@mutmutco/cli 2.9.0 → 2.10.1

package/dist/index.cjs

@@ -5140,8 +5140,9 @@ function buildAwsCrossAccountCheck(input) {
 }
 var MMI_PLUGIN_ID = "mmi@mmi";
 var PLUGIN_LABEL = "plugin install record (mmi@mmi for this project)";
-function pluginInstallManualFix(projectPath) {
-  return `run \`/plugin install ${MMI_PLUGIN_ID}\` then \`/reload-plugins\` (VS Code extension: reopen the workspace) to register the project install record for ${projectPath}`;
+function pluginInstallManualFix(projectPath, surface = "claude-cli") {
+  const register = surface === "codex" ? `\`codex plugin add ${MMI_PLUGIN_ID}\`` : surface === "shell" ? `enable the MMI plugin in your client` : surface === "claude-vscode" ? `\`claude plugin enable ${MMI_PLUGIN_ID}\`` : `\`/plugin install ${MMI_PLUGIN_ID}\``;
+  return `run ${register} then ${reloadAction(surface)} to register the install record for ${projectPath}`;
 }
 function isMmiPluginEnabled(settings) {
   return Boolean(settings?.enabledPlugins?.[MMI_PLUGIN_ID]);
@@ -5161,7 +5162,7 @@ function buildPluginInstallRecordCheck(input) {
   const base = {
     ok: true,
     label: PLUGIN_LABEL,
-    fix: pluginInstallManualFix(input.projectPath),
+    fix: pluginInstallManualFix(input.projectPath, input.surface),
     pluginId
   };
   if (!input.isOrgRepo || !isMmiPluginEnabled(input.settings)) return base;
@@ -5177,7 +5178,7 @@ function buildPluginInstallRecordCheck(input) {
   return {
     ok: false,
     label: PLUGIN_LABEL,
-    fix: pluginInstallManualFix(input.projectPath),
+    fix: pluginInstallManualFix(input.projectPath, input.surface),
     pluginId,
     recordToInsert
   };
@@ -5196,8 +5197,7 @@ function bestRecord(records) {
 }
 function pluginConfigDriftFix(pluginId, surface = "claude-cli") {
   const file = surface === "codex" ? "~/.codex/plugins/installed_plugins.json" : "~/.claude/plugins/installed_plugins.json";
-  const reload = surface === "codex" ? "restart Codex" : surface === "claude-vscode" ? "reopen the VS Code workspace" : "restart Claude Code, or run /reload-plugins";
-  return `\`${pluginId}\` has duplicate install rows or stale gitCommitSha in ${file} \u2014 run \`mmi-cli doctor\` interactively to collapse them to one user-scope row (a .bak backup is written first), then ${reload}`;
+  return `\`${pluginId}\` has duplicate install rows or stale gitCommitSha in ${file} \u2014 run \`mmi-cli doctor\` interactively to collapse them to one user-scope row (a .bak backup is written first), then ${reloadAction(surface)}`;
 }
 function buildPluginConfigDriftCheck(input) {
   const pluginId = input.pluginId ?? MMI_PLUGIN_ID;
@@ -5293,13 +5293,24 @@ function detectSurface(env) {
   if (isClaude) return "claude-cli";
   return "shell";
 }
+function reloadAction(surface) {
+  switch (surface) {
+    case "claude-vscode":
+      return "restart VS Code";
+    case "codex":
+      return "restart Codex";
+    case "claude-cli":
+    case "shell":
+    default:
+      return "restart Claude Code (or run /reload-plugins)";
+  }
+}
 function pluginRecoveryFix(surface) {
   const claude = "claude plugin marketplace update mmi && claude plugin update mmi@mmi && claude plugin enable mmi@mmi";
   switch (surface) {
     case "claude-vscode":
-      return `${claude}   # then reopen the VS Code workspace to reload MMI commands`;
     case "claude-cli":
-      return `${claude}   # then restart Claude Code, or run /reload-plugins`;
+      return `${claude}   # then ${reloadAction(surface)} to reload MMI commands`;
     case "codex":
       return "codex plugin marketplace upgrade mmi && codex plugin add mmi@mmi   # then restart Codex";
     case "shell":
@@ -5566,9 +5577,10 @@ async function buildTrainApplyContext(deps) {
   const [owner, name] = repo.split("/");
   if (!owner || !name) throw new Error(`repo must be owner/name, got ${repo}`);
   const login = requireValue(clean(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
-  const role = clean(await deps.run("gh", ["api", `orgs/${owner}/memberships/${login}`, "--jq", ".role"]));
-  if (role !== "admin") {
-    throw new Error(`${commandAuthorityLabel(owner)} is master-admin only; @${login} is ${role || "not an org admin"}`);
+  const verdict = await deps.trainAuthority(repo);
+  if (!verdict.ok) throw new Error(`${commandAuthorityLabel(owner)}: train authority could not be verified (${verdict.error})`);
+  if (!verdict.train) {
+    throw new Error(`${commandAuthorityLabel(owner)}: @${login} is ${verdict.role} \u2014 no train authority on ${repo}`);
   }
   return {
     repo,
@@ -6391,6 +6403,25 @@ var PROJECTS_ENVELOPE_KEY = "projects";
 
 // src/registry-client.ts
 var DEFAULT_TIMEOUT_MS = 8e3;
+async function fetchTrainAuthority(repo, deps) {
+  if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
+  const token = await deps.token();
+  if (!token) return { ok: false, error: "no GitHub token (gh auth login)" };
+  const doFetch = deps.fetch ?? fetch;
+  try {
+    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/train-authority?repo=${encodeURIComponent(repo)}`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+    });
+    if (!res.ok) return { ok: false, error: `train-authority HTTP ${res.status}` };
+    const body = await res.json();
+    if (typeof body?.train !== "boolean" || !body.role) return { ok: false, error: "malformed train-authority response" };
+    return { ok: true, authority: body };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
 async function fetchProjectsList(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -8845,7 +8876,11 @@ for (const commandName of ["rcand", "release", "hotfix"]) {
       try {
         const result = await runTrainApply(commandName, {
           run: async (file, args) => (await execFileP3(file, args, { timeout: file === "gh" ? 3e4 : GIT_TIMEOUT_MS })).stdout,
-          runSelf: async (args) => (await execFileP3(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout
+          runSelf: async (args) => (await execFileP3(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
+          trainAuthority: async (repo) => {
+            const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
+            return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
+          }
         });
         const message = `mmi-cli ${commandName}: applied ${result.repo} ${result.stage} train at ${result.tag} [${result.deployModel}]; ${result.dispatch}`;
         return printLine(o.json ? JSON.stringify(result, null, 2) : message);
@@ -9011,6 +9046,29 @@ LIVE apply to ${repo}:
   }
 });
 var access = program2.command("access").description("org access audit (read-only)");
+access.command("role [repo]").description("D14 train authority for a repo (server-side Hub check): master | project-admin | developer").option("--json", "machine-readable output").action(async (repoArg) => {
+  const o = { json: rawFlag("--json") };
+  const repo = repoArg ?? await resolveRepo();
+  if (!repo) return fail("access role: pass <owner/repo> or run inside a repo checkout");
+  const cfg = await loadConfig();
+  const verdict = await fetchTrainAuthority(repo, registryClientDeps(cfg));
+  if (!verdict.ok) {
+    if (o.json) {
+      console.log(JSON.stringify({ repo, train: false, error: verdict.error }));
+      process.exitCode = 1;
+      return;
+    }
+    return fail(`access role: ${verdict.error}`);
+  }
+  const a = verdict.authority;
+  if (o.json) {
+    console.log(JSON.stringify(a));
+    if (!a.train) process.exitCode = 1;
+    return;
+  }
+  console.log(`${a.repo}: @${a.login} is ${a.role} \u2014 train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
+  if (!a.train) process.exitCode = 1;
+});
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
   const o = { json: rawFlag("--json"), repo: rawValue("--repo", ""), class: rawValue("--class", "deployable") };
   const deps = { gh: async (args) => execFileP3("gh", args, { timeout: 2e4 }) };
@@ -9184,6 +9242,7 @@ async function runDoctor(opts, io = consoleIo) {
   }
   checks.push({ ok: onPath, label: "mmi-cli on PATH", fix: "auto-provisioned at session start \u2014 reopen the session, or install the MMI plugin" });
   const surface = detectSurface(process.env);
+  const reloadHint = reloadAction(surface);
   let versionReport = buildVersionLagReport({
     currentVersion: resolveVersion(),
     repoVersion: readRepoVersion(),
@@ -9210,12 +9269,13 @@ async function runDoctor(opts, io = consoleIo) {
     settings: readClaudeSettings(),
     installed,
     projectPath: process.cwd(),
-    mirrorFrom: existingMirrorRecord(installed)
+    mirrorFrom: existingMirrorRecord(installed),
+    surface
   });
-  if (!pluginCheck.ok && pluginCheck.recordToInsert && !opts.json && !opts.banner) {
+  if (!pluginCheck.ok && pluginCheck.recordToInsert && !opts.json) {
     if (writeProjectInstallRecord(pluginCheck.recordToInsert)) {
       pluginCheck = { ...pluginCheck, ok: true };
-      io.err("  \u21BB repaired: registered mmi@mmi project install record \u2014 run /reload-plugins to load it this session");
+      io.err(`  \u21BB repaired: registered mmi@mmi project install record \u2014 ${reloadHint} to load MMI commands`);
     }
   }
   checks.push(pluginCheck);
@@ -9228,10 +9288,10 @@ async function runDoctor(opts, io = consoleIo) {
   }
   checks.push(gitignoreCheck);
   let driftCheck = buildPluginConfigDriftCheck({ isOrgRepo: Boolean(cfg.sagaApiUrl), installed, surface });
-  if (!driftCheck.ok && driftCheck.recordsToWrite && !opts.json && !opts.banner) {
+  if (!driftCheck.ok && driftCheck.recordsToWrite && !opts.json) {
     if (backupAndWriteInstalledPlugins(driftCheck.recordsToWrite, driftCheck.pluginId)) {
       driftCheck = { ...driftCheck, ok: true };
-      io.err("  \u21BB repaired: collapsed mmi@mmi to one user-scope entry (backup at installed_plugins.json.bak) \u2014 run /reload-plugins");
+      io.err(`  \u21BB repaired: collapsed mmi@mmi to one user-scope entry (backup at installed_plugins.json.bak) \u2014 ${reloadHint} to load MMI commands`);
     }
   }
   checks.push(driftCheck);
@@ -9251,8 +9311,7 @@ async function runDoctor(opts, io = consoleIo) {
       });
       installedVersionCheck = healed;
       if (healed.ok) {
-        const reload = surface === "claude-vscode" ? "reopen the VS Code workspace" : "restart Claude Code (or run /reload-plugins)";
-        io.err(`  \u21BB updated MMI plugin \u2192 ${releasedVersion ?? "latest"} via claude plugin \u2014 ${reload} to load the new commands`);
+        io.err(`  \u21BB updated MMI plugin \u2192 ${releasedVersion ?? "latest"} via claude plugin \u2014 ${reloadAction(surface)} to load the new commands`);
       }
     }
   }
@@ -9264,12 +9323,12 @@ async function runDoctor(opts, io = consoleIo) {
     releasedVersion,
     installedVersions: installedPluginVersions(installed)
   });
-  if (!cacheCleanupCheck.ok && cacheCleanupCheck.quarantinePlan && !opts.json && !opts.banner) {
+  if (!cacheCleanupCheck.ok && cacheCleanupCheck.quarantinePlan && !opts.json) {
     const moved = quarantinePluginCacheDirs(cacheCleanupCheck.quarantinePlan);
     if (moved > 0) {
       const surfaces = [...new Set(cacheCleanupCheck.leftovers?.map((entry) => entry.surface) ?? [])].join("/");
       const names = cacheCleanupCheck.leftovers?.map((entry) => entry.name).join(", ");
-      io.err(`  \u21BB quarantined ${moved} stale MMI plugin cache dir(s) for ${surfaces || "agent surfaces"}: ${names} \u2014 reload affected sessions`);
+      io.err(`  \u21BB quarantined ${moved} stale MMI plugin cache dir(s) for ${surfaces || "agent surfaces"}: ${names} \u2014 ${reloadHint} to load MMI commands`);
     }
     cacheCleanupCheck = buildMmiPluginCacheCleanupCheck({
       isOrgRepo: Boolean(cfg.sagaApiUrl),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "2.9.0",
+  "version": "2.10.1",
   "description": "MMI Future CLI — delivers the org rules (whole-file), plus saga and KB access. The cross-IDE engine the plugin's SessionStart hook drives.",
   "type": "module",
   "license": "UNLICENSED",