@mutmutco/cli 2.30.0 → 2.31.0

package/dist/index.cjs

@@ -23,18 +23,28 @@ var init_compat = __esm({
 });
 
 // src/client-version.ts
-function resolveClientVersion() {
+function resolveClientVersionManifestCandidates(distDir = __dirname) {
+  return [
+    (0, import_node_path.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
+    (0, import_node_path.join)(distDir, "..", "..", ".cursor-plugin", "plugin.json"),
+    (0, import_node_path.join)(distDir, "..", "..", ".codex-plugin", "plugin.json"),
+    (0, import_node_path.join)(distDir, "..", "package.json")
+  ];
+}
+function readVersionFromManifest(path) {
   try {
-    const manifest = (0, import_node_path.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
-    return JSON.parse((0, import_node_fs.readFileSync)(manifest, "utf8")).version || "0.0.0";
+    const version = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8")).version;
+    return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
-    try {
-      const pkg = (0, import_node_path.join)(__dirname, "..", "package.json");
-      return JSON.parse((0, import_node_fs.readFileSync)(pkg, "utf8")).version || "0.0.0";
-    } catch {
-      return "0.0.0";
-    }
+    return null;
+  }
+}
+function resolveClientVersion() {
+  for (const manifest of resolveClientVersionManifestCandidates()) {
+    const version = readVersionFromManifest(manifest);
+    if (version) return version;
   }
+  return "0.0.0";
 }
 var import_node_fs, import_node_path;
 var init_client_version = __esm({

package/dist/main.cjs

@@ -3473,19 +3473,29 @@ function versionAtLeast(v, min) {
 }
 
 // src/client-version.ts
-function resolveClientVersion() {
+function resolveClientVersionManifestCandidates(distDir = __dirname) {
+  return [
+    (0, import_node_path2.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "..", ".cursor-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "..", ".codex-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "package.json")
+  ];
+}
+function readVersionFromManifest(path2) {
   try {
-    const manifest = (0, import_node_path2.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
-    return JSON.parse((0, import_node_fs2.readFileSync)(manifest, "utf8")).version || "0.0.0";
+    const version = JSON.parse((0, import_node_fs2.readFileSync)(path2, "utf8")).version;
+    return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
-    try {
-      const pkg = (0, import_node_path2.join)(__dirname, "..", "package.json");
-      return JSON.parse((0, import_node_fs2.readFileSync)(pkg, "utf8")).version || "0.0.0";
-    } catch {
-      return "0.0.0";
-    }
+    return null;
   }
 }
+function resolveClientVersion() {
+  for (const manifest of resolveClientVersionManifestCandidates()) {
+    const version = readVersionFromManifest(manifest);
+    if (version) return version;
+  }
+  return "0.0.0";
+}
 function clientVersionHeaders() {
   return { [CLIENT_VERSION_HEADER]: resolveClientVersion() };
 }
@@ -7268,10 +7278,59 @@ function buildPanelPlan(input) {
 }
 
 // src/gc.ts
+var DEFERRED_SWEEP_COMMAND = "mmi-cli gc --apply";
+var DEFERRED_NOTE = "Worktree cleanup deferred \u2014 close this folder in your editor (or run cleanup from a shell outside it), then rerun mmi-cli gc --apply.";
 var WORKTREE_LOCK_RE = /EPERM|EBUSY|EACCES|ENOTEMPTY|permission denied|access is denied|used by another process|resource busy|directory not empty/i;
 function isWorktreeLockError(error) {
   return WORKTREE_LOCK_RE.test(error instanceof Error ? error.message : String(error));
 }
+function deferredWorktreesRegistryPath(gitDir) {
+  const base2 = gitDir.replace(/\\/g, "/").replace(/\/+$/, "");
+  return `${base2}/mmi-deferred-worktrees.json`;
+}
+function parseDeferredWorktreesFile(text) {
+  const parsed = JSON.parse(text);
+  if (!parsed || !Array.isArray(parsed.entries)) return [];
+  return parsed.entries.filter((e) => Boolean(e) && typeof e === "object" && typeof e.path === "string" && typeof e.branch === "string" && e.reason === "lock-held").map((e) => ({ ...e, registeredAt: e.registeredAt || (/* @__PURE__ */ new Date(0)).toISOString() }));
+}
+function serializeDeferredWorktrees(entries) {
+  return `${JSON.stringify({ entries }, null, 2)}
+`;
+}
+function deferredPathKey(path2) {
+  return normPath(path2);
+}
+function isPersistentWorktreeLockFailure(outcome) {
+  return outcome.status === "failed" && isWorktreeLockError(outcome.error);
+}
+async function registerDeferredWorktree(store, entry) {
+  const existing = await store.read();
+  const key = deferredPathKey(entry.path);
+  const already = existing.some((e) => deferredPathKey(e.path) === key);
+  if (already) return { entries: existing, newlyRegistered: false };
+  const next = {
+    ...entry,
+    registeredAt: entry.registeredAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    reason: "lock-held"
+  };
+  const entries = [...existing, next];
+  await store.write(entries);
+  return { entries, newlyRegistered: true };
+}
+async function sweepDeferredWorktrees(store, deps) {
+  if (!store) return { removed: [], stillDeferred: [] };
+  const entries = await store.read();
+  if (!entries.length) return { removed: [], stillDeferred: [] };
+  const removed = [];
+  const stillDeferred = [];
+  for (const entry of entries) {
+    const outcome = await removeWorktreeWithRecovery(entry.path, deps);
+    if (outcome.status === "removed") removed.push(entry.path);
+    else stillDeferred.push(entry);
+  }
+  await store.write(stillDeferred);
+  return { removed, stillDeferred };
+}
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function removeWorktreeWithRecovery(wtPath, deps) {
   const maxAttempts = deps.maxAttempts ?? 3;
@@ -7337,7 +7396,9 @@ function summarizePrMergeCleanupStatus(input) {
   if (input.remoteBranch.status === "failed") return "warnings";
   if (input.localBranch.status === "failed") return "warnings";
   if (input.localBranch.reason === "worktree-removal-failed") return "warnings";
+  if (input.localBranch.reason === "worktree-removal-deferred") return "warnings";
   if (input.worktree?.status === "failed") return "warnings";
+  if (input.worktree?.status === "deferred") return "warnings";
   return "clean";
 }
 function buildPrMergeResultPayload(input) {
@@ -7600,6 +7661,12 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const wtPath = selectPrMergeCleanupWorktree(branch, beforeWorktrees, afterWorktrees, options.startingPath);
   const safeCwd = selectSafeWorktreeCwd([...afterWorktrees, ...beforeWorktrees], wtPath);
   const git = (args) => safeCwd ? options.execGit(["-C", safeCwd, ...args]) : options.execGit(args);
+  const removeDeps = {
+    git,
+    sleep: options.sleep ?? defaultSleep,
+    removeWorktreeDir: options.removeWorktreeDir
+  };
+  await sweepDeferredWorktrees(options.deferredStore, removeDeps).catch(() => void 0);
   const mainWorktreePath = beforeWorktrees[0]?.path ?? afterWorktrees[0]?.path;
   const mainWorktreeTarget = Boolean(wtPath && mainWorktreePath && samePath(wtPath, mainWorktreePath));
   if (wtPath && mainWorktreeTarget) {
@@ -7620,6 +7687,24 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     });
     if (outcome.status === "removed") {
       report.worktree = { path: wtPath, status: "removed", stageTeardown, recovery: outcome.recovery };
+    } else if (isPersistentWorktreeLockFailure(outcome) && options.deferredStore) {
+      const { newlyRegistered } = await registerDeferredWorktree(options.deferredStore, {
+        path: wtPath,
+        branch,
+        reason: "lock-held"
+      });
+      report.worktree = {
+        path: wtPath,
+        status: "deferred",
+        reason: "lock-held",
+        error: outcome.error,
+        deferredNote: DEFERRED_NOTE,
+        deferredSweepCommand: DEFERRED_SWEEP_COMMAND,
+        ...newlyRegistered ? { safeCleanupCommand: safeWorktreeRemoveCommand(safeCwd, wtPath) } : {},
+        stageTeardown
+      };
+      report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-removal-deferred" };
+      return report;
     } else {
       report.worktree = {
         path: wtPath,
@@ -8419,6 +8504,7 @@ var CURSOR_PLUGIN_INSTALL_LABEL = "Cursor Team Marketplace plugin install";
 var CURSOR_MARKETPLACE_INSTALL_GUIDE = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/cursor-marketplace-install.md";
 var CURSOR_PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
 var CURSOR_HOOKS_JSON_REL = "hooks/hooks.json";
+var CURSOR_HOOK_CLI_LABEL = "Cursor hook CLI bundle";
 function joinCachePath(root, ...parts) {
   const sep = root.includes("\\") ? "\\" : "/";
   return [root.replace(/[\\/]+$/, ""), ...parts].join(sep);
@@ -8474,6 +8560,20 @@ function buildCursorPluginInstallCheck(input) {
   }
   return { ...base2, cacheRoot: input.cacheRoot, pins: input.pins };
 }
+function buildCursorHookCliCheck(input) {
+  const fix = "update the MMI Team Marketplace plugin (releases ship cli/dist under plugins/mmi/cli/dist) or install mmi-cli on PATH \u2014 Cursor hooks fall back to PATH when the bundled CLI is missing";
+  const base2 = { ok: true, label: CURSOR_HOOK_CLI_LABEL, fix };
+  if (!input.isOrgRepo) return base2;
+  const shouldCheck = input.surface === "cursor" || input.pins.length > 0;
+  if (!shouldCheck) return base2;
+  if (input.pins.length === 0) {
+    if (input.surface === "cursor" && !input.mmiCliOnPath) return { ...base2, ok: false };
+    return base2;
+  }
+  const missingBundle = input.pins.some((p) => !p.hasCliBundle);
+  if (missingBundle && !input.mmiCliOnPath) return { ...base2, ok: false };
+  return base2;
+}
 var HUB_COMPAT_FIX = "update mmi-cli (npm i -g @mutmutco/cli) / refresh the MMI plugin, then rerun doctor";
 function buildHubCompatCheck(input) {
   const label = "Hub compatibility (client version vs Hub minimum)";
@@ -9502,7 +9602,8 @@ async function runTrainApply(command, deps, options = {}) {
     const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
     const checks2 = await waitForRequiredTrainChecks(deps, ctx, releaseSha2, requiredChecks2);
     await deps.run("git", ["push", "origin", "main"]);
-    const releaseUrl2 = clean(await deps.run("gh", ["release", "create", tag2, "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+    const releaseUrl2 = clean(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+    await verifyPublishedRelease(deps, ctx.repo, tag2, "main", releaseSha2);
     const announceNote2 = deps.announce ? (await deps.announce({ repo: ctx.repo, tag: tag2, summaryFile: options.announceSummaryFile })).note : void 0;
     const autoRunSince2 = (deps.now ?? Date.now)();
     const d2 = await dispatchDeploy(deps, ctx, "main", "main", deployModel2, watch, autoRunSince2, releaseSha2, "report");
@@ -9571,7 +9672,8 @@ async function runTrainApply(command, deps, options = {}) {
     const requiredChecks2 = await discoverRequiredCheckContexts(deps, ctx, "main");
     const checks2 = await waitForRequiredTrainChecks(deps, ctx, releaseSha2, requiredChecks2);
     await deps.run("git", ["push", "origin", "main"]);
-    const releaseUrl2 = clean(await deps.run("gh", ["release", "create", tag2, "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+    const releaseUrl2 = clean(await deps.run("gh", ["release", "create", tag2, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+    await verifyPublishedRelease(deps, ctx.repo, tag2, "main", releaseSha2);
     const announceNote2 = deps.announce ? (await deps.announce({ repo: ctx.repo, tag: tag2, summaryFile: options.announceSummaryFile })).note : void 0;
     const autoRunSince2 = (deps.now ?? Date.now)();
     const d2 = await dispatchDeploy(deps, ctx, "main", "main", deployModel2, watch, autoRunSince2, releaseSha2, "report");
@@ -9987,6 +10089,11 @@ async function deriveHotfixVersion(deps) {
 function hotfixBranch(tag) {
   return `hotfix/${tag}`;
 }
+async function resolveHotfixDeployModel(deps, ctx) {
+  const load = await loadProjectMeta(deps, ctx);
+  const meta = load.status === "ok" ? load.meta : null;
+  return resolveDeployModel2(meta, ctx.repo);
+}
 async function findHotfixPr(deps, ctx, tag) {
   const out = await deps.run("gh", [
     "pr",
@@ -10024,6 +10131,7 @@ async function resolveHotfixSource(deps, ctx, from) {
 }
 async function runHotfixStart(deps, options) {
   const ctx = await buildTrainApplyContext(deps);
+  const deployModel = await resolveHotfixDeployModel(deps, ctx);
   const status = await deps.run("git", ["status", "--porcelain"]);
   if (status.trim()) throw new Error("working tree must be clean before hotfix start");
   await deps.run("git", ["fetch", "origin", "--tags"]);
@@ -10061,18 +10169,23 @@ async function runHotfixStart(deps, options) {
       throw new Error(`cherry-pick of ${label} onto ${branch} conflicted \u2014 aborted; resolve by hand on a manual hotfix branch, keeping the -x trailer (${e.message ?? e})`);
     }
     notes.push(`cherry-picked ${label} onto ${branch} (from origin/main, -x trailer recorded)`);
-    await deps.run("node", ["scripts/release-distribution.mjs", "prepare", version]);
-    const changedFiles = (await deps.run("node", ["scripts/release-distribution.mjs", "changed-files"])).split("\n").map((s) => s.trim()).filter(Boolean);
-    await deps.run("git", ["add", "--", ...changedFiles]);
-    const staged = await deps.run("git", ["diff", "--cached", "--name-only"]);
-    if (staged.trim()) {
-      await deps.run("git", ["commit", "-m", `hotfix ${tag}: lock plugin set + @mutmutco/cli distribution to ${version}`]);
-      notes.push(`distribution prepared + committed for ${version} (${changedFiles.length} locked paths)`);
+    if (deployModel === "hub-serverless") {
+      await deps.run("node", ["scripts/release-distribution.mjs", "prepare", version]);
+      const changedFiles = (await deps.run("node", ["scripts/release-distribution.mjs", "changed-files"])).split("\n").map((s) => s.trim()).filter(Boolean);
+      await deps.run("git", ["add", "--", ...changedFiles]);
+      const staged = await deps.run("git", ["diff", "--cached", "--name-only"]);
+      if (staged.trim()) {
+        await deps.run("git", ["commit", "-m", `hotfix ${tag}: lock plugin set + @mutmutco/cli distribution to ${version}`]);
+        notes.push(`distribution prepared + committed for ${version} (${changedFiles.length} locked paths)`);
+      } else {
+        notes.push("distribution prepare produced no changes \u2014 nothing extra committed");
+      }
     } else {
-      notes.push("distribution prepare produced no changes \u2014 nothing extra committed");
+      notes.push(`distribution bump skipped (deployModel=${deployModel}, Hub-only step)`);
     }
     await deps.run("git", ["push", "-u", "origin", branch]);
   }
+  const bumpNote = deployModel === "hub-serverless" ? " with the locked distribution bump" : "";
   const prUrl = clean2(await deps.run("gh", [
     "pr",
     "create",
@@ -10085,7 +10198,7 @@ async function runHotfixStart(deps, options) {
     "--title",
     `[hotfix] ${tag}`,
     "--body",
-    `Hotfix ${tag}: cherry-pick of ${label} onto origin/main with the locked distribution bump.
+    `Hotfix ${tag}: cherry-pick of ${label} onto origin/main${bumpNote}.
 
 Merge this PR (human-initiated), then run \`mmi-cli hotfix release ${tag}\`.`
   ]));
@@ -10130,6 +10243,7 @@ async function watchReleaseRun(deps, ctx, workflow, sha) {
 }
 async function runHotfixRelease(deps, versionInput, options = {}) {
   const ctx = await buildTrainApplyContext(deps);
+  const deployModel = await resolveHotfixDeployModel(deps, ctx);
   const { tag, version } = normalizeHotfixVersion(versionInput);
   const status = await deps.run("git", ["status", "--porcelain"]);
   if (status.trim()) throw new Error("working tree must be clean before hotfix release");
@@ -10164,33 +10278,74 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
     }
   }
   const runs = [];
-  for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
-    runs.push(await watchReleaseRun(deps, ctx, workflow, mergedSha));
+  let deployNote;
+  if (deployModel === "hub-serverless") {
+    for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
+      runs.push(await watchReleaseRun(deps, ctx, workflow, mergedSha));
+    }
+    deployNote = "watched release-triggered deploy.yml + publish.yml";
+  } else if (deployModel === "tenant-container" || deployModel === "solo-container") {
+    const dispatch = await dispatchDeploy(
+      deps,
+      ctx,
+      "main",
+      "main",
+      deployModel,
+      true,
+      (deps.now ?? Date.now)(),
+      mergedSha,
+      "report"
+    );
+    deployNote = dispatch.note;
+    runs.push({
+      workflow: "tenant-deploy.yml",
+      url: dispatch.runUrl,
+      conclusion: dispatch.deployStatus === "success" ? "success" : dispatch.deployStatus === "failure" ? "failure" : dispatch.deployStatus ?? "pending"
+    });
+  } else {
+    deployNote = `no hotfix deploy dispatch for deployModel=${deployModel} \u2014 prod deploy is repo-specific`;
   }
-  const previousRef = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
   let verifyNote;
-  const publishSucceeded = runs.find((r) => r.workflow === "publish.yml")?.conclusion === "success";
-  try {
-    await deps.run("git", ["-c", "advice.detachedHead=false", "checkout", tag]);
-    const verifyArgs = ["scripts/release-distribution.mjs", "verify", version, ...publishSucceeded ? [] : ["--skip-npm-view"]];
-    const sleep = sleeper(deps);
-    let attempt = 0;
-    for (; ; ) {
-      attempt++;
-      try {
-        await deps.run("node", verifyArgs);
-        break;
-      } catch (err) {
-        if (attempt >= HOTFIX_VERIFY_ATTEMPTS) throw err;
-        await sleep(HOTFIX_VERIFY_RETRY_MS);
+  if (deployModel === "hub-serverless") {
+    const previousRef = clean2(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+    const publishSucceeded = runs.find((r) => r.workflow === "publish.yml")?.conclusion === "success";
+    try {
+      await deps.run("git", ["-c", "advice.detachedHead=false", "checkout", tag]);
+      const verifyArgs = ["scripts/release-distribution.mjs", "verify", version, ...publishSucceeded ? [] : ["--skip-npm-view"]];
+      const sleep = sleeper(deps);
+      let attempt = 0;
+      for (; ; ) {
+        attempt++;
+        try {
+          await deps.run("node", verifyArgs);
+          break;
+        } catch (err) {
+          if (attempt >= HOTFIX_VERIFY_ATTEMPTS) throw err;
+          await sleep(HOTFIX_VERIFY_RETRY_MS);
+        }
       }
+      const retried = attempt > 1 ? `, after ${attempt} attempts (npm propagation lag)` : "";
+      verifyNote = `distribution verified at ${tag}${publishSucceeded ? ` (npm included${retried})` : " (npm view skipped \u2014 publish run not confirmed)"}`;
+    } finally {
+      if (previousRef && previousRef !== "HEAD") await deps.run("git", ["checkout", previousRef]);
     }
-    const retried = attempt > 1 ? `, after ${attempt} attempts (npm propagation lag)` : "";
-    verifyNote = `distribution verified at ${tag}${publishSucceeded ? ` (npm included${retried})` : " (npm view skipped \u2014 publish run not confirmed)"}`;
-  } finally {
-    if (previousRef && previousRef !== "HEAD") await deps.run("git", ["checkout", previousRef]);
+  } else {
+    verifyNote = `distribution verify skipped (deployModel=${deployModel}, Hub-only step)`;
   }
-  return { ...ctx, command: "hotfix-release", tag, mergedSha, checks, tagNote, releaseNote, runs, verifyNote, announceNote };
+  return {
+    ...ctx,
+    command: "hotfix-release",
+    tag,
+    mergedSha,
+    deployModel,
+    checks,
+    tagNote,
+    releaseNote,
+    runs,
+    deployNote,
+    verifyNote,
+    announceNote
+  };
 }
 function deriveHotfixState(f) {
   if (!f.branchExists && !f.pr && !f.tagPushed && !f.releaseExists) {
@@ -10226,6 +10381,11 @@ async function runHotfixStatus(deps, versionInput) {
         return { ...ctx, command: "hotfix-status", ...latestFacts, ...latestDerived };
       }
     }
+    const inFlight = await findInFlightHotfixVersion(deps, ctx);
+    if (inFlight) {
+      const facts2 = await gatherHotfixFacts(deps, ctx, inFlight.tag, inFlight.version);
+      return { ...ctx, command: "hotfix-status", ...facts2, ...deriveHotfixState(facts2) };
+    }
     ({ tag, version } = await deriveHotfixVersion(deps));
   }
   const facts = await gatherHotfixFacts(deps, ctx, tag, version);
@@ -10271,6 +10431,47 @@ async function gatherHotfixFacts(deps, ctx, tag, version) {
   const npmVersion = await deps.run("npm", ["view", "@mutmutco/cli", "version", "--silent"]).then(clean2, () => "unknown");
   return { tag, version, branchExists, pr: pr2 ? { number: pr2.number, state: pr2.state, url: pr2.url } : null, tagPushed, releaseExists, runs, npmVersion };
 }
+async function findInFlightHotfixVersion(deps, ctx) {
+  const tags = /* @__PURE__ */ new Set();
+  const out = await deps.run("gh", [
+    "pr",
+    "list",
+    "--repo",
+    ctx.repo,
+    "--base",
+    "main",
+    "--state",
+    "all",
+    "--limit",
+    "50",
+    "--json",
+    "headRefName"
+  ]);
+  for (const row of JSON.parse(out || "[]")) {
+    const m = typeof row.headRefName === "string" && /^hotfix\/(v\d+\.\d+\.\d+)/.exec(row.headRefName);
+    if (m) tags.add(m[1]);
+  }
+  const branchOut = clean2(await deps.run("git", ["ls-remote", "origin", "refs/heads/hotfix/v*"]));
+  for (const line of branchOut.split("\n").filter(Boolean)) {
+    const ref = line.split(/\s+/)[1] ?? "";
+    const m = /^refs\/heads\/hotfix\/(v\d+\.\d+\.\d+)/.exec(ref);
+    if (m) tags.add(m[1]);
+  }
+  const sorted = [...tags].sort((a, b) => {
+    const pa = a.slice(1).split(".").map(Number);
+    const pb = b.slice(1).split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+      if (pa[i] !== pb[i]) return pb[i] - pa[i];
+    }
+    return 0;
+  });
+  for (const tag of sorted) {
+    const version = tag.slice(1);
+    const facts = await gatherHotfixFacts(deps, ctx, tag, version);
+    if (deriveHotfixState(facts).state !== "complete") return { tag, version };
+  }
+  return null;
+}
 
 // src/release-announce.ts
 var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
@@ -10716,6 +10917,9 @@ var requiredIssueTemplates = [
   ".github/ISSUE_TEMPLATE/config.yml"
 ];
 var requiredWorkflows = [];
+var requiredProductWorkflows = [".github/workflows/gate.yml"];
+var requiredProductRulesetRef = ".github/rulesets/mmi-product-required-checks.json";
+var HUB_REPO3 = "mutmutco/MMI-Hub";
 var requiredLabels = ["bug", "feature", "task", "priority:urgent", "priority:high", "priority:medium", "priority:low"];
 var requiredPriorityOptions = ["Urgent", "High", "Medium", "Low"];
 var strayDefaultLabels = ["documentation", "duplicate", "enhancement", "good first issue", "help wanted", "invalid", "question", "wontfix"];
@@ -10728,6 +10932,7 @@ var requiredProjectWorkflows = [
 ];
 var requiredOrgRulesetTypes = ["pull_request", "non_fast_forward", "deletion"];
 var requiredHubStatusChecks = ["cli", "infra", "docs"];
+var requiredProductStatusChecks = ["gate"];
 function expectedBranches(repoClass, releaseTrack) {
   if (isReleaseTrack(releaseTrack)) return branchesForTrack(releaseTrack);
   return repoClass === "content" ? ["main"] : ["development", "rc", "main"];
@@ -10880,6 +11085,16 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   for (const path2 of requiredWorkflows) {
     checks.push({ ok: await contentExists(deps, repo, baseBranch, path2), label: `automation workflow exists: ${path2}` });
   }
+  if (repo !== HUB_REPO3) {
+    for (const path2 of requiredProductWorkflows) {
+      checks.push({ ok: await contentExists(deps, repo, baseBranch, path2), label: `gate workflow exists: ${path2}` });
+    }
+    checks.push({
+      ok: await contentExists(deps, repo, baseBranch, requiredProductRulesetRef),
+      label: "product required-check ruleset reference exists",
+      detail: `expected: ${requiredProductRulesetRef} (apply as an active repo ruleset after bootstrap)`
+    });
+  }
   if (repoClass === "deployable") {
     const trainScript = "scripts/next-version.mjs";
     checks.push({ ok: await contentExists(deps, repo, baseBranch, trainScript), label: `train tooling script exists: ${trainScript}` });
@@ -11015,7 +11230,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     label: "covered by an active org ruleset",
     detail: orgRuleset ? void 0 : activeOrgRulesets.length === 0 ? "no active Organization-sourced branch ruleset targets this repo" : `missing rule types: ${missingOrgRuleTypes.join(", ")}`
   });
-  if (repo === "mutmutco/MMI-Hub") {
+  if (repo === HUB_REPO3) {
     const statusChecks = rulesetStatusChecks(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
     const missing = requiredHubStatusChecks.filter((check) => !statusChecks.has(check));
     checks.push({
@@ -11023,6 +11238,14 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       label: "Hub required status checks configured",
       detail: optionDetail(missing)
     });
+  } else {
+    const statusChecks = rulesetStatusChecks(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
+    const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
+    checks.push({
+      ok: missing.length === 0,
+      label: "product required status checks configured",
+      detail: missing.length ? `missing contexts: ${missing.join(", ")} \u2014 apply ${requiredProductRulesetRef} as an active repo ruleset` : void 0
+    });
   }
   const declaredApis = (deps.requiredGcpApis ?? []).filter((a) => a && a.trim());
   if (declaredApis.length > 0) {
@@ -11074,12 +11297,32 @@ function parseOwnerRepo(repo) {
   return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
 }
 var DEFAULT_INSTALL_CMD = "npm ci";
+var DEFAULT_GATE_CMD = "npm run check";
+function gateSeedVars(cls) {
+  if (cls === "content") {
+    return {
+      GATE_CMD: DEFAULT_GATE_CMD,
+      GATE_PUSH_BRANCHES_YAML: "[main]",
+      GATE_FULL_RUN_BRANCH: "main",
+      GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/main"]'
+    };
+  }
+  return {
+    GATE_CMD: DEFAULT_GATE_CMD,
+    GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
+    GATE_FULL_RUN_BRANCH: "development",
+    GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/rc", "refs/heads/main"]'
+  };
+}
 function withDerivedRepoVars(vars, parsed, cls) {
   const out = { ...vars };
   out.REPO_NAME ??= parsed.name;
   out.REPO_SLUG ??= parsed.slug;
   out.CLASS ??= cls;
   out.INSTALL_CMD ??= DEFAULT_INSTALL_CMD;
+  for (const [key, value] of Object.entries(gateSeedVars(cls))) {
+    out[key] ??= value;
+  }
   return out;
 }
 function planSeedAction(seed, exists) {
@@ -13045,7 +13288,14 @@ program2.command("gc").description("dry-run cleanup for merged/closed PR branche
     const plan2 = await gcPlan(o.remote, limit);
     if (o.apply && !o.json) console.log(formatGcPlan(plan2, false));
     let applyResult;
-    if (o.apply) applyResult = await applyGcPlan(plan2, o.remote);
+    if (o.apply) {
+      const deferredStore = await createDeferredWorktreeStore();
+      await sweepDeferredWorktrees(
+        deferredStore,
+        worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout)
+      ).catch(() => void 0);
+      applyResult = await applyGcPlan(plan2, o.remote);
+    }
     if (o.json) {
       console.log(JSON.stringify({ dryRun: !o.apply, remote: o.remote, plan: plan2, applyResult }, null, 2));
     } else if (!o.apply) {
@@ -14032,6 +14282,33 @@ async function remoteBranchExists(branch, options = {}) {
   }, options);
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
+async function createDeferredWorktreeStore() {
+  try {
+    const { stdout } = await execFileP2("git", ["rev-parse", "--git-dir"], { timeout: GIT_TIMEOUT_MS });
+    const registryPath = deferredWorktreesRegistryPath(stdout.trim());
+    return {
+      read: async () => {
+        try {
+          return parseDeferredWorktreesFile(await (0, import_promises5.readFile)(registryPath, "utf8"));
+        } catch {
+          return [];
+        }
+      },
+      write: async (entries) => {
+        await (0, import_promises5.writeFile)(registryPath, serializeDeferredWorktrees(entries), "utf8");
+      }
+    };
+  } catch {
+    return void 0;
+  }
+}
+function worktreeRemoveDeps(execGit) {
+  return {
+    git: execGit,
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    removeWorktreeDir: async (worktreePath) => (0, import_promises5.rm)(worktreePath, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  };
+}
 function teardownWorktreeStage(worktreePath) {
   return runWorktreeStageTeardown(worktreePath, {
     hasStageState: (wt) => (0, import_node_fs14.existsSync)(stageStatePath(wt)),
@@ -14087,6 +14364,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     existedBefore: remoteBefore,
     reason: remoteNotAttemptedReason
   });
+  const deferredStore = await createDeferredWorktreeStore();
   const localCleanup = repoArgs.length ? {
     branch: headRef,
     localBranch: { name: headRef, status: "not-attempted", reason: "repo-option" },
@@ -14096,10 +14374,8 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
     startingPath,
     execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
     teardownWorktreeStage,
-    // Hardened fallback when retried `git worktree remove` still hits a Windows file lock (#967).
-    // `fs.rm` recursive removes a junction as a link (it does not traverse into the target) and its
-    // own maxRetries/retryDelay rides out a handle that an indexer/antivirus releases a moment later.
-    removeWorktreeDir: async (worktreePath) => (0, import_promises5.rm)(worktreePath, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+    deferredStore,
+    removeWorktreeDir: worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout).removeWorktreeDir
   });
   console.log(JSON.stringify(buildPrMergeResultPayload({
     number,
@@ -14567,10 +14843,11 @@ function renderHotfixStart(r) {
 }
 function renderHotfixRelease(r) {
   return [
-    `mmi-cli hotfix release: ${r.tag} at ${r.mergedSha.slice(0, 7)} on ${r.repo}`,
+    `mmi-cli hotfix release: ${r.tag} at ${r.mergedSha.slice(0, 7)} on ${r.repo} (deployModel=${r.deployModel})`,
     `  - checks: ${r.checks}`,
     `  - ${r.tagNote}`,
     `  - ${r.releaseNote}`,
+    `  - deploy: ${r.deployNote}`,
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
     `  - ${r.verifyNote}`,
     ...r.announceNote ? [`  - announce: ${r.announceNote}`] : [],
@@ -14975,6 +15252,7 @@ function cursorPluginCachePinSnapshots() {
       const path2 = (0, import_node_path13.join)(root, entry.name);
       const pluginJson = (0, import_node_path13.join)(path2, ".cursor-plugin", "plugin.json");
       const hooksJson = (0, import_node_path13.join)(path2, "hooks", "hooks.json");
+      const cliBundle = (0, import_node_path13.join)(path2, "cli", "dist", "index.cjs");
       let isEmpty = true;
       try {
         isEmpty = (0, import_node_fs14.readdirSync)(path2).length === 0;
@@ -14986,6 +15264,7 @@ function cursorPluginCachePinSnapshots() {
         path: path2,
         hasPluginJson: (0, import_node_fs14.existsSync)(pluginJson),
         hasHooksJson: (0, import_node_fs14.existsSync)(hooksJson),
+        hasCliBundle: (0, import_node_fs14.existsSync)(cliBundle),
         isEmpty
       };
     });
@@ -15237,6 +15516,15 @@ async function runDoctor(opts, io = consoleIo) {
       hubCheckout: hubCheckoutForCursorSeed()
     })
   );
+  const cursorPins = cursorPluginCachePinSnapshots() ?? [];
+  checks.push(
+    buildCursorHookCliCheck({
+      isOrgRepo: Boolean(cfg.sagaApiUrl),
+      surface,
+      pins: cursorPins,
+      mmiCliOnPath: onPath
+    })
+  );
   const gaps = checks.filter((c) => !c.ok);
   if (opts.banner) {
     if (gaps.length) io.log(`\u26A0 MMI setup needed \u2014 ${gaps.map((g) => g.fix).join(" \xB7 ")} \xB7 guide: ${MMI_AGENTIC_ONBOARDING_GUIDE.url}`);

package/dist/saga.cjs

@@ -3411,18 +3411,28 @@ var import_node_path2 = require("node:path");
 var CLIENT_VERSION_HEADER = "x-client-version";
 
 // src/client-version.ts
-function resolveClientVersion() {
+function resolveClientVersionManifestCandidates(distDir = __dirname) {
+  return [
+    (0, import_node_path2.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "..", ".cursor-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "..", ".codex-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "package.json")
+  ];
+}
+function readVersionFromManifest(path2) {
   try {
-    const manifest = (0, import_node_path2.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
-    return JSON.parse((0, import_node_fs2.readFileSync)(manifest, "utf8")).version || "0.0.0";
+    const version = JSON.parse((0, import_node_fs2.readFileSync)(path2, "utf8")).version;
+    return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
-    try {
-      const pkg = (0, import_node_path2.join)(__dirname, "..", "package.json");
-      return JSON.parse((0, import_node_fs2.readFileSync)(pkg, "utf8")).version || "0.0.0";
-    } catch {
-      return "0.0.0";
-    }
+    return null;
+  }
+}
+function resolveClientVersion() {
+  for (const manifest of resolveClientVersionManifestCandidates()) {
+    const version = readVersionFromManifest(manifest);
+    if (version) return version;
   }
+  return "0.0.0";
 }
 function clientVersionHeaders() {
   return { [CLIENT_VERSION_HEADER]: resolveClientVersion() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "2.30.0",
+  "version": "2.31.0",
   "description": "MMI Future CLI — delivers the org rules (whole-file), plus saga and KB access. The cross-IDE engine the plugin's SessionStart hook drives.",
   "type": "module",
   "license": "UNLICENSED",