@mutmutco/cli 3.35.2 → 3.36.1

package/dist/main.cjs

@@ -3887,6 +3887,10 @@ function writeCache(path2, session) {
 async function hubAuthSession(deps) {
   if (!deps.baseUrl) return void 0;
   const apiUrl = normalizeBaseUrl(deps.baseUrl);
+  const envToken = process.env.MMI_HUB_TOKEN;
+  if (envToken) {
+    return { ...{ token: envToken }, expiresAt: new Date(Date.now() + 30 * 60 * 1e3).toISOString(), apiUrl, githubTokenFingerprint: "env-override" };
+  }
   const now = deps.now?.() ?? /* @__PURE__ */ new Date();
   const cachePath = deps.cachePath ?? defaultHubSessionCachePath();
   const ghToken = await deps.githubToken();
@@ -5104,6 +5108,12 @@ async function postSchedulesLift(repo, schedules, deps) {
   if (!res.ok && res.status === 404) return { ...res, unreachable: "route-absent" };
   return res;
 }
+async function postSchedulesMode(slug, mode, deps) {
+  return postJson("/projects/schedules-mode", { slug, mode }, deps);
+}
+async function postSchedulesRun(id, deps) {
+  return postJson("/schedules/run", { id }, deps, "POST", { noRetry: true });
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
@@ -9026,6 +9036,7 @@ function commandLadderHint() {
   for (const e of COMMAND_LADDER_BOARD) {
     lines.push(`${e.gh.padEnd(pad)} \u2192 ${e.replacement}`);
   }
+  lines.push("[mmi] Schedules doctrine (#3228): scheduled jobs + LLM crons go through the Hub registry \u2014 eight-field header \u2192 PR \u2192 `mmi-cli org schedules register`; LLM crons ONLY via the harbour (llm: yes \u21D2 executor cursor-agent). Never hand-build an unregistered cron. Opt out per repo: `mmi-cli org schedules mode self-managed`.");
   return lines.join("\n");
 }
 
@@ -16992,11 +17003,18 @@ function awsScheduleEntry(payload) {
     source: `aws scheduler schedule ${Name} (eu-central-1)`
   };
 }
-function awsScheduleNames(payload) {
+function awsScheduleRefs(payload) {
   if (!payload || typeof payload !== "object") return [];
   const { Schedules: schedules } = payload;
   if (!Array.isArray(schedules)) return [];
-  return schedules.map((s) => s && typeof s === "object" ? s.Name : void 0).filter((n) => typeof n === "string" && !isJervResource(n));
+  const refs = [];
+  for (const s of schedules) {
+    if (!s || typeof s !== "object") continue;
+    const { Name, GroupName } = s;
+    if (typeof Name !== "string" || isJervResource(Name)) continue;
+    refs.push(typeof GroupName === "string" && GroupName !== "default" && GroupName !== "" ? { name: Name, group: GroupName } : { name: Name });
+  }
+  return refs;
 }
 var DECLARED_ENTRIES = [
   { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli runtime box get <box> --ssh)" },
@@ -17065,7 +17083,7 @@ function cadenceStale(registryCadence, liveCadence) {
   if (!liveCrons.length) return false;
   return !liveCrons.every((cron) => registered.has(cron));
 }
-function reconcileGithubActions(liveGithub, registry2, readRepos) {
+function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflowNames = /* @__PURE__ */ new Set()) {
   const registryGithub = registry2.filter((r) => r.executor === "github-actions");
   const liveByName = new Map(liveGithub.map((e) => [e.name, e]));
   const registryById = new Map(registryGithub.map((r) => [r.id, r]));
@@ -17095,18 +17113,25 @@ function reconcileGithubActions(liveGithub, registry2, readRepos) {
       }
       continue;
     }
+    if (activeWorkflowNames.has(r.id)) continue;
     if (readRepos.has(r.repo)) {
       drifts.push({
         class: "registered-but-dead",
         name: r.id,
         executor: r.executor || "github-actions",
-        detail: "registered with no armed workflow",
-        remedy: `remove it from ${r.repo} (or re-arm the workflow), then re-run the schedules lift to prune the stale SCHEDULE# row`
+        detail: "registered with no workflow file behind it",
+        remedy: `restore the workflow in ${r.repo} (or, if it was retired on purpose, re-run the schedules lift so the replace prunes the stale SCHEDULE# row)`
       });
     }
   }
   return drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name));
 }
+function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
+  return drifts.filter((d) => {
+    if (d.class !== "stray-cron" && d.class !== "unlaunchered-llm") return true;
+    return !selfManagedRepos.has((d.name.split("/")[0] ?? "").toLowerCase());
+  });
+}
 function renderDrift(d) {
   return `${d.class}: ${d.name} (${d.executor}) \u2014 ${d.detail}; remedy: ${d.remedy}`;
 }
@@ -17125,6 +17150,7 @@ function strayCronDrifts(workflows) {
 function unlauncheredLlmDrift(entry) {
   if (entry.llm !== "yes") return null;
   if (isHarbourLlmLauncher(entry.executor)) return null;
+  if (entry.executor.startsWith("aws-scheduler") && entry.executor.includes("mmi-hub-schedule-dispatcher")) return null;
   const allowed = [...HARBOUR_LLM_LAUNCHERS].join(", ");
   return {
     class: "unlaunchered-llm",
@@ -17142,7 +17168,7 @@ function unlauncheredLlmDrifts(entries) {
   }
   return drifts.sort((a, b) => a.name.localeCompare(b.name));
 }
-function assembleReconciliation(githubEntries2, readRepos, registry2) {
+function assembleReconciliation(githubEntries2, readRepos, registry2, activeWorkflowNames = /* @__PURE__ */ new Set()) {
   if (registry2 === null) {
     return {
       reconciliation: [],
@@ -17151,7 +17177,7 @@ function assembleReconciliation(githubEntries2, readRepos, registry2) {
     };
   }
   const live = githubEntries2.filter((e) => e.executor === "github-actions");
-  const drifts = reconcileGithubActions(live, registry2, readRepos);
+  const drifts = reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames);
   return { reconciliation: drifts, driftLines: drifts.map(renderDrift), incomplete: [] };
 }
 
@@ -17214,7 +17240,7 @@ async function githubEntries(client) {
     const listing = await client.restPaginate(`/orgs/${ORG}/repos?per_page=100`);
     repos = listing.filter((r) => typeof r?.name === "string" && r.archived !== true).map((r) => r.name).sort();
   } catch (e) {
-    return { entries, incomplete: [`github: could not list ${ORG} repos \u2014 ${e.message}`], drift, reconciliation: [], readRepos };
+    return { entries, incomplete: [`github: could not list ${ORG} repos \u2014 ${e.message}`], drift, reconciliation: [], readRepos, workflowNames: [] };
   }
   const results = await Promise.all(
     repos.map(async (repo) => {
@@ -17238,7 +17264,7 @@ async function githubEntries(client) {
   }
   const reconciliation = [...strayCronDrifts(workflows), ...unlauncheredLlmDrifts(entries)];
   drift.push(...reconciliation.map(renderDrift));
-  return { entries, incomplete, drift, reconciliation, readRepos };
+  return { entries, incomplete, drift, reconciliation, readRepos, workflowNames: workflows.map((w) => w.name) };
 }
 async function awsJson(args) {
   const run = async () => {
@@ -17265,9 +17291,10 @@ async function awsEntries() {
     incomplete.push(`aws: events list-rules failed \u2014 ${e.message}`);
   }
   try {
-    const names = awsScheduleNames(await awsJson(["scheduler", "list-schedules"]));
-    for (const name of names) {
-      const entry = awsScheduleEntry(await awsJson(["scheduler", "get-schedule", "--name", name]));
+    const refs = awsScheduleRefs(await awsJson(["scheduler", "list-schedules"]));
+    for (const ref of refs) {
+      const args = ["scheduler", "get-schedule", "--name", ref.name, ...ref.group ? ["--group-name", ref.group] : []];
+      const entry = awsScheduleEntry(await awsJson(args));
       if (entry) entries.push(entry);
     }
   } catch (e) {
@@ -17279,20 +17306,34 @@ async function awsEntries() {
 async function defaultRegistryRead() {
   return fetchSchedulesList(registryClientDeps(await loadConfig()));
 }
-async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead) {
-  const [gh, aws, registry2] = await Promise.all([
+async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead, readProjects = defaultProjectsRead) {
+  const [gh, aws, registry2, projects] = await Promise.all([
     githubEntries(client),
     awsEntries(),
-    readRegistry().catch(() => null)
+    readRegistry().catch(() => null),
+    readProjects().catch(() => null)
   ]);
-  const recon = assembleReconciliation(gh.entries, new Set(gh.readRepos), registry2);
+  const recon = assembleReconciliation(gh.entries, new Set(gh.readRepos), registry2, new Set(gh.workflowNames));
+  const selfManaged = /* @__PURE__ */ new Set();
+  for (const proj of projects ?? []) {
+    if (proj?.schedulesMode !== "self-managed") continue;
+    for (const r of proj.repos ?? []) selfManaged.add((r.split("/").pop() ?? "").toLowerCase());
+  }
+  const reconciliation = suppressSelfManagedDrifts(
+    [...gh.reconciliation, ...aws.reconciliation, ...recon.reconciliation],
+    selfManaged
+  );
+  const driftLines = reconciliation.map(renderDrift);
   return {
     entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
     incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete],
-    drift: [...gh.drift, ...aws.drift, ...recon.driftLines],
-    reconciliation: [...gh.reconciliation, ...aws.reconciliation, ...recon.reconciliation]
+    drift: driftLines,
+    reconciliation
   };
 }
+async function defaultProjectsRead() {
+  return fetchProjectsList(registryClientDeps(await loadConfig()));
+}
 function warnIncomplete2(incomplete) {
   for (const f of incomplete) console.error(`org schedules: WARNING \u2014 ${f}`);
   if (incomplete.length) console.error("org schedules: this notebook is INCOMPLETE \u2014 schedules may be missing from it.");
@@ -17301,7 +17342,7 @@ function reportDrift(drift) {
   for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
 function registerSchedulesCommands(program3) {
-  program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "splice the generated inventory into the given doc between the schedules:inventory markers (docs/schedules.md)").action(async (o) => {
+  const schedules = program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "splice the generated inventory into the given doc between the schedules:inventory markers (docs/schedules.md)").action(async (o) => {
     try {
       const { entries, incomplete, drift, reconciliation } = await fetchNotebook();
       if (o.doc) {
@@ -17329,6 +17370,44 @@ function registerSchedulesCommands(program3) {
       await failGraceful(e.message);
     }
   });
+  schedules.command("run <schedule-id>").description("fire one registered schedule NOW through the harbour dispatcher (same guardrails as a clocked run) \u2014 master or a repo-admin of the schedule\u2019s repo (#3220)").action(async (scheduleId) => {
+    try {
+      const res = await postSchedulesRun(scheduleId, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules run: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
+  schedules.command("mode <mode>").description("fleet schedules doctrine for a repo: 'managed' (default \u2014 Hub registry + drift enforcement) or 'self-managed' (opt out; the repo owns its crons). Project-admin self-serve (#3228).").option("--repo <name>", "bare repo name (defaults to the origin remote basename)").action(async (mode, o) => {
+    try {
+      if (mode !== "managed" && mode !== "self-managed") {
+        await failGraceful("schedules mode: mode must be 'managed' or 'self-managed'");
+        return;
+      }
+      let repo = o.repo?.trim();
+      if (!repo) {
+        const url = await gitOut(["remote", "get-url", "origin"]);
+        repo = url.trim().replace(/\.git$/, "").split(/[/:]/).filter(Boolean).pop() ?? "";
+      }
+      if (!repo) {
+        await failGraceful("schedules mode: could not resolve the repo \u2014 pass --repo <name>");
+        return;
+      }
+      const slug = repo.toLowerCase();
+      const res = await postSchedulesMode(slug, mode, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules mode: HTTP ${res.status} \u2014 ${res.error ?? "write failed"}`);
+        return;
+      }
+      console.log(JSON.stringify({ ok: true, slug, schedulesMode: mode }));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
 }
 
 // src/schedules-lift-command.ts
@@ -17340,7 +17419,7 @@ var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor"
 function parseScheduleHeader(yamlText) {
   const out = {};
   for (const rawLine of yamlText.split("\n")) {
-    const m = /^#\s*(schedule|what|owner|cadence|executor|llm|output|breaks|kill):\s*(.+?)\s*$/.exec(rawLine);
+    const m = /^#\s*(schedule|what|owner|cadence|executor|llm|output|breaks|kill|target):\s*(.+?)\s*$/.exec(rawLine);
     if (m && out[m[1]] === void 0) out[m[1]] = m[2].trim();
   }
   return out;
@@ -17373,6 +17452,10 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   if (llmFromHeader(yamlText) === "unknown") {
     throw new Error(`schedules lift: ${expectedId} header \`llm: ${h.llm}\` does not classify (yes / no / embeddings) \u2014 an unreadable declaration would register a row whose LLM column lies.`);
   }
+  const target = header.target;
+  if (target !== void 0 && !/^[A-Za-z0-9_-]{1,140}$/.test(target)) {
+    throw new Error(`schedules lift: ${expectedId} header \`target: ${target}\` is not a bare lambda function name (allowed: A-Z a-z 0-9 _ -; max 140).`);
+  }
   return {
     id: expectedId,
     what: h.what,
@@ -17384,7 +17467,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
     breaks: h.breaks,
     kill: h.kill,
     repo,
-    sourcePath: workflowPath
+    sourcePath: workflowPath,
+    ...target !== void 0 ? { target } : {}
   };
 }
 function scheduleRecordsFromWorkflows(repo, files) {
@@ -17475,7 +17559,7 @@ async function runSchedulesLift(opts, deps = {}) {
 function registerSchedulesLiftCommand(program3, deps = {}) {
   const schedules = program3.commands.find((c) => c.name() === "schedules");
   if (!schedules) throw new Error("schedules lift: registerSchedulesCommands must run first \u2014 the lift attaches to the `schedules` command");
-  schedules.command("lift").description("lift this repo's eight-field workflow headers into SCHEDULE# registry rows (C2, #3186) \u2014 a per-repo replace; aborts the whole lift on any header violation; exits 75 when the registry is unreachable (#3187)").option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to lift (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write").action(async (o) => {
+  schedules.command("register").alias("lift").description("register this repo's eight-field workflow headers as SCHEDULE# registry rows (C2, #3186; renamed from `lift`, #3219) \u2014 a per-repo replace; aborts the whole registration on any header violation; exits 75 when the registry is unreachable (#3187)").option("--repo <name>", "bare repo name for the join key (defaults to the origin remote basename, case-preserved)").option("--dir <path>", "workflows directory to lift (defaults to .github/workflows)").option("--dry-run", "print the {repo, schedules} body that would be POSTed; never write").action(async (o) => {
     try {
       const result = await runSchedulesLift({ repo: o.repo, dir: o.dir, dryRun: Boolean(o.dryRun) }, deps);
       if (o.dryRun) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.35.2",
+  "version": "3.36.1",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",