@mutmutco/cli 3.25.0 → 3.27.0

package/dist/main.cjs

@@ -3616,13 +3616,29 @@ var CLI_EXIT_WATCHDOG_MS = 1e4;
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
   const timer = setTimeout(() => {
     console.error(
-      `mmi-cli: command finished but the process did not exit within ${watchdogMs}ms \u2014 a handle leaked; forcing exit (#2904). Please report this.`
+      `mmi-cli: command finished but the process did not exit within ${watchdogMs}ms \u2014 a handle leaked (${describeActiveHandles()}); forcing exit (#2904). Please report this.`
     );
     void flushStdio().finally(() => process.exit(typeof process.exitCode === "number" ? process.exitCode : 0));
   }, watchdogMs);
   timer.unref?.();
   await closeHttpPool();
 }
+function describeActiveHandles() {
+  let summary;
+  try {
+    const counts = /* @__PURE__ */ new Map();
+    for (const type of process.getActiveResourcesInfo()) counts.set(type, (counts.get(type) ?? 0) + 1);
+    summary = [...counts.entries()].sort().map(([type, n]) => n > 1 ? `${type}\xD7${n}` : type).join(", ") || "none reported";
+  } catch {
+    summary = "unavailable";
+  }
+  try {
+    const children = (process._getActiveHandles?.() ?? []).filter((h) => h?.constructor?.name === "ChildProcess").map((h) => `${h.spawnfile ?? "?"}(pid=${h.pid ?? "?"})`);
+    if (children.length) summary += `; live children: ${children.join(", ")}`;
+  } catch {
+  }
+  return summary;
+}
 async function failGraceful(msg) {
   console.error(`mmi-cli ${msg}`);
   return cleanExit(1);
@@ -5453,6 +5469,7 @@ function buildPrMergeArgs(input) {
 function basePolicyBlocksImmediateMerge(message) {
   return /base branch policy prohibits|protected branch|required status check|merge queue/i.test(message);
 }
+var PR_MERGE_ENQUEUED_EXIT_CODE = 2;
 function ghPrMergeLocalBranchDeleteWarning(message) {
   return /used by worktree|cannot delete branch/i.test(message);
 }
@@ -6196,7 +6213,7 @@ function formatGcPlan(plan, apply) {
 }
 
 // src/project-model.ts
-var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-game", "non-deployable", "cli-tool", "worker"];
+var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "non-deployable", "cli-tool", "worker"];
 var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "registry-publish", "content", "none"];
 var RELEASE_TRACKS = ["full", "direct", "trunk"];
 var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
@@ -6233,12 +6250,12 @@ function resolveDeployModel(meta, repo) {
   const projectType = resolveProjectType(meta, repo);
   if (projectType === "content" || meta?.class === "content") return "content";
   if (projectType === "hub-service" || repoIsHub(repo)) return "hub-serverless";
-  if (projectType === "desktop-game" || projectType === "non-deployable") return "none";
+  if (projectType === "desktop-app" || projectType === "desktop-game" || projectType === "non-deployable") return "none";
   if (projectType === "cli-tool") return "registry-publish";
   return "tenant-container";
 }
 function projectTypeClearsWebProfile(projectType, deployModel) {
-  return projectType === "content" || projectType === "desktop-game" || projectType === "non-deployable" || projectType === "cli-tool" || deployModel === "content" || deployModel === "none" || deployModel === "registry-publish";
+  return projectType === "content" || projectType === "desktop-app" || projectType === "desktop-game" || projectType === "non-deployable" || projectType === "cli-tool" || deployModel === "content" || deployModel === "none" || deployModel === "registry-publish";
 }
 function inferReleaseTrackFromBranches(hints) {
   if (hints.hasRcBranch) return void 0;
@@ -9200,7 +9217,7 @@ function resolveMergeCiPolicy(input) {
     (p) => /^\.github\/workflows\/[^/]+\.(ya?ml)$/i.test(p.replace(/\\/g, "/"))
   );
   if (!ciWorkflows.length) {
-    return { policy: "no-ci", reason: "no .github/workflows CI" };
+    return { policy: "no-ci", reason: "no pull_request-triggered .github/workflows CI" };
   }
   return { policy: "wait-for-checks", reason: ciWorkflows.join(", ") };
 }
@@ -9211,13 +9228,18 @@ function parseGhPrChecksOutput(stdout) {
   const lines = text.split(/\r?\n/).filter((l) => l.trim());
   if (!lines.length) return "no-checks-reported";
   let anyPending = false;
+  let anyFailure = false;
   for (const line of lines) {
     const parts = line.includes("	") ? line.split("	") : line.split(/\s+/);
     const state = (parts[1] ?? "").toLowerCase();
-    if (state === "fail" || state === "failure" || state === "error") return "failure";
+    if (state === "fail" || state === "failure" || state === "error") {
+      anyFailure = true;
+      continue;
+    }
     if (state === "pass" || state === "success" || state === "skipping" || state === "skipped") continue;
     anyPending = true;
   }
+  if (anyFailure) return anyPending ? "failing" : "failure";
   return anyPending ? "pending" : "success";
 }
 function parseGhPrChecksResult(stdout, stderr) {
@@ -9230,14 +9252,16 @@ function parseGhPrChecksResult(stdout, stderr) {
 function pollStateFromParsed(parsed) {
   return parsed === "error" ? "failure" : parsed;
 }
+var PR_CHECKS_TIMEOUT_EXIT_CODE = 2;
 var PR_CHECKS_POLL_MS = 3e4;
-var PR_CHECKS_TIMEOUT_MS = 10 * 6e4;
+var PR_CHECKS_TIMEOUT_MS = 30 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
 var PR_CHECKS_CONFIRM_MS = 5e3;
+var PR_CHECKS_FAILURE_CONFIRMATIONS = 2;
 var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
 function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none") {
   if (checks === "no-checks-reported") return { action: "proceed" };
-  const staleNote = `registry says no-ci (${policyReason}), but live PR checks exist`;
+  const staleNote = `merge CI policy says no-ci (${policyReason}), but live PR checks exist`;
   if (checks === "success") {
     return { action: "proceed", note: `${staleNote}; proceeding because they are green` };
   }
@@ -9264,12 +9288,39 @@ async function waitForPrChecks(deps) {
     queuedStates.push(firstState);
   }
   const now = deps.now ?? (() => Date.now());
-  const deadline = now() + PR_CHECKS_TIMEOUT_MS;
+  const timeoutMs = deps.timeoutMs ?? PR_CHECKS_TIMEOUT_MS;
+  const started = now();
+  const deadline = started + timeoutMs;
+  const report = (state) => {
+    try {
+      const elapsedMs = now() - started;
+      deps.progress?.({ state, elapsedMs, remainingMs: Math.max(0, deadline - now()) });
+    } catch {
+    }
+  };
   let lastDetail = "pending";
   let successStreak = 0;
+  let failureStreak = 0;
+  report("starting");
   while (now() < deadline) {
     const state = queuedStates.shift() ?? await deps.pollChecks();
-    if (state === "failure") return { policy, status: "failure", reason, detail: lastDetail };
+    report(state);
+    if (state !== "success") successStreak = 0;
+    if (state !== "failure") failureStreak = 0;
+    if (state === "failure") {
+      failureStreak += 1;
+      if (failureStreak >= PR_CHECKS_FAILURE_CONFIRMATIONS) {
+        return { policy, status: "failure", reason, detail: "checks-failure" };
+      }
+      lastDetail = "confirming-failure";
+      await deps.sleep(PR_CHECKS_POLL_MS);
+      continue;
+    }
+    if (state === "failing") {
+      lastDetail = "failing (a check failed; others still running)";
+      await deps.sleep(PR_CHECKS_POLL_MS);
+      continue;
+    }
     if (state === "success") {
       successStreak += 1;
       if (successStreak >= PR_CHECKS_SUCCESS_CONFIRMATIONS) {
@@ -9279,7 +9330,6 @@ async function waitForPrChecks(deps) {
       await deps.sleep(PR_CHECKS_CONFIRM_MS);
       continue;
     }
-    successStreak = 0;
     if (state === "no-checks-reported") {
       lastDetail = "no-checks-reported (waiting for workflow to queue)";
       await deps.sleep(PR_CHECKS_POLL_MS);
@@ -9288,7 +9338,7 @@ async function waitForPrChecks(deps) {
     lastDetail = state;
     await deps.sleep(PR_CHECKS_POLL_MS);
   }
-  return { policy, status: "timeout", reason, detail: lastDetail };
+  return { policy, status: "timeout", reason, detail: lastDetail, waitedMs: now() - started };
 }
 
 // src/bootstrap-ruleset.ts
@@ -9376,6 +9426,11 @@ function workflowTriggersPullRequest(yaml) {
   if (!onBlock) return false;
   return /\bpull_request\b/.test(onBlock);
 }
+function workflowReportsPrChecks(yaml) {
+  const onBlock = extractOnBlock(yaml);
+  if (!onBlock) return false;
+  return /\bpull_request(_target)?\b/.test(onBlock);
+}
 function extractOnBlock(yaml) {
   const lines = yaml.split(/\r?\n/);
   let inOn = false;
@@ -9608,6 +9663,10 @@ function seedMatchesDeployModel(seed, deployModel) {
   if (!seed.deployModels?.length) return true;
   return deployModel != null && seed.deployModels.includes(deployModel);
 }
+function seedMatchesProjectType(seed, projectType) {
+  if (!seed.projectTypes?.length) return true;
+  return projectType != null && seed.projectTypes.includes(projectType);
+}
 function planSeedAction(seed, exists) {
   if (seed.source === "fanout") {
     return { target: seed.target, action: "skip", ownership: "fanout", reason: "delivered by the fanout pipeline" };
@@ -9620,18 +9679,25 @@ function planSeedAction(seed, exists) {
   }
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
-function reconcileSeedAction(action, content, isManagedBlock) {
+function reconcileSeedAction(action, content, isManagedBlock, remoteContent = null) {
   if (action.action === "skip") return action;
   if (content == null) {
     return { ...action, action: "skip", reason: "no resolvable content" };
   }
-  if (isManagedBlock) return action;
-  const unfilled = missingPlaceholders(content);
-  if (unfilled.length) {
-    return { ...action, action: "skip", reason: `unfilled: ${unfilled.join(", ")} \u2014 pass --var` };
+  if (!isManagedBlock) {
+    const unfilled = missingPlaceholders(content);
+    if (unfilled.length) {
+      return { ...action, action: "skip", reason: `unfilled: ${unfilled.join(", ")} \u2014 pass --var` };
+    }
+  }
+  if (action.action === "update" && remoteContent != null && sameIgnoringEol(content, remoteContent)) {
+    return { ...action, action: "skip", reason: "already current" };
   }
   return action;
 }
+function sameIgnoringEol(a, b) {
+  return a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
+}
 function renderSeedPlan(actions) {
   const lines = ["bootstrap apply \u2014 seed plan (dry-run; no mutations):"];
   for (const a of actions) {
@@ -9915,12 +9981,12 @@ async function listWorkflowPaths(deps, repo, branch) {
       `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`
     );
     return (entries ?? []).filter((e) => e.type === "file" && /\.ya?ml$/i.test(e.name ?? "")).map((e) => `.github/workflows/${e.name}`);
-  } catch {
-    return [];
+  } catch (e) {
+    return e?.status === 404 ? [] : void 0;
   }
 }
 async function resolveEmittedPrContexts(deps, repo, branch) {
-  const paths = await listWorkflowPaths(deps, repo, branch);
+  const paths = await listWorkflowPaths(deps, repo, branch) ?? [];
   const workflows = [];
   for (const path2 of paths) {
     const body = await fetchFileContent(deps, repo, branch, path2);
@@ -9973,12 +10039,25 @@ async function resolveRepoMergeCiPolicy(repo, deps) {
   }
   const baseBranch = "development";
   const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
+  const workflowPaths = repoClass === "hub" ? [".github/workflows/gate.yml"] : hasGate ? [PRODUCT_GATE_PATH] : await listWorkflowPaths(deps, repo, baseBranch);
+  if (workflowPaths === void 0) {
+    return { policy: "wait-for-checks", reason: "workflows listing unreadable (API error) \u2014 failing safe to wait-for-checks" };
+  }
+  const prTriggered = await filterPullRequestTriggered(deps, repo, baseBranch, workflowPaths);
   return resolveMergeCiPolicy({
-    workflowPaths: hasGate ? repoClass === "hub" ? [".github/workflows/gate.yml"] : [PRODUCT_GATE_PATH] : [],
+    workflowPaths: prTriggered,
     registryCi: meta?.ci,
     registryRequiredChecks: meta?.requiredChecks
   });
 }
+async function filterPullRequestTriggered(deps, repo, branch, paths) {
+  const kept = [];
+  for (const path2 of paths) {
+    const body = await fetchFileContent(deps, repo, branch, path2);
+    if (body == null || workflowReportsPrChecks(body)) kept.push(path2);
+  }
+  return kept;
+}
 async function auditRepoCi(repo, deps) {
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const repoClass = classifyRepo(repo, meta);
@@ -11927,7 +12006,6 @@ function bootstrapPlan(repo, repoClass) {
     { label: `apply branch protection / allowlist: ${protectedBranches}`, gated: true },
     { label: "attach GitHub Project v2 and register Hub registry META", gated: true },
     { label: "seed README.md and architecture.md", gated: true },
-    { label: "commit .cursor/rules/<repo>.mdc", gated: true },
     { label: `register fanout target on ${repoClass === "content" ? "main" : "development"}`, gated: true }
   ];
 }
@@ -14957,9 +15035,6 @@ async function contentText(deps, repo, branch, path2) {
     return null;
   }
 }
-function repoSlugFromFullName(repo) {
-  return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
-}
 async function getProtection(deps, repo, branch) {
   try {
     return await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection`) ?? {};
@@ -15109,13 +15184,6 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     label: "architecture.md is filled (no template placeholders)",
     detail: archPlaceholders.length ? `unfilled: ${archPlaceholders.join(", ")}` : void 0
   });
-  const agentRulesPath = `.cursor/rules/${repoSlugFromFullName(repo)}.mdc`;
-  const agentRulesOk = await contentExists2(deps, repo, baseBranch, agentRulesPath);
-  checks.push({
-    ok: agentRulesOk,
-    label: "Cursor agent rules file exists",
-    detail: agentRulesOk ? void 0 : `expected: ${agentRulesPath}`
-  });
   const labels = await restPagedJson2(deps, `repos/${repo}/labels`, []);
   const labelNames = new Set(labels.map((l) => l.name));
   for (const label of requiredLabels) {
@@ -15699,10 +15767,16 @@ function attestedLine(att) {
 var CONTRACT_UNDECLARED_LINE = "No runtime secrets declared \u2014 declare requiredRuntimeSecrets (a per-stage name map) in the registry META, or attest the app needs none with an explicit empty stage map ({ dev: [], rc: [], main: [] }).";
 function appGapsFor(meta, model, slug, projectType, mainDeployFact) {
   const attested = appAttestationOf(meta);
-  const isTenantWeb = !(projectType === "content" || model === "content") && projectType !== "desktop-game" && projectType !== "cli-tool" && !(projectType === "non-deployable" || model === "none") && model !== "hub-serverless" && model !== "serverless" && model !== "registry-publish";
+  const isTenantWeb = !(projectType === "content" || model === "content") && projectType !== "desktop-app" && projectType !== "desktop-game" && projectType !== "cli-tool" && !(projectType === "non-deployable" || model === "none") && model !== "hub-serverless" && model !== "serverless" && model !== "registry-publish";
   const contractUndeclared = isTenantWeb && Boolean(meta) && !hasRuntimeSecretContract(meta?.requiredRuntimeSecrets);
   if (attested) return contractUndeclared ? [attestedLine(attested), CONTRACT_UNDECLARED_LINE] : [attestedLine(attested)];
   if (projectType === "content" || model === "content") return ["Content repo: keep app-owned work to docs/content changes; release train does not apply."];
+  if (projectType === "desktop-app") {
+    return [
+      "Desktop app: no Hub deploy coords, Google OAuth, DWD, or tenant control by default; keep app-owned installer/packaging outside the tenant train.",
+      "Keep README.md and architecture.md explicit about the per-OS build and distribution path (installer, and any registry publish alongside it) so readiness does not guess web infra."
+    ];
+  }
   if (projectType === "desktop-game") {
     return [
       "Desktop game: no Hub deploy coords, Google OAuth, DWD, or tenant control by default; keep app-owned release packaging outside the tenant train.",
@@ -15836,7 +15910,7 @@ function buildV2HealPatch(repoOrSlug, meta, mainDeployFact) {
       patch.requiredRuntimeSecrets = next;
     }
   }
-  const appOwnedGaps = confidentType ? appGapsFor(meta, model, slug, confidentType, mainDeployFact) : [`Project type is unset and not derivable \u2014 classify with \`mmi-cli project set ${repo} --project-type <web-app|hub-service|content|desktop-game|non-deployable|cli-tool|worker> --deploy-model <tenant-container|solo-container|hub-serverless|serverless|registry-publish|content|none>\` before heal completes the v2 fields (prevents defaulting a non-web repo to tenant-container).`];
+  const appOwnedGaps = confidentType ? appGapsFor(meta, model, slug, confidentType, mainDeployFact) : [`Project type is unset and not derivable \u2014 classify with \`mmi-cli project set ${repo} --project-type <web-app|hub-service|content|desktop-app|desktop-game|non-deployable|cli-tool|worker> --deploy-model <tenant-container|solo-container|hub-serverless|serverless|registry-publish|content|none>\` before heal completes the v2 fields (prevents defaulting a non-web repo to tenant-container).`];
   if (boardRegistryGaps(meta).length) appOwnedGaps.unshift(boardRegistryGapMessage(repo));
   return { slug, patch, appOwnedGaps };
 }
@@ -16447,6 +16521,15 @@ function settableVarHelp() {
   });
   return `META field to set (repeatable): ${keys.join(", ")}`;
 }
+function duplicateVarKeyAcrossFlags(vars, sets) {
+  const keyOf = (v) => v.includes("=") ? v.slice(0, v.indexOf("=")) : v;
+  const varKeys = new Set(vars.map(keyOf));
+  for (const s of sets) {
+    const key = keyOf(s);
+    if (varKeys.has(key)) return key;
+  }
+  return null;
+}
 function buildProjectSetPatch(input) {
   const patch = {};
   if (input.class) {
@@ -16475,7 +16558,11 @@ function buildProjectSetPatch(input) {
   }
   for (const value of input.vars) {
     const eq = value.indexOf("=");
-    if (eq <= 0) throw new Error(`project set: --var must be KEY=VALUE (got "${value}")`);
+    if (eq <= 0) {
+      const looksPositional = value.includes("/") || !value.includes("=");
+      const hint = looksPositional ? " \u2014 if that is the [owner/repo] argument, put it BEFORE --var; a variadic flag swallows the tokens after it" : "";
+      throw new Error(`project set: --var must be KEY=VALUE (got "${value}")${hint}`);
+    }
     const key = value.slice(0, eq);
     const raw = value.slice(eq + 1);
     if (!SETTABLE_VAR_KEY_SET.has(key)) {
@@ -18200,6 +18287,28 @@ function validateBatchSpecs(specs) {
   }
   return { ok: errors.length === 0, errors, validated };
 }
+var NORTH_STAR_LABEL_COLOR = "5319e7";
+function northStarLabelsForBatch(specs) {
+  const labels = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    if (spec.northStar) labels.add(northStarLabel(normalizeNorthStarSlug(spec.northStar)));
+    for (const l of spec.labels ?? []) if (l.startsWith("northstar:")) labels.add(l);
+  }
+  return [...labels].sort((a, b) => a.localeCompare(b));
+}
+async function ensureNorthStarLabels(client, repo, specs) {
+  const minted = [];
+  for (const name of northStarLabelsForBatch(specs)) {
+    try {
+      await client.rest("POST", `repos/${repo}/labels`, {
+        body: { name, color: NORTH_STAR_LABEL_COLOR, description: `North Star: ${name.slice("northstar:".length)}` }
+      });
+      minted.push(name);
+    } catch {
+    }
+  }
+  return minted;
+}
 async function createIssuesBatch(specs, options, deps = {}) {
   const client = deps.client ?? defaultGitHubClient();
   const validation = validateBatchSpecs(specs);
@@ -18210,6 +18319,7 @@ ${lines}`);
   }
   const repo = await resolveRepo(options.repo);
   if (!repo) throw new Error("could not resolve repo \u2014 pass --repo owner/repo");
+  await ensureNorthStarLabels(client, repo, validation.validated.map((v) => v.spec));
   const created = [];
   const failures = [];
   for (const entry of validation.validated) {
@@ -19588,7 +19698,7 @@ function registerPrLifecycleCommands(program3) {
         const { state, rows } = await snap();
         const output = { state, checks: rows };
         console.log(JSON.stringify(output));
-        if (state === "failure") process.exitCode = 1;
+        if (state === "failure" || state === "failing") process.exitCode = 1;
         return;
       }
       const deadline = Date.now() + CHECKS_WATCH_TIMEOUT_MS;
@@ -20509,11 +20619,15 @@ function acquireWorktreeSetupLock(worktreeRoot) {
   }
 }
 var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
-worktree.command("create <branch>").description("create a worktree from a base ref and provision it (install deps + copy local-only config)").option("--from <ref>", "base ref to branch from", "origin/development").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch>)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--json", "machine-readable output").action(async (branch, o) => {
+worktree.command("create <branch>").description("create a worktree from a base ref and provision it (install deps + copy local-only config)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<branch>)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--json", "machine-readable output").action(async (branch, o, cmd) => {
   try {
+    if (o.base !== void 0 && cmd.getOptionValueSource("from") === "cli" && o.base !== o.from) {
+      return fail(`worktree create: --from and --base are the same option (--base is an alias); got --from ${o.from} and --base ${o.base} \u2014 pass one`);
+    }
+    const fromRef = o.base ?? o.from;
     const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     const wtPath = o.path ?? defaultWorktreePath(repoRoot2, branch);
-    const { base, fetchBranch } = resolveWorktreeBase(o.from, o.remote);
+    const { base, fetchBranch } = resolveWorktreeBase(fromRef, o.remote);
     if (fetchBranch) {
       const fetchErr = await execFileP2("git", ["fetch", o.remote, fetchBranch], { timeout: GH_MUTATION_TIMEOUT_MS }).then(() => void 0).catch((e) => (e instanceof Error ? e.message : String(e)).split("\n")[0]);
       if (fetchErr) console.error(`  warning: could not fetch ${o.remote}/${fetchBranch} (${fetchErr}); base ${base} may be stale`);
@@ -20969,7 +21083,7 @@ project.command("attest [owner/repo]").description("attest this repo's app-owned
   const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
   return reportWrite("project attest", res);
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -20979,7 +21093,10 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   }
   const slug = slugOf(target);
   const repo = target.includes("/") ? target : `mutmutco/${slug}`;
-  const vars = rawValues("--var");
+  const setAlias = o.set ?? [];
+  const vars = [...o.var ?? [], ...setAlias];
+  const dupe = duplicateVarKeyAcrossFlags(o.var ?? [], setAlias);
+  if (dupe) return fail(`project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
       vars.push(`secrets=${(0, import_node_fs24.readFileSync)(o.secretsFile, "utf8")}`);
@@ -20995,7 +21112,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
       deployModel: o.deployModel,
       releaseTrack: o.releaseTrack,
       vars,
-      unsets: rawValues("--unset"),
+      unsets: o.unset ?? [],
       clearWebProfile: Boolean(o.clearWebProfile)
     });
   } catch (e) {
@@ -21614,7 +21731,13 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
 async function listCiWorkflowPaths(cwd = process.cwd()) {
   const wfDir = (0, import_node_path23.join)(cwd, ".github", "workflows");
   if (!(0, import_node_fs24.existsSync)(wfDir)) return [];
-  return (0, import_node_fs24.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).map((name) => `.github/workflows/${name}`);
+  return (0, import_node_fs24.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    try {
+      return workflowReportsPrChecks((0, import_node_fs24.readFileSync)((0, import_node_path23.join)(wfDir, name), "utf8"));
+    } catch {
+      return true;
+    }
+  }).map((name) => `.github/workflows/${name}`);
 }
 async function resolveMergeCiPolicyForCheckout(repoOpt) {
   const repo = repoOpt ?? await resolveRepo();
@@ -21671,17 +21794,30 @@ async function pollGhPrChecks(prNumber, repoArgs) {
   }
   return state;
 }
-pr.command("checks-wait <number>").description("bounded wait for PR checks; skips immediately on no-ci repos (#1432)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (number, o) => {
+pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
+  let timeoutMs;
+  if (o.timeout !== void 0) {
+    const minutes = Number(o.timeout);
+    if (!Number.isFinite(minutes) || minutes <= 0) return fail("pr checks-wait: --timeout must be a positive number of minutes");
+    timeoutMs = Math.round(minutes * 6e4);
+  }
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
     sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
-    log: (message) => console.warn(message)
+    log: (message) => console.warn(message),
+    timeoutMs,
+    // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
+    // an agent harness kills it on its own (shorter) deadline before the verdict ever prints (#2940).
+    progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
   });
   if (o.json) printLine(JSON.stringify(result));
-  else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
-  if (result.status === "failure" || result.status === "timeout") process.exitCode = 1;
+  else if (result.status === "timeout") {
+    printLine(`pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.`);
+  } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
+  if (result.status === "failure") process.exitCode = 1;
+  if (result.status === "timeout") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
 });
 async function ghMergeAutoEnqueue(prNumber, repo, method) {
   const args = repo ? ["--repo", repo] : [];
@@ -21764,7 +21900,10 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
-      log: (message) => console.warn(message)
+      log: (message) => console.warn(message),
+      // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
+      // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
+      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     }),
     // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
@@ -21946,6 +22085,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   }
   const remoteBefore = await remoteBranchExists2(headRef);
   let remoteDeleteAttempted = false;
+  let upgradedToAuto = false;
   let remoteNotAttemptedReason = headIsProtected ? "protected-branch" : void 0;
   await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto, deleteBranch: !headIsProtected }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch(async (e) => {
     const message = String(e.message || "");
@@ -21969,14 +22109,30 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
       return;
     }
     if (!o.auto && basePolicyBlocksImmediateMerge(message)) {
-      throw new Error(`gh pr merge ${number}: the base-branch policy blocks an immediate merge \u2014 re-run with --auto to merge once required checks pass.`);
+      console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
+      upgradedToAuto = true;
+      await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: !headIsProtected }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
+        const m2 = String(e2.message || "");
+        if (/already been merged/i.test(m2)) {
+          remoteNotAttemptedReason = "pr-already-merged";
+          return;
+        }
+        const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
+        if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
+        if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
+      });
+      return;
     }
     if (!ghPrMergeLocalBranchDeleteWarning(message)) throw e;
   });
-  if (o.auto) {
+  if (o.auto || upgradedToAuto) {
     const state = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS5 }).catch(() => ({ stdout: "" }))).stdout.trim();
     if (state !== "MERGED") {
-      console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", pr: number, branch: headRef, state: state || "unknown" }));
+      console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", pr: number, branch: headRef, state: state || "unknown", upgradedToAuto: upgradedToAuto || void 0 }));
+      if (upgradedToAuto && !o.auto) {
+        console.warn(`pr merge: PR #${number} is ENQUEUED, not merged \u2014 auto-merge will land it once required checks pass. Exiting ${PR_MERGE_ENQUEUED_EXIT_CODE} so a chained command does not treat this as a completed merge.`);
+        process.exitCode = PR_MERGE_ENQUEUED_EXIT_CODE;
+      }
       return;
     }
   }
@@ -22310,19 +22466,6 @@ function rawValue(flag, fallback) {
   const inline = process.argv.find((arg) => arg.startsWith(`${flag}=`));
   return inline ? inline.slice(flag.length + 1) : fallback;
 }
-function rawValues(flag) {
-  const out = [];
-  for (let i = 0; i < process.argv.length; i++) {
-    const arg = process.argv[i];
-    if (arg === flag && process.argv[i + 1]) {
-      out.push(process.argv[i + 1]);
-      i++;
-      continue;
-    }
-    if (arg.startsWith(`${flag}=`)) out.push(arg.slice(flag.length + 1));
-  }
-  return out;
-}
 function stagePortFromArgv() {
   const raw = rawValue("--port", "");
   if (!raw) return void 0;
@@ -22890,7 +23033,7 @@ bootstrap.command("org-ruleset").description("drift-check the codified org no-ag
   else console.log(renderOrgRulesetDriftReport(plan));
   if (plan.action !== "noop") process.exitCode = 1;
 });
-bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo) => {
+bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
   const o = {
     class: rawValue("--class", "deployable"),
     projectType: rawValue("--project-type", ""),
@@ -22916,7 +23059,7 @@ bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: i
   const readFile4 = (p) => (0, import_node_fs24.existsSync)(p) ? (0, import_node_fs24.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const rawVars = {};
-  for (const value of rawValues("--var")) {
+  for (const value of cmdOpts.var ?? []) {
     const eq = value.indexOf("=");
     if (eq > 0) rawVars[value.slice(0, eq)] = value.slice(eq + 1);
   }
@@ -22937,6 +23080,7 @@ bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: i
   const actions = [];
   const applied = [];
   let applyDeployModel;
+  let applyProjectType;
   try {
     const payload = buildRegisterPayload(repo, o.class, vars, {
       projectType: o.projectType || void 0,
@@ -22944,6 +23088,7 @@ bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: i
       releaseTrack: o.releaseTrack || void 0
     });
     applyDeployModel = payload.deployModel;
+    applyProjectType = payload.projectType;
   } catch {
   }
   let seedPlan = { mode: "direct", ref: baseBranch, reason: "dry-run (no protection probe)" };
@@ -22968,6 +23113,7 @@ bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: i
   for (const seed of manifest.seeds) {
     if (!seed.classes.includes(o.class)) continue;
     if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
+    if (!seedMatchesProjectType(seed, applyProjectType)) continue;
     const resolved = { ...seed, target: seed.target.replace("{{REPO_SLUG}}", slug) };
     let exists = false;
     let sha;
@@ -22991,7 +23137,7 @@ bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: i
     const planned = planSeedAction(resolved, exists);
     const isBlock = resolved.source === "managed-block";
     const content = planned.action === "create" || planned.action === "update" ? isBlock ? upsertManagedGitignoreBlock(remoteContent).content : resolveSeedContent(resolved, vars, readFile4) : null;
-    const action = reconcileSeedAction(planned, content, isBlock);
+    const action = reconcileSeedAction(planned, content, isBlock, remoteContent);
     actions.push(action);
     if (o.execute && (action.action === "create" || action.action === "update")) {
       await gh(contentPutArgs(repo, resolved.target, content, seedPlan.ref, action.action === "update" ? sha : void 0));
@@ -23024,10 +23170,17 @@ bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: i
       ]);
       seedPrUrl = created.url;
     }
+    let autoMergeEnabled = true;
     await gh(["pr", "merge", seedPrUrl, "--repo", repo, "--auto", "--squash"]).catch((e) => {
-      if (!/already/i.test(String(e.message ?? ""))) throw e;
+      const message = String(e.message ?? "");
+      if (/already/i.test(message)) return;
+      if (/clean status|enablePullRequestAutoMerge/i.test(message)) {
+        autoMergeEnabled = false;
+        return;
+      }
+      throw e;
     });
-    applied.push(`seed: PR ${seedPrUrl} (base ${baseBranch} protected; auto-merge enabled)`);
+    applied.push(autoMergeEnabled ? `seed: PR ${seedPrUrl} (base ${baseBranch} protected; auto-merge enabled)` : `seed: PR ${seedPrUrl} (base ${baseBranch} protected; auto-merge refused \u2014 PR is already clean. Land it: mmi-cli pr land <n> --repo ${repo})`);
   }
   if (o.execute && o.class === "deployable") {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.25.0",
+  "version": "3.27.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",