@mutmutco/cli 3.139.1 → 3.139.3

package/dist/main.cjs

@@ -7078,9 +7078,15 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
+  const windowsCompat = {
+    // #5113: opt-in informational windows-latest proof. Default OFF — the CLI fills the rendered job
+    // YAML (or '') at the final layering step; never hand-passed.
+    GATE_WINDOWS_COMPAT_JOB_YAML: ""
+  };
   if (track === "trunk") {
     return {
       ...runtimeVars,
+      ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[main]",
       GATE_FULL_RUN_BRANCH: "main",
       GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/main"]'
@@ -7089,6 +7095,7 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
   if (track === "direct") {
     return {
       ...runtimeVars,
+      ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[development, main]",
       GATE_FULL_RUN_BRANCH: "development",
       GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/main"]'
@@ -7096,6 +7103,7 @@ function gateSeedVars(cls, releaseTrack, runtime = "node") {
   }
   return {
     ...runtimeVars,
+    ...windowsCompat,
     GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
     GATE_FULL_RUN_BRANCH: "development",
     GATE_RULESET_BRANCH_REFS_JSON: '["refs/heads/development", "refs/heads/rc", "refs/heads/main"]'
@@ -7112,8 +7120,38 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack) {
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime))) {
     out[key] ??= value;
   }
+  if (out.GATE_WINDOWS_COMPAT === "true" && !out.GATE_WINDOWS_COMPAT_JOB_YAML) {
+    out.GATE_WINDOWS_COMPAT_JOB_YAML = windowsCompatJobYaml(out);
+  }
   return out;
 }
+function windowsCompatJobYaml(vars) {
+  const workdir = vars.GATE_WORKDIR ?? ".";
+  const cmd = vars.GATE_CMD ?? DEFAULT_GATE_CMD;
+  const install = vars.GATE_INSTALL_CMD ?? "npm ci";
+  const fullRunBranch = vars.GATE_FULL_RUN_BRANCH ?? "development";
+  const runtime = vars.GATE_RUNTIME === "python" ? "python" : "node";
+  const setup = runtime === "python" ? `      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with: { python-version: '${vars.GATE_PY_VERSION ?? DEFAULT_GATE_PY_VERSION}' }` : `      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: npm, cache-dependency-path: ${vars.GATE_CACHE_DEP_PATH ?? "package-lock.json"} }`;
+  return `  # MMI-Hub#5113: opt-in Windows compatibility proof \u2014 informational only. Do NOT add this job to a
+  # required-contexts ruleset without a deliberate repo decision: the required gate stays the Linux lane
+  # (faster, cheaper, where autonomous agents run). GitHub-hosted Windows minutes cost more than Linux,
+  # hence opt-in. defaults.run.shell=bash is Git for Windows bash on windows-latest, so the check syntax
+  # the Linux gate runs keeps working here.
+  windows-compat:
+    if: \${{ github.event_name == 'pull_request' || (github.event_name == 'push' && (github.ref_name == '${fullRunBranch}' || github.ref_name == 'main')) }}
+    runs-on: windows-latest
+    defaults:
+      run: { working-directory: ${workdir}, shell: bash }
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+${setup}
+      - run: ${install}
+      # Fast proof only \u2014 the full suite stays on the Linux gate.
+      - run: ${cmd}
+`;
+}
 function gateConfigToVars(gate) {
   const out = {};
   if (!gate || typeof gate !== "object") return out;
@@ -7124,6 +7162,7 @@ function gateConfigToVars(gate) {
   if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
   const seconds = typeof gate.maxSeconds === "number" ? String(gate.maxSeconds) : gate.maxSeconds;
   if (typeof seconds === "string" && /^\d+$/.test(seconds.trim()) && Number(seconds) > 0) out.GATE_MAX_SECONDS = seconds.trim();
+  if (gate.windowsCompat === true) out.GATE_WINDOWS_COMPAT = "true";
   return out;
 }
 function seedMatchesDeployModel(seed, deployModel) {
@@ -10707,10 +10746,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.139.1",
-    tag: "v3.139.1",
-    commit: "882483d74da4",
-    npm: "@mutmutco/cli@3.139.1"
+    version: "3.139.3",
+    tag: "v3.139.3",
+    commit: "19258f64de5f",
+    npm: "@mutmutco/cli@3.139.3"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10727,14 +10766,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.139.1"
+          v3Target: "v3.139.3"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.139.1 and redeploy the Hub Lambda from tag v3.139.1 (882483d74da4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.139.1 (@mutmutco/cli@3.139.1, tag commit 882483d74da4 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.139.3 and redeploy the Hub Lambda from tag v3.139.3 (19258f64de5f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.139.3 (@mutmutco/cli@3.139.3, tag commit 19258f64de5f \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -22696,8 +22735,9 @@ var import_node_crypto5 = require("node:crypto");
 var import_node_child_process12 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
-var REPO_INDEX_SCHEMA = 1;
-var HARD_DENY = [
+
+// ../infra/repo-index-path-policy.mjs
+var HARD_DENY = Object.freeze([
   /(^|\/)\.env(\.|$)/i,
   /(^|\/)\.env\./i,
   /credentials/i,
@@ -22708,7 +22748,20 @@ var HARD_DENY = [
   /(^|\/)id_rsa/i,
   /(^|\/)id_ed25519/i,
   /\.keystore$/i
-];
+]);
+function isHardDeniedRepoIndexPath(value) {
+  return typeof value !== "string" || HARD_DENY.some((pattern) => pattern.test(value));
+}
+function isSafeRepoIndexPath(value) {
+  if (typeof value !== "string" || !value || value.length > 1024) return false;
+  if (value.startsWith("/") || value.includes("\\") || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+  const segments = value.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return false;
+  return !isHardDeniedRepoIndexPath(value);
+}
+
+// src/repo-index.ts
+var REPO_INDEX_SCHEMA = 1;
 var INDEXABLE_EXT = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -22742,10 +22795,10 @@ function repoIndexStorePath(cwd) {
   return repoRuntimeStatePath(cwd, "repo-index", "index.json");
 }
 function isHardDeniedPath(relPosix) {
-  return HARD_DENY.some((re) => re.test(relPosix));
+  return isHardDeniedRepoIndexPath(relPosix);
 }
 function isIndexablePath(relPosix) {
-  if (isHardDeniedPath(relPosix)) return false;
+  if (!isSafeRepoIndexPath(relPosix)) return false;
   if (relPosix.startsWith(".git/")) return false;
   if (relPosix.includes("node_modules/")) return false;
   if (relPosix.includes("dist/")) return false;
@@ -23215,6 +23268,7 @@ ${chunk.symbol ?? ""}
 ${chunk.blurb ?? ""}`;
   }
 }
+var V4_EMBED_TIMEOUT_MS = 15 * 6e4;
 function runEmbedder(cwd, chunks, modelDirectory, createdAt) {
   if (!chunks.length) return { embeddings: [] };
   const runner = (0, import_node_path23.join)(cwd, "repo-indexer", "src", "batch.mjs");
@@ -23223,7 +23277,7 @@ function runEmbedder(cwd, chunks, modelDirectory, createdAt) {
   if (!(0, import_node_fs25.existsSync)(file)) return { embeddings: [], reason: "embeddings-unavailable" };
   const request = { texts: chunks.map((chunk) => ({ id: chunk.id, text: embeddingInput(cwd, chunk) })), maxBatch: V4_EMBED_BATCH };
   const env = { ...process.env, ...modelDirectory ? { MMI_REPO_INDEXER_MODEL_DIR: modelDirectory } : {} };
-  const result = (0, import_node_child_process13.spawnSync)(process.execPath, [file], { input: JSON.stringify(request), encoding: "utf8", windowsHide: true, timeout: 3e5, maxBuffer: V4_MAX_ARTIFACT_BYTES, env });
+  const result = (0, import_node_child_process13.spawnSync)(process.execPath, [file], { input: JSON.stringify(request), encoding: "utf8", windowsHide: true, timeout: V4_EMBED_TIMEOUT_MS, maxBuffer: V4_MAX_ARTIFACT_BYTES, env });
   if (result.error || result.status !== 0) return { embeddings: [], reason: "embeddings-unavailable" };
   try {
     const response = JSON.parse(result.stdout);
@@ -23297,6 +23351,9 @@ async function buildRepoIndexV4(cwd, repo, opts = {}) {
 `, "utf8");
   return envelope;
 }
+function repoIndexV4StorePath(cwd) {
+  return statePath(cwd);
+}
 
 // src/repo-index-v4/shards.ts
 var V4_STAGE_MAX_BODY_BYTES = 750 * 1024;
@@ -32371,7 +32428,7 @@ var surfaces_default = {
       ownership: {
         trust: "host",
         cache: "host",
-        repair: "mmi-cli"
+        repair: "mmi-hub"
       },
       certification: {
         hostCommand: "claude",
@@ -32506,7 +32563,7 @@ var surfaces_default = {
       ownership: {
         trust: "operator",
         cache: "host",
-        repair: "mmi-cli"
+        repair: "mmi-hub"
       },
       certification: {
         hostCommand: "codex",
@@ -32767,8 +32824,8 @@ var surfaces_default = {
       },
       ownership: {
         trust: "host",
-        cache: "mmi-cli",
-        repair: "mmi-cli"
+        cache: "mmi-hub",
+        repair: "mmi-hub"
       },
       certification: {
         hostCommand: "cursor-agent",
@@ -32879,7 +32936,7 @@ var surfaces_default = {
       ownership: {
         trust: "host",
         cache: "host",
-        repair: "mmi-cli"
+        repair: "mmi-hub"
       },
       certification: {
         hostCommand: "kilo",
@@ -32997,7 +33054,7 @@ var surfaces_default = {
       ownership: {
         trust: "host",
         cache: "host",
-        repair: "mmi-cli"
+        repair: "mmi-hub"
       },
       certification: {
         hostCommand: "jervcode",
@@ -34125,19 +34182,14 @@ function checkPluginCache(input) {
     parts.push(`${input.staging.length} orphaned staging dir(s)${size}`);
   }
   return {
-    ok: false,
+    ok: true,
+    warn: true,
     id: "plugin-cache",
     label: "plugin cache",
-    // #3485: deliberately NOT `reportOnly`, and not in the closed set docs/doctor-contract.md enumerates.
-    // A checker argued it qualifies because no `doctor --apply` clears it; I tagged it, then reverted.
-    // `mmi-cli plugin prune --apply` clears it in one command and a re-run goes green, so this is an
-    // ordinary red the operator is expected to act on. "The doctor cannot heal it automatically" was never
-    // the bar — see the contract for why report-only is a per-row ruling rather than a rule you can apply
-    // from here.
-    // Lead with the versioned-cache framing when there are stale versions; otherwise report the staging litter
-    // on its own so a cache with zero versioned dirs still gets an honest ✗.
+    // Installed-surface convergence belongs to mmi-hub; the host owns its cache lifecycle. Doctor
+    // reports old generations but never races either writer by deleting them.
     detail: input.stale.length ? `${input.cached} versions cached (${parts.join("; ")})` : parts.join("; "),
-    fix: "run `mmi-cli plugin prune` to review, then `mmi-cli plugin prune --apply` to delete",
+    fix: "run `mmi-hub status` and `mmi-hub update`; if only superseded cache remains, let the host retire it after all older sessions close",
     verbose: evidence
   };
 }
@@ -34242,24 +34294,34 @@ function checkRepoIndexCloud(probe) {
     probe.builtAt ? `builtAt: ${probe.builtAt}` : "builtAt: n/a",
     typeof probe.fileCount === "number" ? `fileCount: ${probe.fileCount}` : "fileCount: n/a",
     typeof probe.embCount === "number" ? `embCount: ${probe.embCount}` : "embCount: n/a",
-    typeof probe.localPresent === "boolean" ? `local cache: ${probe.localPresent ? "present" : "absent"}` : "local cache: n/a"
+    typeof probe.localPresent === "boolean" ? `local v3 cache: ${probe.localPresent ? "present" : "absent"}` : "local v3 cache: n/a",
+    `local v4: ${probe.localV4State ?? "unknown"}${probe.localV4Commit ? ` @ ${probe.localV4Commit.slice(0, 12)}` : ""}${typeof probe.localV4EmbeddingCoverage === "number" ? ` (${Math.round(probe.localV4EmbeddingCoverage * 100)}% embeddings)` : ""}`,
+    `cloud v4: ${probe.cloudV4State ?? "unknown"}${probe.cloudV4Commit ? ` @ ${probe.cloudV4Commit.slice(0, 12)}` : ""}`,
+    `v4 cohort: ${probe.v4ReadPercent ?? 0}%`,
+    `v4 shadows: ${probe.v4ShadowComparisons ?? 0}/${probe.v4ShadowMinimum ?? 50} \u2014 ${probe.v4ShadowCutoverReady ? "cutover-ready" : "not ready"}`,
+    ...Object.entries(probe.v4ShadowErrors ?? {}).map(([kind, count]) => `v4 shadow error ${kind}: ${count}`)
   ];
   switch (probe.kind) {
-    case "healthy":
+    case "healthy": {
+      const v4Unready = probe.cloudV4State === "invalid" || probe.cloudV4State === "tombstoned" || probe.cloudV4State === "degraded" && (probe.localV4EmbeddingCoverage ?? 1) < 0.95;
+      const detail = probe.detail ?? `cloud v3 ok${typeof probe.fileCount === "number" ? ` \u2014 ${probe.fileCount} files` : ""}; v4 ${probe.cloudV4State ?? "absent"}, cohort ${probe.v4ReadPercent ?? 0}%`;
       return {
-        ok: true,
+        ok: !v4Unready || (probe.v4ReadPercent ?? 0) === 0,
+        ...v4Unready && (probe.v4ReadPercent ?? 0) === 0 ? { warn: true, verified: false } : {},
         id: "repo-index",
         label: "repo-index",
-        detail: probe.detail ?? `cloud ok${typeof probe.fileCount === "number" ? ` \u2014 ${probe.fileCount} files` : ""}`,
+        detail,
+        ...v4Unready ? { fix: "run `mmi-hub update`, then dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile`; keep the v4 cohort at 0 until shadows pass" } : {},
         verbose: evidence
       };
+    }
     case "command-absent":
       return {
         ok: false,
         id: "repo-index",
         label: "repo-index",
         detail: "this mmi-cli build has no repo-index command",
-        fix: "run `mmi-cli doctor` to heal the global CLI, or `npm install -g @mutmutco/cli`",
+        fix: "run `mmi-hub status`, then `mmi-hub update` to converge the CLI and installed host surfaces",
         verbose: evidence
       };
     case "deploy-lag":
@@ -34278,7 +34340,7 @@ function checkRepoIndexCloud(probe) {
         id: "repo-index",
         label: "repo-index",
         detail: probe.detail ?? "no cloud projection for this repo",
-        fix: "run harbour repo-index-reconcile or `mmi-cli oracle repo-index sync-estate --repo <owner/name>`",
+        fix: "dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile` or run the authenticated per-repo sync",
         verbose: evidence
       };
     case "stale":
@@ -34287,7 +34349,7 @@ function checkRepoIndexCloud(probe) {
         id: "repo-index",
         label: "repo-index",
         detail: probe.detail ?? "cloud projection looks stale vs recent pushes",
-        fix: "trigger `repo-index-reconcile` (workflow_dispatch) or wait for the 6h harbour tick",
+        fix: "dispatch `mmi-cli harbour org schedules run MMI-Hub/repo-index-reconcile` or wait for the registered 6h schedule",
         verbose: evidence
       };
     case "auth":
@@ -34305,7 +34367,7 @@ function checkRepoIndexCloud(probe) {
         id: "repo-index",
         label: "repo-index",
         detail: probe.detail ?? "Hub API URL not configured",
-        fix: "run `mmi-cli doctor` to repair Hub wiring",
+        fix: "run `mmi-hub status` and `mmi-hub update`; Hub URL wiring is installer-owned",
         verbose: evidence
       };
     case "network":
@@ -34335,6 +34397,39 @@ function planGitignore(current) {
   const { content, changed } = upsertManagedGitignoreBlock(current);
   return changed ? { ok: false, content } : { ok: true };
 }
+function checkLineEndings(probe) {
+  if (probe.error) {
+    return {
+      ok: true,
+      verified: false,
+      id: "line-endings",
+      label: "line endings",
+      detail: `could not inspect tracked shell scripts: ${probe.error}`,
+      fix: "run `git ls-files --eol -- '*.sh'` from the repository root, then re-run `mmi-cli doctor`"
+    };
+  }
+  const problems = [
+    ...probe.attributesPresent ? [] : [".gitattributes is missing"],
+    ...probe.crlfShellScripts.map((path2) => `${path2} is CRLF in the index`)
+  ];
+  if (!problems.length) {
+    return {
+      ok: true,
+      id: "line-endings",
+      label: "line endings",
+      detail: ".gitattributes present; tracked *.sh index entries are LF"
+    };
+  }
+  return {
+    ok: false,
+    id: "line-endings",
+    label: "line endings",
+    detail: problems.join("; "),
+    fix: "add the canonical .gitattributes if missing, then run `git add --renormalize .`",
+    command: "git add --renormalize .",
+    verbose: probe.crlfShellScripts.map((path2) => `i/crlf: ${path2}`)
+  };
+}
 async function runDoctorClean(opts, io, deps) {
   const full = !opts.fast && !opts.banner && !opts.preflight;
   const applyEnv = full;
@@ -34468,6 +34563,11 @@ async function runDoctorClean(opts, io, deps) {
     const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
     if (aws) emitNow(aws);
   }
+  async function runLineEndingsRow() {
+    const root = await deps.repoRoot();
+    const state = deps.lineEndingState?.(root);
+    if (state) emitNow(checkLineEndings(state));
+  }
   async function runGitignoreRow() {
     const current = deps.readGitignore();
     const gi = planGitignore(current);
@@ -34487,42 +34587,6 @@ async function runDoctorClean(opts, io, deps) {
     }
   }
   async function runPluginCacheRow() {
-    if (applyEnv && deps.prunePluginCache && spendOnce("cache-prune")) {
-      const cache = deps.pluginCache();
-      if (cache.stale.length === 0 && cache.staging.length === 0) {
-        emitNow(checkPluginCache(cache));
-        return;
-      }
-      healIntent(`plugin cache \u2014 pruning ${cache.stale.length} superseded version(s) (guarded)`);
-      traceHeal("cache-prune");
-      const outcome = deps.prunePluginCache();
-      if (outcome.removed.length) markHealChanged();
-      const evidence = [
-        ...outcome.removed.map((v) => `pruned: ${v}`),
-        ...outcome.held.map((h) => `still held: ${h.version} (${h.error}) \u2014 never forced`),
-        ...outcome.kept.map((k) => `kept: ${k.version} \u2014 ${k.reason}`)
-      ];
-      if (outcome.held.length === 0) {
-        emitNow({
-          id: "plugin-cache",
-          ok: true,
-          label: "plugin cache",
-          detail: outcome.removed.length ? `pruned ${outcome.removed.length} superseded version(s)` : "nothing provably superseded (guards kept every candidate)",
-          verbose: evidence
-        });
-      } else {
-        emitNow({
-          id: "plugin-cache",
-          ok: false,
-          reportOnly: true,
-          label: "plugin cache",
-          detail: `${outcome.removed.length} pruned; ${outcome.held.length} still held by a live session`,
-          fix: "close the session holding it and re-run `mmi-cli doctor`",
-          verbose: evidence
-        });
-      }
-      return;
-    }
     emitNow(checkPluginCache(deps.pluginCache()));
   }
   async function runClaudeBinaryRow() {
@@ -34851,6 +34915,7 @@ async function runDoctorClean(opts, io, deps) {
     { id: "aws-identity", when: true, run: runAwsRow },
     { id: "sessionstart-payload", when: true, run: runSessionPayloadRow },
     { id: "claude-binary", when: true, run: runClaudeBinaryRow },
+    { id: "line-endings", when: isOrgRepo, run: runLineEndingsRow },
     { id: "gitignore-block", when: isOrgRepo, run: runGitignoreRow }
   ];
   const maxPasses = 3;
@@ -35143,6 +35208,20 @@ function writeGitignore(content) {
     return false;
   }
 }
+function lineEndingState(root) {
+  const attributesPresent = (0, import_node_fs41.existsSync)((0, import_node_path38.join)(root, ".gitattributes"));
+  try {
+    const output = (0, import_node_child_process18.execFileSync)("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
+      windowsHide: true,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const crlfShellScripts = output.split(/\r?\n/).filter((line) => line.startsWith("i/crlf ")).map((line) => line.slice(line.indexOf("	") + 1)).filter(Boolean);
+    return { attributesPresent, crlfShellScripts };
+  } catch (error) {
+    return { attributesPresent, crlfShellScripts: [], error: error.message || "git ls-files --eol failed" };
+  }
+}
 async function ghInstalled() {
   try {
     await execFileP6("gh", ["--version"]);
@@ -35352,6 +35431,7 @@ function mmiDoctorDeps(opts = {}) {
     currentCliVersion: resolveClientVersion,
     readGitignore,
     writeGitignore,
+    lineEndingState,
     repoRoot,
     executeScratchGc: (root, o) => executeScratchGc(root, { apply: o.apply }),
     // #2759: same fetch+ff-only sync SessionStart runs, wired here too so an on-demand `mmi-cli doctor`
@@ -35520,6 +35600,21 @@ function mmiDoctorDeps(opts = {}) {
     // #4156: short-timeout Hub status for the current repo. Fail-soft — never throws to doctor.
     repoIndexCloudState: async (root) => {
       const local = repoIndexStatus(root);
+      let localV4 = { state: "absent" };
+      try {
+        const parsed = JSON.parse((0, import_node_fs42.readFileSync)(repoIndexV4StorePath(root), "utf8"));
+        const state = parsed.status?.state;
+        if (parsed.schemaVersion === 4 && (state === "ready" || state === "degraded")) {
+          const chunks = parsed.manifest?.chunks?.length ?? 0;
+          localV4 = {
+            state,
+            ...typeof parsed.manifest?.commit === "string" ? { commit: parsed.manifest.commit } : {},
+            embeddingCoverage: chunks ? (parsed.manifest?.embeddings?.length ?? 0) / chunks : 1
+          };
+        } else localV4 = { state: "invalid" };
+      } catch {
+      }
+      const localFields = { localPresent: local.present, localV4State: localV4.state, localV4Commit: localV4.commit, localV4EmbeddingCoverage: localV4.embeddingCoverage };
       try {
         const cfg = await loadConfig();
         const repo = inferRepoSlug(root);
@@ -35528,17 +35623,32 @@ function mmiDoctorDeps(opts = {}) {
           timeoutMs: 4e3
         });
         if (isRepoIndexStatusError(st)) {
-          if (st.code === "deploy-lag") return { kind: "deploy-lag", repo, localPresent: local.present };
-          if (st.code === "auth") return { kind: "auth", repo, localPresent: local.present };
-          if (st.code === "config") return { kind: "config", repo, detail: st.error, localPresent: local.present };
-          return { kind: "network", repo, detail: st.error, localPresent: local.present };
+          if (st.code === "deploy-lag") return { kind: "deploy-lag", repo, ...localFields };
+          if (st.code === "auth") return { kind: "auth", repo, ...localFields };
+          if (st.code === "config") return { kind: "config", repo, detail: st.error, ...localFields };
+          return { kind: "network", repo, detail: st.error, ...localFields };
         }
         const present = st.present;
         const builtAt = typeof st.builtAt === "string" ? st.builtAt : void 0;
         const fileCount = typeof st.fileCount === "number" ? st.fileCount : void 0;
         const embCount = typeof st.embCount === "number" ? st.embCount : void 0;
+        const v4 = st.v4;
+        const migration = st.v4Migration;
+        const shadow = st.v4Shadow;
+        const shadowThresholds = shadow?.thresholds;
+        const cloudV4State = typeof v4?.state === "string" && ["ready", "degraded", "invalid", "tombstoned"].includes(v4.state) ? v4.state : "absent";
+        const v4Fields = {
+          ...localFields,
+          cloudV4State,
+          ...typeof v4?.commit === "string" ? { cloudV4Commit: v4.commit } : {},
+          v4ReadPercent: typeof migration?.readPercent === "number" ? migration.readPercent : 0,
+          v4ShadowComparisons: typeof shadow?.comparisonCount === "number" ? shadow.comparisonCount : 0,
+          v4ShadowMinimum: typeof shadowThresholds?.minimumComparisons === "number" ? shadowThresholds.minimumComparisons : 50,
+          v4ShadowCutoverReady: shadow?.cutoverReady === true,
+          v4ShadowErrors: shadow?.errors && typeof shadow.errors === "object" ? shadow.errors : {}
+        };
         if (present === false) {
-          return { kind: "missing-projection", repo, localPresent: local.present, fileCount: 0, embCount: 0 };
+          return { kind: "missing-projection", repo, ...v4Fields, fileCount: 0, embCount: 0 };
         }
         if (builtAt) {
           const ageMs = Date.now() - Date.parse(builtAt);
@@ -35549,7 +35659,7 @@ function mmiDoctorDeps(opts = {}) {
               builtAt,
               fileCount,
               embCount,
-              localPresent: local.present,
+              ...v4Fields,
               detail: `projection builtAt ${builtAt} (>48h old)`
             };
           }
@@ -35560,13 +35670,13 @@ function mmiDoctorDeps(opts = {}) {
           builtAt,
           fileCount,
           embCount,
-          localPresent: local.present
+          ...v4Fields
         };
       } catch (e) {
         return {
           kind: "network",
           detail: e instanceof Error ? e.message : String(e),
-          localPresent: local.present
+          ...localFields
         };
       }
     }

package/dist/repo-index-v4.cjs

@@ -85,6 +85,30 @@ function defaultIsIgnored(root, relPaths, exec = import_node_child_process.execF
 var import_node_child_process2 = require("node:child_process");
 var import_node_path2 = require("node:path");
 
+// ../infra/repo-index-path-policy.mjs
+var HARD_DENY = Object.freeze([
+  /(^|\/)\.env(\.|$)/i,
+  /(^|\/)\.env\./i,
+  /credentials/i,
+  /secrets?\.json$/i,
+  /\.pem$/i,
+  /\.p12$/i,
+  /\.key$/i,
+  /(^|\/)id_rsa/i,
+  /(^|\/)id_ed25519/i,
+  /\.keystore$/i
+]);
+function isHardDeniedRepoIndexPath(value) {
+  return typeof value !== "string" || HARD_DENY.some((pattern) => pattern.test(value));
+}
+function isSafeRepoIndexPath(value) {
+  if (typeof value !== "string" || !value || value.length > 1024) return false;
+  if (value.startsWith("/") || value.includes("\\") || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+  const segments = value.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return false;
+  return !isHardDeniedRepoIndexPath(value);
+}
+
 // src/repo-runtime-state.ts
 var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
@@ -120,18 +144,6 @@ function repoRuntimeStatePath(cwd, ...parts) {
 }
 
 // src/repo-index.ts
-var HARD_DENY = [
-  /(^|\/)\.env(\.|$)/i,
-  /(^|\/)\.env\./i,
-  /credentials/i,
-  /secrets?\.json$/i,
-  /\.pem$/i,
-  /\.p12$/i,
-  /\.key$/i,
-  /(^|\/)id_rsa/i,
-  /(^|\/)id_ed25519/i,
-  /\.keystore$/i
-];
 var INDEXABLE_EXT = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -155,10 +167,10 @@ var INDEXABLE_EXT = /* @__PURE__ */ new Set([
   ".html"
 ]);
 function isHardDeniedPath(relPosix) {
-  return HARD_DENY.some((re) => re.test(relPosix));
+  return isHardDeniedRepoIndexPath(relPosix);
 }
 function isIndexablePath(relPosix) {
-  if (isHardDeniedPath(relPosix)) return false;
+  if (!isSafeRepoIndexPath(relPosix)) return false;
   if (relPosix.startsWith(".git/")) return false;
   if (relPosix.includes("node_modules/")) return false;
   if (relPosix.includes("dist/")) return false;
@@ -418,6 +430,7 @@ ${chunk.symbol ?? ""}
 ${chunk.blurb ?? ""}`;
   }
 }
+var V4_EMBED_TIMEOUT_MS = 15 * 6e4;
 function runEmbedder(cwd, chunks, modelDirectory, createdAt) {
   if (!chunks.length) return { embeddings: [] };
   const runner = (0, import_node_path4.join)(cwd, "repo-indexer", "src", "batch.mjs");
@@ -426,7 +439,7 @@ function runEmbedder(cwd, chunks, modelDirectory, createdAt) {
   if (!(0, import_node_fs3.existsSync)(file)) return { embeddings: [], reason: "embeddings-unavailable" };
   const request = { texts: chunks.map((chunk) => ({ id: chunk.id, text: embeddingInput(cwd, chunk) })), maxBatch: V4_EMBED_BATCH };
   const env = { ...process.env, ...modelDirectory ? { MMI_REPO_INDEXER_MODEL_DIR: modelDirectory } : {} };
-  const result = (0, import_node_child_process3.spawnSync)(process.execPath, [file], { input: JSON.stringify(request), encoding: "utf8", windowsHide: true, timeout: 3e5, maxBuffer: V4_MAX_ARTIFACT_BYTES, env });
+  const result = (0, import_node_child_process3.spawnSync)(process.execPath, [file], { input: JSON.stringify(request), encoding: "utf8", windowsHide: true, timeout: V4_EMBED_TIMEOUT_MS, maxBuffer: V4_MAX_ARTIFACT_BYTES, env });
   if (result.error || result.status !== 0) return { embeddings: [], reason: "embeddings-unavailable" };
   try {
     const response = JSON.parse(result.stdout);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.139.1",
+  "version": "3.139.3",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",