@mutmutco/cli 3.139.1 → 3.139.2

package/dist/main.cjs

@@ -7078,9 +7078,15 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
+  const windowsCompat = {
+    // #5113: opt-in informational windows-latest proof. Default OFF — the CLI fills the rendered job
+    // YAML (or '') at the final layering step; never hand-passed.
+    GATE_WINDOWS_COMPAT_JOB_YAML: ""
+  };
   if (track === "trunk") {
     return {
       ...runtimeVars,
+      ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[main]",
       GATE_FULL_RUN_BRANCH: "main",
       GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/main"]'
@@ -7089,6 +7095,7 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
   if (track === "direct") {
     return {
       ...runtimeVars,
+      ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[development, main]",
       GATE_FULL_RUN_BRANCH: "development",
       GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/main"]'
@@ -7096,6 +7103,7 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
   }
   return {
     ...runtimeVars,
+    ...windowsCompat,
     GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
     GATE_FULL_RUN_BRANCH: "development",
     GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/rc", "refs/heads/main"]'
@@ -7112,8 +7120,38 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime))) {
     out[key] ??= value;
   }
+  if (out.GATE_WINDOWS_COMPAT === "true" && !out.GATE_WINDOWS_COMPAT_JOB_YAML) {
+    out.GATE_WINDOWS_COMPAT_JOB_YAML = windowsCompatJobYaml(out);
+  }
   return out;
 }
+function windowsCompatJobYaml(vars) {
+  const workdir = vars.GATE_WORKDIR ?? ".";
+  const cmd = vars.GATE_CMD ?? DEFAULT_GATE_CMD;
+  const install = vars.GATE_INSTALL_CMD ?? "npm ci";
+  const fullRunBranch = vars.GATE_FULL_RUN_BRANCH ?? "development";
+  const runtime = vars.GATE_RUNTIME === "python" ? "python" : "node";
+  const setup = runtime === "python" ? `      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with: { python-version: '${vars.GATE_PY_VERSION ?? DEFAULT_GATE_PY_VERSION}' }` : `      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: npm, cache-dependency-path: ${vars.GATE_CACHE_DEP_PATH ?? "package-lock.json"} }`;
+  return `  # MMI-Hub#5113: opt-in Windows compatibility proof \u2014 informational only. Do NOT add this job to a
+  # required-contexts ruleset without a deliberate repo decision: the required gate stays the Linux lane
+  # (faster, cheaper, where autonomous agents run). GitHub-hosted Windows minutes cost more than Linux,
+  # hence opt-in. defaults.run.shell=bash is Git for Windows bash on windows-latest, so the check syntax
+  # the Linux gate runs keeps working here.
+  windows-compat:
+    if: \${{ github.event_name == 'pull_request' || (github.event_name == 'push' && (github.ref_name == '${fullRunBranch}' || github.ref_name == 'main')) }}
+    runs-on: windows-latest
+    defaults:
+      run: { working-directory: ${workdir}, shell: bash }
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+${setup}
+      - run: ${install}
+      # Fast proof only \u2014 the full suite stays on the Linux gate.
+      - run: ${cmd}
+`;
+}
 function gateConfigToVars(gate) {
   const out = {};
   if (!gate || typeof gate !== "object") return out;
@@ -7124,6 +7162,7 @@ function gateConfigToVars(gate) {
   if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
   const seconds = typeof gate.maxSeconds === "number" ? String(gate.maxSeconds) : gate.maxSeconds;
   if (typeof seconds === "string" && /^\d+$/.test(seconds.trim()) && Number(seconds) > 0) out.GATE_MAX_SECONDS = seconds.trim();
+  if (gate.windowsCompat === true) out.GATE_WINDOWS_COMPAT = "true";
   return out;
 }
 function seedMatchesDeployModel(seed, deployModel) {
@@ -10707,10 +10746,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.139.1",
-    tag: "v3.139.1",
-    commit: "882483d74da4",
-    npm: "@mutmutco/cli@3.139.1"
+    version: "3.139.2",
+    tag: "v3.139.2",
+    commit: "1e69c6815490",
+    npm: "@mutmutco/cli@3.139.2"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10727,14 +10766,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.139.1"
+          v3Target: "v3.139.2"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.139.1 and redeploy the Hub Lambda from tag v3.139.1 (882483d74da4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.139.1 (@mutmutco/cli@3.139.1, tag commit 882483d74da4 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.139.2 and redeploy the Hub Lambda from tag v3.139.2 (1e69c6815490); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.139.2 (@mutmutco/cli@3.139.2, tag commit 1e69c6815490 \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -22696,8 +22735,9 @@ var import_node_crypto5 = require("node:crypto");
 var import_node_child_process12 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
-var REPO_INDEX_SCHEMA = 1;
-var HARD_DENY = [
+
+// ../infra/repo-index-path-policy.mjs
+var HARD_DENY = Object.freeze([
   /(^|\/)\.env(\.|$)/i,
   /(^|\/)\.env\./i,
   /credentials/i,
@@ -22708,7 +22748,20 @@ var HARD_DENY = [
   /(^|\/)id_rsa/i,
   /(^|\/)id_ed25519/i,
   /\.keystore$/i
-];
+]);
+function isHardDeniedRepoIndexPath(value) {
+  return typeof value !== "string" || HARD_DENY.some((pattern) => pattern.test(value));
+}
+function isSafeRepoIndexPath(value) {
+  if (typeof value !== "string" || !value || value.length > 1024) return false;
+  if (value.startsWith("/") || value.includes("\\") || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+  const segments = value.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return false;
+  return !isHardDeniedRepoIndexPath(value);
+}
+
+// src/repo-index.ts
+var REPO_INDEX_SCHEMA = 1;
 var INDEXABLE_EXT = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -22742,10 +22795,10 @@ function repoIndexStorePath(cwd) {
   return repoRuntimeStatePath(cwd, "repo-index", "index.json");
 }
 function isHardDeniedPath(relPosix) {
-  return HARD_DENY.some((re) => re.test(relPosix));
+  return isHardDeniedRepoIndexPath(relPosix);
 }
 function isIndexablePath(relPosix) {
-  if (isHardDeniedPath(relPosix)) return false;
+  if (!isSafeRepoIndexPath(relPosix)) return false;
   if (relPosix.startsWith(".git/")) return false;
   if (relPosix.includes("node_modules/")) return false;
   if (relPosix.includes("dist/")) return false;
@@ -34335,6 +34388,39 @@ function planGitignore(current) {
   const { content, changed } = upsertManagedGitignoreBlock(current);
   return changed ? { ok: false, content } : { ok: true };
 }
+function checkLineEndings(probe) {
+  if (probe.error) {
+    return {
+      ok: true,
+      verified: false,
+      id: "line-endings",
+      label: "line endings",
+      detail: `could not inspect tracked shell scripts: ${probe.error}`,
+      fix: "run `git ls-files --eol -- '*.sh'` from the repository root, then re-run `mmi-cli doctor`"
+    };
+  }
+  const problems = [
+    ...probe.attributesPresent ? [] : [".gitattributes is missing"],
+    ...probe.crlfShellScripts.map((path2) => `${path2} is CRLF in the index`)
+  ];
+  if (!problems.length) {
+    return {
+      ok: true,
+      id: "line-endings",
+      label: "line endings",
+      detail: ".gitattributes present; tracked *.sh index entries are LF"
+    };
+  }
+  return {
+    ok: false,
+    id: "line-endings",
+    label: "line endings",
+    detail: problems.join("; "),
+    fix: "add the canonical .gitattributes if missing, then run `git add --renormalize .`",
+    command: "git add --renormalize .",
+    verbose: probe.crlfShellScripts.map((path2) => `i/crlf: ${path2}`)
+  };
+}
 async function runDoctorClean(opts, io, deps) {
   const full = !opts.fast && !opts.banner && !opts.preflight;
   const applyEnv = full;
@@ -34468,6 +34554,11 @@ async function runDoctorClean(opts, io, deps) {
     const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
     if (aws) emitNow(aws);
   }
+  async function runLineEndingsRow() {
+    const root = await deps.repoRoot();
+    const state = deps.lineEndingState?.(root);
+    if (state) emitNow(checkLineEndings(state));
+  }
   async function runGitignoreRow() {
     const current = deps.readGitignore();
     const gi = planGitignore(current);
@@ -34851,6 +34942,7 @@ async function runDoctorClean(opts, io, deps) {
     { id: "aws-identity", when: true, run: runAwsRow },
     { id: "sessionstart-payload", when: true, run: runSessionPayloadRow },
     { id: "claude-binary", when: true, run: runClaudeBinaryRow },
+    { id: "line-endings", when: isOrgRepo, run: runLineEndingsRow },
     { id: "gitignore-block", when: isOrgRepo, run: runGitignoreRow }
   ];
   const maxPasses = 3;
@@ -35143,6 +35235,20 @@ function writeGitignore(content) {
     return false;
   }
 }
+function lineEndingState(root) {
+  const attributesPresent = (0, import_node_fs41.existsSync)((0, import_node_path38.join)(root, ".gitattributes"));
+  try {
+    const output = (0, import_node_child_process18.execFileSync)("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
+      windowsHide: true,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const crlfShellScripts = output.split(/\r?\n/).filter((line) => line.startsWith("i/crlf ")).map((line) => line.slice(line.indexOf("	") + 1)).filter(Boolean);
+    return { attributesPresent, crlfShellScripts };
+  } catch (error) {
+    return { attributesPresent, crlfShellScripts: [], error: error.message || "git ls-files --eol failed" };
+  }
+}
 async function ghInstalled() {
   try {
     await execFileP6("gh", ["--version"]);
@@ -35352,6 +35458,7 @@ function mmiDoctorDeps(opts = {}) {
     currentCliVersion: resolveClientVersion,
     readGitignore,
     writeGitignore,
+    lineEndingState,
     repoRoot,
     executeScratchGc: (root, o) => executeScratchGc(root, { apply: o.apply }),
     // #2759: same fetch+ff-only sync SessionStart runs, wired here too so an on-demand `mmi-cli doctor`

package/dist/repo-index-v4.cjs

@@ -85,6 +85,30 @@ function defaultIsIgnored(root, relPaths, exec = import_node_child_process.execF
 var import_node_child_process2 = require("node:child_process");
 var import_node_path2 = require("node:path");
 
+// ../infra/repo-index-path-policy.mjs
+var HARD_DENY = Object.freeze([
+  /(^|\/)\.env(\.|$)/i,
+  /(^|\/)\.env\./i,
+  /credentials/i,
+  /secrets?\.json$/i,
+  /\.pem$/i,
+  /\.p12$/i,
+  /\.key$/i,
+  /(^|\/)id_rsa/i,
+  /(^|\/)id_ed25519/i,
+  /\.keystore$/i
+]);
+function isHardDeniedRepoIndexPath(value) {
+  return typeof value !== "string" || HARD_DENY.some((pattern) => pattern.test(value));
+}
+function isSafeRepoIndexPath(value) {
+  if (typeof value !== "string" || !value || value.length > 1024) return false;
+  if (value.startsWith("/") || value.includes("\\") || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+  const segments = value.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return false;
+  return !isHardDeniedRepoIndexPath(value);
+}
+
 // src/repo-runtime-state.ts
 var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
@@ -120,18 +144,6 @@ function repoRuntimeStatePath(cwd, ...parts) {
 }
 
 // src/repo-index.ts
-var HARD_DENY = [
-  /(^|\/)\.env(\.|$)/i,
-  /(^|\/)\.env\./i,
-  /credentials/i,
-  /secrets?\.json$/i,
-  /\.pem$/i,
-  /\.p12$/i,
-  /\.key$/i,
-  /(^|\/)id_rsa/i,
-  /(^|\/)id_ed25519/i,
-  /\.keystore$/i
-];
 var INDEXABLE_EXT = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -155,10 +167,10 @@ var INDEXABLE_EXT = /* @__PURE__ */ new Set([
   ".html"
 ]);
 function isHardDeniedPath(relPosix) {
-  return HARD_DENY.some((re) => re.test(relPosix));
+  return isHardDeniedRepoIndexPath(relPosix);
 }
 function isIndexablePath(relPosix) {
-  if (isHardDeniedPath(relPosix)) return false;
+  if (!isSafeRepoIndexPath(relPosix)) return false;
   if (relPosix.startsWith(".git/")) return false;
   if (relPosix.includes("node_modules/")) return false;
   if (relPosix.includes("dist/")) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.139.1",
+  "version": "3.139.2",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",