? " (held by another lane)" : ""}`);
+  return `claimed ${landed.length} of ${results.length}: ${landed.length ? `${landed.join(", ")} landed` : "none landed"}; not claimed: ${notClaimed.join(", ")}`;
+}
 async function claimBoardIssues(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
   const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
@@ -27388,10 +27400,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.4",
-    tag: "v4.6.4",
-    commit: "db079140cdfb",
-    npm: "@mutmutco/cli@4.6.4"
+    version: "4.6.5",
+    tag: "v4.6.5",
+    commit: "cd6f8a959ed5",
+    npm: "@mutmutco/cli@4.6.5"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27408,14 +27420,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.4"
+          v3Target: "v4.6.5"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.4 and redeploy the Hub Lambda from tag v4.6.4 (db079140cdfb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.4 (@mutmutco/cli@4.6.4, tag commit db079140cdfb \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.5 and redeploy the Hub Lambda from tag v4.6.5 (cd6f8a959ed5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.5 (@mutmutco/cli@4.6.5, tag commit cd6f8a959ed5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -41941,6 +41953,13 @@ var writeApi = async (args) => {
   const { stdout, credential } = await execFileP("gh", ["api", ...args], { timeout: GH_MUTATION_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 });
   return { stdout, credential };
 };
+var autoMergeApi = async (pr, repo, head) => {
+  const args = ["pr", "merge", pr, "-R", repo, "--squash", "--auto", "--match-head-commit", head];
+  const env = await ghFilingAppEnv("gh", args, true);
+  if (!env) throw new Error("app actor: filing write token unavailable for merge-queue auto-merge fallback");
+  await execFileP("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024, env });
+  return { credential: "app_installation" };
+};
 var ASYNC_HEADERS = ["-H", "Accept: application/vnd.github+json", "-H", "X-GitHub-Api-Version: 2026-03-10"];
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
 function admissionJournal(repo, pr, root) {
@@ -42017,6 +42036,21 @@ function admissionResponse(output) {
   }
   return { code: Number(response[1]), body: result };
 }
+function admissionRejected(reason) {
+  if (/enqueuer is not authorized to merge|not authorized to merge/i.test(reason)) {
+    return {
+      mergeStatus: "failed",
+      retryable: false,
+      admissionCause: "enqueuer-not-authorized",
+      error: `queue admission rejected (missing merge permission): ${reason}. The landing identity reported in \`credential\` may not merge into this base through the merge queue. Granting it (the GitHub App's merge permission, or a ruleset bypass) is a repository or organization setting only an admin can change; do not rerun pr land until that grant exists, and never fall back to a personal token.`
+    };
+  }
+  return {
+    mergeStatus: "failed",
+    retryable: false,
+    error: `queue admission rejected: ${reason}. Resolve the reported cause, then explicitly rerun pr land; it will repeat preflight before a new request.`
+  };
+}
 async function submitQueueAdmission(pr, repo, head, read, write, options, resume = false) {
   const unknown = (reason) => ({
     mergeStatus: "failed",
@@ -42024,11 +42058,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     outcomeUnknown: true,
     error: `queue submission outcome unknown: ${reason}. Preserve the receipt and rerun pr land to reconcile read-only; no new request was sent after this uncertainty.`
   });
-  const rejected = (reason) => ({
-    mergeStatus: "failed",
-    retryable: false,
-    error: `queue admission rejected: ${reason}. Resolve the reported cause, then explicitly rerun pr land; it will repeat preflight before a new request.`
-  });
+  const rejected = admissionRejected;
   const reconcile = async (reason, recordEntry = false) => {
     try {
       const observed = await readPrMergeQueue(pr, repo, read);
@@ -42138,13 +42168,45 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       }
       return reconcile(`GitHub reported ${body.status}, but matching-head membership or merged state is unconfirmed`, body.status === "enqueued");
     }
+    const tryAutoMergeFallback = async (reason, uuid) => {
+      const autoMerge = options.autoMerge ?? (write === writeApi ? autoMergeApi : void 0);
+      if (!/enqueuer is not authorized to merge/i.test(reason) || !autoMerge) return void 0;
+      try {
+        const fallback = await autoMerge(pr, repo, head);
+        const fallbackCredential = fallback?.credential ?? credential ?? receipt?.credential;
+        const observed = await readPrMergeQueue(pr, repo, read);
+        if (observed.state === "MERGED" && observed.headRefOid === head) {
+          try {
+            journal.save("merged", uuid, void 0, fallbackCredential);
+          } catch {
+            return reconcile("the completed auto-merge fallback could not be checkpointed");
+          }
+          return { mergeStatus: "merged" };
+        }
+        if (observed.isInMergeQueue && observed.headRefOid === head) {
+          const entry = observed.mergeQueueEntry;
+          const queueEntry = entry?.headCommit && entry.enqueuedAt ? { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt } : void 0;
+          try {
+            journal.save("enqueued", uuid, queueEntry, fallbackCredential);
+          } catch {
+            return reconcile("the enqueued auto-merge fallback could not be checkpointed");
+          }
+          return { mergeStatus: "auto-merge-enqueued" };
+        }
+      } catch {
+      }
+      return void 0;
+    };
     if (code === 400 || code === 403 || code === 404 || code === 422) {
+      const reason = body.details?.message ?? body.message ?? `HTTP ${code}`;
+      const fallbackResult = await tryAutoMergeFallback(reason);
+      if (fallbackResult) return fallbackResult;
       try {
         journal.save("failed", void 0, void 0, credential);
       } catch {
         return unknown("the explicit rejection could not be checkpointed");
       }
-      return rejected(body.details?.message ?? body.message ?? `HTTP ${code}`);
+      return rejected(reason);
     }
     const details = body.details;
     if (code !== 202 && code !== 409 || body.status !== "pending" || !UUID.test(details?.uuid ?? "")) return reconcile("the send returned no recognized admission result");
@@ -42175,6 +42237,36 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       continue;
     }
     if (!["failed", "enqueued", "merged"].includes(status ?? "")) return reconcile("the operation returned an unrecognized state");
+    if (status === "failed") {
+      const reason = details?.message ?? "GitHub reported a failed operation";
+      const autoMerge = options.autoMerge ?? (write === writeApi ? autoMergeApi : void 0);
+      if (/enqueuer is not authorized to merge/i.test(reason) && autoMerge && receipt.head === head) {
+        try {
+          const fallback = await autoMerge(pr, repo, head);
+          const fallbackCredential = fallback?.credential ?? receipt?.credential;
+          const observed = await readPrMergeQueue(pr, repo, read);
+          if (observed.state === "MERGED" && observed.headRefOid === head) {
+            try {
+              journal.save("merged", receipt.uuid, void 0, fallbackCredential);
+            } catch {
+              return reconcile("the completed auto-merge fallback could not be checkpointed");
+            }
+            return { mergeStatus: "merged" };
+          }
+          if (observed.isInMergeQueue && observed.headRefOid === head) {
+            const entry = observed.mergeQueueEntry;
+            const queueEntry = entry?.headCommit && entry.enqueuedAt ? { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt } : void 0;
+            try {
+              journal.save("enqueued", receipt.uuid, queueEntry, fallbackCredential);
+            } catch {
+              return reconcile("the enqueued auto-merge fallback could not be checkpointed");
+            }
+            return { mergeStatus: "auto-merge-enqueued" };
+          }
+        } catch {
+        }
+      }
+    }
     try {
       journal.save(status, receipt.uuid);
     } catch {
@@ -42513,22 +42605,24 @@ function registerCancelOrphans(ci2, writeToken) {
   });
 }
 var RUN_CANCEL_STATUS = "cancel-requested";
-async function cancelWorkflowRun(repo, id, deps) {
+var RUN_FORCE_CANCEL_STATUS = "force-cancel-requested";
+async function cancelWorkflowRun(repo, id, deps, force = false) {
   const raw = String(id).trim();
   if (!/^[1-9]\d*$/.test(raw)) throw new Error(`run cancel: <id> must be a positive workflow run id (received '${String(id)}')`);
   const runId = Number(raw);
   if (!Number.isSafeInteger(runId)) throw new Error(`run cancel: <id> ${raw} is beyond the safe integer range; refusing to address a different run`);
   if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`run cancel: --repo must be owner/repo (received '${repo}')`);
   try {
-    await deps.cancel(repo, runId);
+    if (force && deps.forceCancel) await deps.forceCancel(repo, runId);
+    else await deps.cancel(repo, runId);
   } catch (error) {
     const detail = String(error.stderr ?? error);
     throw new Error(/\b403\b/.test(detail) ? "run cancel: GitHub App denied (HTTP 403); actions:write permission is required; no personal-token fallback" : `run cancel: ${detail}`);
   }
-  return { ok: true, repo, runId, status: RUN_CANCEL_STATUS };
+  return { ok: true, repo, runId, ...force ? { force: true } : {}, status: force ? RUN_FORCE_CANCEL_STATUS : RUN_CANCEL_STATUS };
 }
 function registerRunCancel(run, writeToken) {
-  run.command("cancel <id>").description("cancel one queued or in-progress workflow run on the org App (actions:write); requests the cancel and prints a receipt").requiredOption("--repo <owner/repo>", "repository that owns the run").option("--json", "machine-readable receipt").action(async (id, options) => {
+  run.command("cancel <id>").description("cancel one queued or in-progress workflow run on the org App (actions:write); requests the cancel and prints a receipt").requiredOption("--repo <owner/repo>", "repository that owns the run").option("--force", "force-cancel the run so always() jobs stop too (#9512)").option("--json", "machine-readable receipt").action(async (id, options) => {
     let receipt;
     try {
       receipt = await cancelWorkflowRun(options.repo, id, {
@@ -42538,13 +42632,20 @@ function registerRunCancel(run, writeToken) {
             timeout: 2e4,
             env: { ...process.env, GH_TOKEN: token }
           });
+        },
+        forceCancel: async (repo, runId) => {
+          const token = await writeToken();
+          await execFileP("gh", ["api", `repos/${repo}/actions/runs/${runId}/force-cancel`, "--method", "POST"], {
+            timeout: 2e4,
+            env: { ...process.env, GH_TOKEN: token }
+          });
         }
-      });
+      }, options.force === true);
     } catch (error) {
       return fail(error.message);
     }
     if (options.json) console.log(JSON.stringify(receipt));
-    else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 cancel requested (status: ${receipt.status})`);
+    else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status})`);
   });
 }
 
@@ -42963,6 +43064,8 @@ function registerBoardCommands(program3) {
           console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
           if (result.claimed) for (const line of formatDecisionLines(result.ref, ruled[i].decisions ?? [])) console.log(line);
         });
+        const summary = formatBulkClaimSummary(bulk.results);
+        if (summary) console.log(summary);
         printClaimWarnings([...bulk.warnings ?? [], ...rulingWarnings]);
       }
       if (bulk.failed > 0) process.exitCode = 1;
@@ -65735,11 +65838,17 @@ function tagsReadHint(path2) {
   const slug = `${match[1]}/${match[2]}`;
   return ` No App-token REST read exists for git tags or refs \u2014 read git tags directly with \`git ls-remote --tags origin 'refs/tags/*'\` (no token needed; \`git ls-remote origin refs/tags/<tag>\` for one tag), or read tag-backed GitHub Releases with \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/releases?per_page=20"\`.`;
 }
+function branchRulesReadHint(path2) {
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:rules/branches/[^/?#]+|branches/[^/?#]+/protection(?:/|$)|rulesets(?:/|$))`).exec(path2.split("?")[0]);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`.`;
+}
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -69457,7 +69566,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans") return;
+  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel") return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -70294,7 +70403,7 @@ registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
 registerRunCancel(
   program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` is the only one, and it rides the org App actions:write profile"),
-  async () => (await mintCommandWriteToken(appActorDeps(), "run cancel")).token
+  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token
 );
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.4",
+  "version": "4.6.5",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.6.4",
+  "version": "4.6.5",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/org-guide/references/work-and-releases.md

@@ -165,7 +165,11 @@ that actually ships in the cut: the train refuses an issue or PR number the rele
 commit, so build and verify the lines from one pass over that range —
 `git log --stat --format='%h %s%n%b' origin/main..origin/development`, which carries each commit's
 subject, body and changed files — never from subjects, PR titles or memory; a line whose claim is not
-in that output does not go in the file. A Hub summary never mentions a Jerv-side project; the train
+in that output does not go in the file. Release recovery can re-cut the same `v*` tag on a new SHA, so
+other checkouts still holding the old tag reject a plain `git fetch origin --tags` (`would clobber existing tag`);
+refresh tags with `git fetch origin --tags --force` (or `git fetch origin '+refs/tags/*:refs/tags/*'`) and
+never chain a plain tag fetch with `&&` ahead of a read-only `git log <tag>..origin/<branch>` range (#9517).
+A Hub summary never mentions a Jerv-side project; the train
 refuses such a line.
 Every new MM-Work suite Release, solo and hotfix included, requires `--announce-summary-file` and `--announce-summary-file-tr` in the bilingual update-notes template of the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md#update-notes) (`Fixed`/`Düzeldi`, then `New`/`Yeni`, with `<Area>: <sentence>.` lines; a Fixed line states what works now, never the problem). A suite release requires `--member-summary-file owner/repo=path` and `--member-summary-file-tr owner/repo=path` for every member it releases. A suite cut's `--owner-go` records the owner's explicit go for that one cut, never an agent's own decision: a held train or stale MM-Work cut goes to the suite orchestrator with the exact owner-gated commands. On its own an agent runs only `suite rcand --dry-run` and `suite hotfix <member> --dry-run`; it never runs `suite release` or `suite abandon`, which have no dry-run. Details: the release skill.