@mutmutco/cli 3.11.0 → 3.12.0

package/dist/main.cjs

@@ -4957,7 +4957,7 @@ function parseIssueSelector(selector, defaultRepo) {
   throw new Error(`expected an issue selector like 123, #123, owner/repo#123, or a GitHub issue URL`);
 }
 function partitionBoardItems(items, viewer, currentRepo, writableRepos) {
-  const empty = () => ({ userOwned: [], claimable: [], taken: [] });
+  const empty = () => ({ userOwned: [], claimable: [], taken: [], unownedInFlight: [] });
   const groups = { primary: empty(), secondary: empty() };
   const viewerKey = viewer.toLowerCase();
   const repoKey = currentRepo.toLowerCase();
@@ -4972,6 +4972,8 @@ function partitionBoardItems(items, viewer, currentRepo, writableRepos) {
       groups[scope].claimable.push(item);
     } else if (item.assignees.length > 0) {
       groups[scope].taken.push(item);
+    } else {
+      groups[scope].unownedInFlight.push(item);
     }
   }
   sortBuckets(groups.primary);
@@ -5642,6 +5644,7 @@ function renderScope(lines, label, title, buckets) {
   lines.push("", `${label} \xB7 ${title}`);
   renderOwned(lines, buckets.userOwned);
   renderClaimable(lines, buckets.claimable);
+  renderUnowned(lines, buckets.unownedInFlight);
   renderTaken(lines, buckets.taken);
 }
 function renderOwned(lines, items) {
@@ -5664,17 +5667,23 @@ function renderTaken(lines, items) {
   lines.push("Taken");
   for (const item of items) lines.push(`  ${item.ref} \xB7 ${item.status} \xB7 @${item.assignees.join(", @")}`);
 }
+function renderUnowned(lines, items) {
+  if (!items.length) return;
+  lines.push("Unowned in-flight (unassigned \u2014 needs an owner)");
+  for (const item of items) lines.push(`  ${item.status} \xB7 ${renderTitledItem(item)}`);
+}
 function renderTitledItem(item) {
   const pri = item.priority ? ` \xB7 ${item.priority}` : "";
   return `${item.ref} - [${item.type ?? "item"}]${pri} ${item.title}`;
 }
 function hasItems(buckets) {
-  return buckets.userOwned.length > 0 || buckets.claimable.length > 0 || buckets.taken.length > 0;
+  return buckets.userOwned.length > 0 || buckets.claimable.length > 0 || buckets.taken.length > 0 || buckets.unownedInFlight.length > 0;
 }
 function sortBuckets(buckets) {
   buckets.userOwned.sort(compareItems);
   buckets.claimable.sort(compareItems);
   buckets.taken.sort(compareItems);
+  buckets.unownedInFlight.sort(compareItems);
 }
 function compareItems(a, b) {
   return (STATUS_ORDER.get(a.status) ?? 99) - (STATUS_ORDER.get(b.status) ?? 99) || a.repository.localeCompare(b.repository) || a.number - b.number;
@@ -8783,6 +8792,7 @@ async function startStage(config = {}, opts = {}) {
   if (!opts.envPrepared) await ensureStageRuntimeEnv(config, opts, cwd);
   if (stagePort != null && portGuard) await ensureStagePortAvailable(stagePort, cwd, portGuard);
   const extraEnv = stageExtraEnv(config, stagePort);
+  const vaultProcessEnv = opts.vaultEnvMerge ?? {};
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
@@ -8795,7 +8805,8 @@ async function startStage(config = {}, opts = {}) {
     detached: process.platform !== "win32",
     windowsHide: true,
     stdio: "ignore",
-    env: { ...process.env, ...stageProcessEnv(stagePort, extraEnv) }
+    // Vault secrets first so the stage-selection contract (MMI_STAGE/MMI_PORT/…) always wins on any collision.
+    env: { ...process.env, ...vaultProcessEnv, ...stageProcessEnv(stagePort, extraEnv) }
   });
   const state = {
     pid: child.pid ?? 0,
@@ -9082,12 +9093,13 @@ function parseAddedItemId(stdout) {
 function isAlreadyOnBoardError(stderr) {
   return /already exists in (?:this|the) project/i.test(stderr);
 }
-function buildPrArgs({ title, body, base, head, repo }) {
+function buildPrArgs({ title, body, base, head, repo, draft }) {
   const args = ["pr", "create"];
   if (repo) args.push("--repo", repo);
   args.push("--title", title, "--body", body);
   if (base) args.push("--base", base);
   if (head) args.push("--head", head);
+  if (draft) args.push("--draft");
   return args;
 }
 
@@ -9782,7 +9794,6 @@ function deriveStageGap(inputs) {
     return `local stage default applies to central-container repos only (tenant-container/solo-container; registry deployModel = ${inputs.deployModel ?? "unset"})`;
   }
   if (!inputs.hasCompose) missing.push("docker-compose.yml");
-  if (!inputs.hasEnvExample) missing.push(".env.example");
   if (!inputs.portRange) missing.push("Hub registry portRange");
   return missing.length ? `cannot derive a default local stage \u2014 missing: ${missing.join(", ")}` : null;
 }
@@ -9798,7 +9809,9 @@ function deriveStage(inputs) {
     // answered" — any HTTP status — is the health signal, not a 2xx on the bare root.
     healthAnyStatus: true,
     portRange: inputs.portRange,
-    ensureEnv: { example: ".env.example", target: ".env" },
+    // #2655: only bootstrap a `.env` when the repo ships `.env.example` (legacy). Without it, the stage is
+    // vault-native — the runner injects the declared dev secrets into the compose process env (no disk file).
+    ...inputs.hasEnvExample ? { ensureEnv: { example: ".env.example", target: ".env" } } : {},
     // MMI_PORT is the host-published port (the free STAGE_PORT); PORT is intentionally absent so compose
     // reads the container's bind port from .env rather than this overriding it to the publish port (#1505).
     env: {
@@ -9876,7 +9889,9 @@ async function runStageLiveUp(deps, t) {
     ref: t.ref,
     ip,
     dispatched: ["tenant-deploy.yml", "tenant-control.yml"],
-    message: `dispatched the dev deploy of ${t.ref} and the Cloudflare edge gate for ${t.host} \u2192 ${ip}; watch the runs in ${STAGE_LIVE_HUB_REPO} Actions \u2014 tear down with: mmi-cli stage --live --down --apply`
+    // #2656: the gate now writes a skip+block pair and self-verifies from the runner (a non-allowed vantage),
+    // so a gate that failed to close fails the run RED. The stage is private only once that gate run is green.
+    message: `dispatched the dev deploy of ${t.ref} and the Cloudflare edge gate for ${t.host} \u2192 ${ip}; watch the runs in ${STAGE_LIVE_HUB_REPO} Actions and treat the stage as private ONLY once the cf-gate-allow run is green (it self-verifies the host is blocked) \u2014 tear down with: mmi-cli stage --live --down --apply`
   };
 }
 async function runStageLiveDown(deps, t) {
@@ -10545,7 +10560,16 @@ async function probeRemoteTag(deps, tag) {
   const remoteOut = await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/tags/${tag}`]);
   return clean2(remoteOut).split(/\s+/)[0] || "";
 }
-async function ensureTagPushed(deps, tag, sha, probed) {
+async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
+  try {
+    await deps.run("git", ["merge-base", "--is-ancestor", remoteSha, "origin/main"]);
+    return false;
+  } catch (e) {
+    if (e.code !== 1) return false;
+  }
+  return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
+}
+async function ensureTagPushed(deps, tag, sha, probed, releaseRepo) {
   const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
   let localSha = "";
   try {
@@ -10554,8 +10578,14 @@ async function ensureTagPushed(deps, tag, sha, probed) {
   }
   if (remoteSha) {
     if (remoteSha !== sha) {
+      const mismatch = `tag ${tag} already exists on origin at ${remoteSha}, but this run intends ${sha}`;
+      if (releaseRepo && await isStrayUnreleasedTag(deps, tag, remoteSha, releaseRepo)) {
+        throw new Error(
+          `${mismatch}. The existing tag is not reachable from origin/main and has no GitHub Release \u2014 it was pushed outside the train, not by a completed release. Sanctioned recovery: delete the stray tag (git push origin --delete ${tag}; git tag -d ${tag} if it exists locally), check the repo's Actions for any workflow the stray tag already triggered, then rerun mmi-cli release --apply (if a publish already ran off the stray tag, mint the next version instead of reusing this one). Never complete the release by hand \u2014 a manual GitHub Release or branch push bypasses the train and leaves main behind.`
+        );
+      }
       throw new Error(
-        `tag ${tag} already exists on origin at ${remoteSha}, but this run intends ${sha} \u2014 refusing to touch a pushed tag. Repair manually: either release the existing tagged commit (reset the local branch to ${remoteSha} and rerun), or mint the next candidate version so a fresh tag is used. Never force-move or delete a pushed tag.`
+        `${mismatch} \u2014 refusing to touch a pushed tag. Repair manually: either release the existing tagged commit (reset the local branch to ${remoteSha} and rerun), or mint the next candidate version so a fresh tag is used. Never force-move or delete a pushed tag.`
       );
     }
     if (localSha && localSha !== sha) {
@@ -10922,7 +10952,7 @@ async function runFoldStage(deps, startBranch, preFold, fn) {
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe) {
   let tagPush;
   try {
-    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe);
+    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe, ctx.repo);
   } catch (e) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
   }
@@ -20963,7 +20993,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   console.log(JSON.stringify({ ...created, deduped: false, label: SKILL_LESSON_LABEL, skill, priority, projectItemId, onBoard }));
 });
 var pr = program2.command("pr").description("pull requests \u2014 reliable create with structured output");
-pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
+pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").action(async (o) => {
   let body;
   let title;
   try {
@@ -20972,7 +21002,7 @@ pr.command("create").description("create a PR and print {number,url} JSON").opti
   } catch (e) {
     return fail(`pr create: ${e.message}`);
   }
-  const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo }));
+  const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo, draft: o.draft }));
   console.log(JSON.stringify(created));
 });
 pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').action(async (number, o) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",