@mutmutco/cli 2.60.0 → 2.61.1

package/dist/main.cjs

@@ -14143,8 +14143,8 @@ function bootstrapPlan(repo, repoClass) {
     { label: `provision branch model: ${branchModel}`, gated: true },
     { label: `apply branch protection / allowlist: ${protectedBranches}`, gated: true },
     { label: "attach GitHub Project v2 and register saga-ready Hub registry META", gated: true },
-    { label: "seed README.md, architecture.md, AGENTS.md, and CLAUDE.md", gated: true },
-    { label: "commit .claude/settings.json and .cursor/rules/<repo>.mdc", gated: true },
+    { label: "seed README.md and architecture.md", gated: true },
+    { label: "commit .cursor/rules/<repo>.mdc and .cursor/environment.json", gated: true },
     { label: `register fanout target on ${repoClass === "content" ? "main" : "development"}`, gated: true }
   ];
 }
@@ -14329,28 +14329,6 @@ async function runStageLiveDown(deps, t) {
   };
 }
 
-// src/org-spine-pull.ts
-async function reconcileDirtyOrgSpineBeforePull(deps, branch, options = {}) {
-  await deps.run("git", ["fetch", "origin", branch]).catch(() => "");
-  const reconciled = [];
-  for (const file of ORG_SPINE_FILES) {
-    const status = (await deps.run("git", ["status", "--porcelain", "--", file])).trim();
-    if (!status) continue;
-    if (options.isRulesSource) {
-      options.warn?.(
-        `org spine file ${file} has local edits \u2014 skipped reconcile (rules source repo; commit or stash before train)`
-      );
-      continue;
-    }
-    try {
-      await deps.run("git", ["checkout", `origin/${branch}`, "--", file]);
-      reconciled.push(file);
-    } catch {
-    }
-  }
-  return reconciled;
-}
-
 // src/git-clean-tree.ts
 function isAgentScratchPath(path2) {
   const normalized = path2.replace(/\\/g, "/").trim();
@@ -14469,22 +14447,7 @@ async function verifyPublishedRelease(deps, repo, tag, expectedTarget, expectedS
     throw new Error(`origin/${expectedTarget} points at ${branchSha}, expected ${expectedSha}`);
   }
 }
-var ORG_SPINE_FILES = [
-  "AGENTS.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  ".claude/settings.json",
-  ".claude/output-styles/mmi-plain.md",
-  ".cursor/rules/mmi-plain-language.mdc",
-  ".cursor/rules/mmi-tool-economy.mdc",
-  ".cursor/rules/mmi-code-economy.mdc"
-];
-function isSpinePath(path2) {
-  return ORG_SPINE_FILES.includes(path2);
-}
 async function ffOnlyPull(deps, branch) {
-  const isRulesSource2 = deps.isRulesSource ? await deps.isRulesSource() : false;
-  await reconcileDirtyOrgSpineBeforePull(deps, branch, { isRulesSource: isRulesSource2, warn: deps.warn });
   await deps.run("git", ["pull", "--ff-only", "origin", branch]);
 }
 var RELEASE_TOLERATED_PATHS = [".gitignore"];
@@ -14515,18 +14478,18 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithSpineResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
   } catch {
   }
   const unmerged = (await deps.run("git", ["diff", "--name-only", "--diff-filter=U"])).split("\n").map((s) => s.trim()).filter(Boolean);
-  const blocking = unmerged.filter((f) => !isSpinePath(f) && !extraTolerated.includes(f));
+  const blocking = unmerged.filter((f) => !extraTolerated.includes(f));
   if (unmerged.length === 0 || blocking.length > 0) {
     await deps.run("git", ["merge", "--abort"]);
     throw new Error(
-      unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on non-spine path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
+      unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
   await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
@@ -15071,7 +15034,7 @@ async function preflightMergeToMain(deps, deployModel, remoteRef, blockingPrefix
   const foldPaths = await resolveFoldPaths(deps, deployModel);
   const tolerated = [...foldPaths, ...RELEASE_TOLERATED_PATHS];
   const predicted = await predictMergeConflicts(deps, "origin/main", remoteRef);
-  const predictedBlocking = predicted.filter((f) => !isSpinePath(f) && !tolerated.includes(f));
+  const predictedBlocking = predicted.filter((f) => !tolerated.includes(f));
   if (predictedBlocking.length > 0) {
     throw new Error(`${blockingPrefix}: ${predictedBlocking.join(", ")} \u2014 no merge was started. ${realignMessage}`);
   }
@@ -15083,7 +15046,7 @@ async function executeMergeToMain(deps, sourceRef, mergeLabel, tolerated, predic
   if (predicted.length === 0) {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
   } else {
-    await mergeWithSpineResolution(deps, sourceRef, mergeLabel, "theirs", tolerated);
+    await mergeWithToleratedResolution(deps, sourceRef, mergeLabel, "theirs", tolerated);
   }
 }
 async function mergeSourceToMain(deps, deployModel, args) {
@@ -15192,7 +15155,7 @@ async function runTrainApplyPipeline(mode, input) {
       sourceRef: "development",
       remoteRef: "origin/development",
       mergeLabel: "development -> main",
-      blockingPrefix: "development -> main merge would conflict on non-spine path(s)",
+      blockingPrefix: "development -> main merge would conflict on untolerated path(s)",
       realignMessage: "The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release."
     });
     const versionFold2 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
@@ -15262,7 +15225,7 @@ async function runTrainApplyPipeline(mode, input) {
     deps,
     deployModel,
     "origin/rc",
-    "rc -> main merge would conflict on non-spine path(s)",
+    "rc -> main merge would conflict on untolerated path(s)",
     "The train is misaligned: reconcile main and rc via an approved alignment PR (do not hand-resolve on main), then rerun release."
   );
   const coverage = deps.hotfixCoverage({ mainRef: "origin/main", rcRef: "origin/rc", ack: options.ack ?? [] });
@@ -15741,8 +15704,6 @@ async function runHotfixStart(deps, options) {
   const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
-    const isRulesSource2 = deps.isRulesSource ? await deps.isRulesSource() : false;
-    await reconcileDirtyOrgSpineBeforePull(deps, branch, { isRulesSource: isRulesSource2, warn: deps.warn });
     await deps.run("git", ["pull", "--ff-only", "origin", branch]);
     notes.push(`branch ${branch} already on origin \u2014 reused (cherry-pick/bump assumed present; PR step resumes)`);
   } else {
@@ -16564,7 +16525,7 @@ function renderAccessReport(report) {
 
 // src/bootstrap-verify.ts
 var TRAIN_BRANCHES = ["development", "rc", "main"];
-var requiredDocs = ["README.md", "architecture.md", "AGENTS.md", "CLAUDE.md", ".claude/settings.json"];
+var requiredDocs = ["README.md", "architecture.md"];
 var requiredIssueTemplates = [
   ".github/ISSUE_TEMPLATE/bug.yml",
   ".github/ISSUE_TEMPLATE/feature.yml",
@@ -18684,6 +18645,107 @@ async function secretsCapabilities(deps, opts) {
   }
   deps.log(formatCapabilities(report));
 }
+async function fetchCatalog(deps, label, repo, extra) {
+  const qs = new URLSearchParams({ repo, ...extra }).toString();
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/secrets/catalog?${qs}`, {
+      method: "GET",
+      headers: await deps.headers(),
+      signal: AbortSignal.timeout(CAPABILITIES_TIMEOUT_MS)
+    });
+  } catch (e) {
+    if (isTimeoutError(e)) {
+      deps.err(`${label}: timed out after ${CAPABILITIES_TIMEOUT_MS}ms aggregating the catalog for ${repo}. No conclusion made; retry with a warm Hub.`);
+      return null;
+    }
+    deps.err(`${label}: ${e.message}`);
+    return null;
+  }
+  if (!res.ok) {
+    const upgrade = await upgradeMessage(res);
+    if (upgrade) deps.err(upgrade);
+    else if (res.status === 404)
+      deps.err(`${label}: the Hub API did not recognize /secrets/catalog (HTTP 404) \u2014 the deployed Hub predates this command. Not an authorization error; it answers once a Hub release carrying it is deployed.`);
+    else if (res.status === 403)
+      deps.err(`${label}: master-admin only (HTTP 403) \u2014 the catalog surface is master-only (#2220).`);
+    else deps.err(`${label} failed: HTTP ${res.status}${await readErr(res)}`);
+    return null;
+  }
+  return await res.json();
+}
+function whereLabel(v) {
+  return v.slug === "_org" ? `_org/${v.provider ?? v.group}` : v.slug;
+}
+function formatFindHits(intent, hits) {
+  if (!hits.length) return `no catalog match for "${intent}". Browse with \`mmi-cli secrets catalog\`, or run \`mmi-cli secrets doctor\` for drift.`;
+  const blocks = hits.map((h) => [`${h.key}  (${whereLabel(h)})  \u2014 ${h.purpose}`, `    ${h.command}`].join("\n"));
+  return [`${hits.length} match(es) for "${intent}" (only \`get\` prints a value):`, "", ...blocks].join("\n");
+}
+function formatCatalog(r) {
+  const lines = [`catalog \u2014 ${r.count} secret(s) across ${r.groups.length} group(s):`, ""];
+  for (const g of r.groups) {
+    lines.push(`\u25B8 ${g.group}`);
+    const width = Math.max(...g.secrets.map((s) => s.key.length), 1);
+    for (const s of g.secrets) lines.push(`    ${s.key.padEnd(width)}  ${s.command}`);
+  }
+  lines.push("", "Names + meaning only \u2014 values are never shown. `secrets doctor` reports drift.");
+  return lines.join("\n");
+}
+function formatDrift(d) {
+  if (d.ok) return "vault doctor: zero drift \u2014 SSM matches the catalog.";
+  const lines = ["vault doctor: drift found", ""];
+  const section = (title, rows) => {
+    if (!rows.length) return;
+    lines.push(`${title} (${rows.length}):`, ...rows.map((r) => `  - ${r}`), "");
+  };
+  section("declared but MISSING in SSM", d.declaredMissing.map((m) => m.path));
+  section("ORPHAN in SSM, undeclared \u2014 declare or delete", d.orphan.map((o) => o.path));
+  section("OFF-SCHEME path", d.offScheme.map((o) => `${o.path}  (${o.reason})`));
+  section("DUPLICATE org-infra secret", d.duplicate.map((dup) => `${dup.logical}: ${dup.paths.join(" , ")}`));
+  return lines.join("\n").trimEnd();
+}
+async function secretsFind(deps, intent, opts) {
+  const repo = await targetRepo(deps, opts);
+  const data = await fetchCatalog(deps, "secrets find", repo, { intent });
+  if (!data) return false;
+  if (data.mode !== "intent") {
+    deps.err("secrets find: unexpected response mode");
+    return false;
+  }
+  if (opts.json) {
+    deps.log(JSON.stringify(data, null, 2));
+    return true;
+  }
+  deps.log(formatFindHits(intent, data.hits));
+  return true;
+}
+async function secretsCatalog(deps, opts) {
+  const repo = await targetRepo(deps, opts);
+  const data = await fetchCatalog(deps, "secrets catalog", repo, opts.drift ? { drift: "true" } : {});
+  if (!data) return;
+  if (opts.json) {
+    deps.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (data.mode === "drift") deps.log(formatDrift(data.drift));
+  else if (data.mode === "catalog") deps.log(formatCatalog(data));
+}
+async function secretsDoctor(deps, opts) {
+  const repo = await targetRepo(deps, opts);
+  const data = await fetchCatalog(deps, "secrets doctor", repo, { drift: "true" });
+  if (!data) return false;
+  if (data.mode !== "drift") {
+    deps.err("secrets doctor: unexpected response mode");
+    return false;
+  }
+  if (opts.json) {
+    deps.log(JSON.stringify(data.drift, null, 2));
+    return data.drift.ok;
+  }
+  deps.log(formatDrift(data.drift));
+  return data.drift.ok;
+}
 var DEFAULT_RUNTIME_SECRET_NAMES2 = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 function stringList(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string" && isValidSecretKey(x)) : [];
@@ -19131,6 +19193,13 @@ function registerSecretsCommands(program3) {
   const secrets = program3.command("secrets").description("two-tier project secrets \u2014 self-serve your repo dev/* tier; org tier is master-gated");
   secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsWhere(d, o)));
   secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets((d) => secretsList(d, o)));
+  secrets.command("find <intent>").description("resolve a plain-language intent to the canonical secret(s) + the exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
+    if (!await secretsFind(d, intent, o)) process.exitCode = 1;
+  }));
+  secrets.command("catalog").description("the secret catalog \u2014 grouped, with each secret's exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--drift", "include the bidirectional reconciler drift report").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCatalog(d, o)));
+  secrets.command("doctor").description("vault drift report \u2014 declared-missing / orphan / off-scheme / duplicate (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets(async (d) => {
+    if (!await secretsDoctor(d, o)) process.exitCode = 1;
+  }));
   secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").action(async (o) => {
     if (!["dev", "rc", "main"].includes(o.stage)) {
       return fail("secrets preflight: --stage must be dev, rc, or main");
@@ -24435,7 +24504,6 @@ function trainApplyDeps() {
       const toArr = (v) => v ? [v] : void 0;
       return { rc: toArr(ed.rc), main: toArr(ed.main) };
     },
-    isRulesSource: async () => isRulesSource((await loadConfig()).orgRulesSource),
     warn: (message) => consoleIo.err(`mmi-cli: ${message}`)
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "2.60.0",
+  "version": "2.61.1",
   "description": "MMI Future CLI — delivers the org rules (whole-file), Jervaise-only continuity, and KB access. The cross-IDE engine the plugin's SessionStart hook drives.",
   "type": "module",
   "license": "UNLICENSED",