@mutmutco/cli 3.36.1 → 3.38.0

package/dist/main.cjs

@@ -4107,33 +4107,6 @@ var import_node_path6 = require("node:path");
 var import_node_child_process4 = require("node:child_process");
 var import_node_fs6 = require("node:fs");
 var import_node_path4 = require("node:path");
-
-// src/plan-scratch.ts
-var metaKey = (project2, slug) => `${project2}/${slug}`;
-function parseMeta(raw) {
-  if (!raw) return {};
-  try {
-    const o = JSON.parse(raw);
-    return o && typeof o === "object" ? o : {};
-  } catch {
-    return {};
-  }
-}
-function hashContent(s) {
-  let h = 2166136261;
-  for (let i = 0; i < s.length; i++) {
-    h ^= s.charCodeAt(i);
-    h = Math.imul(h, 16777619);
-  }
-  return (h >>> 0).toString(16);
-}
-
-// src/rules-sync.ts
-function normalizeEol(s) {
-  return s.replace(/\r\n/g, "\n");
-}
-
-// src/scratch-gc.ts
 var PLAN_ADVISORY_AGE_MS = 30 * 24 * 36e5;
 var ROOT_SCRATCH_STALE_MS = 24 * 36e5;
 var SCRATCH_GC_THROTTLE_MS = 24 * 36e5;
@@ -4155,16 +4128,16 @@ function markScratchGcRun(stampPath, now = Date.now()) {
   }
 }
 function executeScratchGc(repoRoot2, opts, now = Date.now()) {
-  const snap = collectScratchSnapshot(repoRoot2, { project: opts.project });
+  const snap = collectScratchSnapshot(repoRoot2);
   const plan = planScratchGc(snap, now);
   if (!opts.apply) return { plan };
-  return { plan, applied: applyScratchGc(plan, repoRoot2, now, opts.project) };
+  return { plan, applied: applyScratchGc(plan, repoRoot2, now) };
 }
-function buildPrMergeScratchHousekeeping(repoRoot2, deps = {}, project2) {
+function buildPrMergeScratchHousekeeping(repoRoot2, deps = {}) {
   const runScratchGc = deps.runScratchGc ?? executeScratchGc;
   try {
-    const scratchApply = runScratchGc(repoRoot2, { apply: true, project: project2 });
-    const scratchAfter = runScratchGc(repoRoot2, { apply: false, project: project2 });
+    const scratchApply = runScratchGc(repoRoot2, { apply: true });
+    const scratchAfter = runScratchGc(repoRoot2, { apply: false });
     const applied = scratchApply.applied;
     const pruned = applied?.pruned.length ?? 0;
     const skipped = applied?.skipped ?? 0;
@@ -4228,58 +4201,16 @@ function planScratchGc(snap, now = Date.now()) {
       });
     }
   }
-  if (snap.syncQueueSlugs === null) {
-    for (const f of snap.planMdFiles) {
-      if (now - f.mtimeMs <= PLAN_ADVISORY_AGE_MS) continue;
-      candidates.push({
-        path: f.path,
-        family: "plan",
-        kind: "file",
-        tier: "advisory",
-        reason: "North Star sync queue unreadable; kept",
-        bytes: f.bytes
-      });
-    }
-  } else {
-    for (const f of snap.planMdFiles) {
-      if (now - f.mtimeMs <= PLAN_ADVISORY_AGE_MS) continue;
-      const slug = f.name.replace(/\.md$/, "");
-      if (snap.syncQueueSlugs.has(slug)) {
-        candidates.push({
-          path: f.path,
-          family: "plan",
-          kind: "file",
-          tier: "advisory",
-          reason: "pending North Star sync; kept",
-          bytes: f.bytes
-        });
-        continue;
-      }
-      const hash = f.hash;
-      const meta = snap.planMeta;
-      const entry = hash && meta ? syncedPlanMetaEntry(meta, snap.project, slug, hash) : void 0;
-      if (entry) {
-        candidates.push({
-          path: f.path,
-          family: "plan",
-          kind: "file",
-          tier: "safe-auto",
-          reason: "North Star synced hash confirmed",
-          bytes: f.bytes,
-          hash
-        });
-      } else {
-        candidates.push({
-          path: f.path,
-          family: "plan",
-          kind: "file",
-          tier: "advisory",
-          reason: "local plan content is not confirmed synced; kept",
-          bytes: f.bytes,
-          ...hash ? { hash } : {}
-        });
-      }
-    }
+  for (const f of snap.planMdFiles) {
+    if (now - f.mtimeMs <= PLAN_ADVISORY_AGE_MS) continue;
+    candidates.push({
+      path: f.path,
+      family: "plan",
+      kind: "file",
+      tier: "advisory",
+      reason: "plan older than the advisory floor; review and prune manually",
+      bytes: f.bytes
+    });
   }
   return {
     candidates,
@@ -4287,47 +4218,6 @@ function planScratchGc(snap, now = Date.now()) {
     advisory: candidates.filter((c) => c.tier === "advisory")
   };
 }
-function syncedPlanMetaEntry(meta, project2, slug, hash) {
-  if (!project2) return false;
-  const entry = meta[metaKey(project2, slug)];
-  return Boolean(entry?.hash === hash && entry.syncedAt);
-}
-function readPlanMeta(plansRoot) {
-  try {
-    return parseMeta((0, import_node_fs6.readFileSync)((0, import_node_path4.join)(plansRoot, ".plan-meta.json"), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function readSyncQueueSlugs(plansRoot) {
-  let queueRaw;
-  try {
-    queueRaw = (0, import_node_fs6.readFileSync)((0, import_node_path4.join)(plansRoot, ".sync-queue.json"), "utf8");
-  } catch (e) {
-    const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
-    return code === "ENOENT" || code === "ENOTDIR" ? /* @__PURE__ */ new Set() : null;
-  }
-  try {
-    const parsed = JSON.parse(queueRaw);
-    const entries = Array.isArray(parsed) ? parsed : parsed.entries ?? [];
-    return new Set(entries.map((e) => e.slug).filter((s) => typeof s === "string"));
-  } catch {
-    return null;
-  }
-}
-function physicalPlanCandidateStillAllowed(candidatePath, repoAnchor, lstat = import_node_fs6.lstatSync) {
-  const path2 = candidatePath.replace(/\\/g, "/").replace(/\/+$/, "");
-  const parent = (0, import_node_path4.dirname)(path2).replace(/\\/g, "/").replace(/\/+$/, "");
-  const name = (0, import_node_path4.basename)(path2);
-  const plansDir = `${repoAnchor}/plans`;
-  if (parent !== plansDir || !name.endsWith(".md")) return false;
-  try {
-    const st = lstat(plansDir);
-    return st.isDirectory() && !st.isSymbolicLink();
-  } catch {
-    return false;
-  }
-}
 function formatScratchGcPlan(plan, applied, applyResult) {
   if (plan.candidates.length === 0) return "scratch GC: nothing to prune \u2014 local scratch is clean.";
   const lines = [];
@@ -4373,7 +4263,7 @@ function treeOlderThan(root, now, floor) {
   }
   return true;
 }
-function applyScratchGc(plan, repoRoot2, now = Date.now(), project2) {
+function applyScratchGc(plan, repoRoot2, now = Date.now()) {
   const result = { pruned: [], skipped: 0, bytes: 0 };
   let repoAnchor;
   try {
@@ -4402,30 +4292,7 @@ function applyScratchGc(plan, repoRoot2, now = Date.now(), project2) {
         result.skipped += 1;
         continue;
       }
-      if (c.family === "plan") {
-        if (!c.hash || !physicalPlanCandidateStillAllowed(real, repoAnchor)) {
-          result.skipped += 1;
-          continue;
-        }
-        const plansRoot = `${repoAnchor}/plans`;
-        const slug = (0, import_node_path4.basename)(c.path).replace(/\.md$/, "");
-        const pending = readSyncQueueSlugs(plansRoot);
-        if (pending === null || pending.has(slug)) {
-          result.skipped += 1;
-          continue;
-        }
-        const currentHash = hashContent(normalizeEol((0, import_node_fs6.readFileSync)(c.path, "utf8")));
-        if (currentHash !== c.hash) {
-          result.skipped += 1;
-          continue;
-        }
-        const meta = readPlanMeta(plansRoot);
-        if (!meta || !syncedPlanMetaEntry(meta, project2, slug, currentHash)) {
-          result.skipped += 1;
-          continue;
-        }
-      }
-      const floor = c.family === "plan" ? PLAN_ADVISORY_AGE_MS : c.family === "scratch-dir" || c.family === "scratch-file" ? ROOT_SCRATCH_STALE_MS : 0;
+      const floor = c.family === "scratch-dir" || c.family === "scratch-file" ? ROOT_SCRATCH_STALE_MS : 0;
       if (floor > 0 && now - st.mtimeMs <= floor) {
         result.skipped += 1;
         continue;
@@ -4453,7 +4320,6 @@ function rootCandidateStillAllowed(c, realPath, repoAnchor) {
   const name = (0, import_node_path4.basename)(path2);
   if (c.family === "scratch-dir") return c.kind === "dir" && parent === repoAnchor && ROOT_SCRATCH_DIRS.has(name);
   if (c.family === "scratch-file") return (c.kind ?? "file") === "file" && parent === repoAnchor && ROOT_SCRATCH_FILE_PREFIXES.some((prefix) => name.startsWith(prefix));
-  if (c.family === "plan") return physicalPlanCandidateStillAllowed(path2, repoAnchor);
   return false;
 }
 function trackedPathStatus(c, realPath, repoAnchor) {
@@ -4509,7 +4375,6 @@ function rootScratchDirSnapshot(root, readdir2, stat2) {
 function collectScratchSnapshot(repoRoot2, deps = {}) {
   const readdir2 = deps.readdir ?? import_node_fs6.readdirSync;
   const stat2 = deps.stat ?? import_node_fs6.statSync;
-  const readFile6 = deps.readFile ?? import_node_fs6.readFileSync;
   const plansRoot = (0, import_node_path4.join)(repoRoot2, "plans");
   const rootScratchFiles = [];
   try {
@@ -4540,37 +4405,13 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       const full = (0, import_node_path4.join)(plansRoot, ent.name);
       try {
         const st = stat2(full);
-        const raw = readFile6(full, "utf8");
-        planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file", hash: hashContent(normalizeEol(raw)) });
+        planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file" });
       } catch {
       }
     }
   } catch {
   }
-  let planMeta = {};
-  try {
-    planMeta = parseMeta(readFile6((0, import_node_path4.join)(plansRoot, ".plan-meta.json"), "utf8"));
-  } catch {
-    planMeta = {};
-  }
-  const project2 = deps.project?.trim() || void 0;
-  const syncQueueSlugs = (() => {
-    let queueRaw;
-    try {
-      queueRaw = readFile6((0, import_node_path4.join)(plansRoot, ".sync-queue.json"), "utf8");
-    } catch (e) {
-      const code = typeof e === "object" && e && "code" in e ? String(e.code ?? "") : "";
-      return code === "ENOENT" || code === "ENOTDIR" ? /* @__PURE__ */ new Set() : null;
-    }
-    try {
-      const parsed = JSON.parse(queueRaw);
-      const entries = Array.isArray(parsed) ? parsed : parsed.entries ?? [];
-      return new Set(entries.map((e) => e.slug).filter((s) => typeof s === "string"));
-    } catch {
-      return null;
-    }
-  })();
-  return { repoRoot: repoRoot2, rootScratchFiles, planMdFiles, planMeta, project: project2, syncQueueSlugs };
+  return { repoRoot: repoRoot2, rootScratchFiles, planMdFiles };
 }
 
 // src/repo-runtime-state.ts
@@ -9440,8 +9281,8 @@ var MANAGED_GITIGNORE_LINES = [
   "/tmp/",
   // Ad-hoc agent scratch at repo root (e.g. tmp_diff.txt) — same class as /tmp/ (#1676).
   "/tmp_*",
-  // Plan scratch at ANY depth (root plans/, cli/plans/, .cursor/plans/) — AI planning docs are S3-synced
-  // via `mmi-cli northstar push` / auto-save on write; never git-tracked (AGENTS.md "Repo cleanliness", #1550, #1842).
+  // Plan scratch at ANY depth (root plans/, cli/plans/, .cursor/plans/) — AI planning docs are managed by
+  // the personal `jerv` CLI's plan store; never git-tracked (AGENTS.md "Repo cleanliness", #1550, #1842).
   "**/plans/",
   // Superpowers plan/spec output is scratch too; authoritative docs live directly under docs/.
   "docs/superpowers/",
@@ -9526,6 +9367,117 @@ function isGateWorkflowPath(path2) {
   const base = path2.split(/[/\\]/).pop() ?? path2;
   return /^(?:.+[-_.])?gate\.ya?ml$/i.test(base);
 }
+function unquoteInline(value) {
+  const v = value.trim();
+  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"')) return v.slice(1, -1).replace(/\\(["\\])/g, "$1");
+  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) return v.slice(1, -1).replace(/''/g, "'");
+  return v;
+}
+var BLOCK_SCALAR = /^[|>][+-]?\s*$/;
+function readScalar(lines, from, inlineValue, keyIndent) {
+  if (!BLOCK_SCALAR.test(inlineValue)) return unquoteInline(inlineValue);
+  const body = [];
+  for (let k = from + 1; k < lines.length; k++) {
+    if (lines[k].indent <= keyIndent) break;
+    body.push(lines[k].text);
+  }
+  return body.join("\n");
+}
+function readWith(lines, from, inlineValue, withIndent) {
+  if (inlineValue.startsWith("{")) {
+    const cmd = inlineValue.match(/command:\s*("[^"]*"|'[^']*'|[^,}]+)/);
+    const ms = inlineValue.match(/max-seconds:\s*("[^"]*"|'[^']*'|[^,}]+)/);
+    return {
+      command: cmd ? unquoteInline(cmd[1].trim()) : void 0,
+      maxSeconds: ms ? unquoteInline(ms[1].trim()) : void 0
+    };
+  }
+  const out = {};
+  for (let j = from + 1; j < lines.length; j++) {
+    if (lines[j].indent <= withIndent) break;
+    const cm = lines[j].text.match(/^command:\s?(.*)$/);
+    if (cm && out.command === void 0) {
+      out.command = readScalar(lines, j, cm[1].trim(), lines[j].indent);
+      continue;
+    }
+    const mm = lines[j].text.match(/^max-seconds:\s?(.*)$/);
+    if (mm && out.maxSeconds === void 0) {
+      out.maxSeconds = readScalar(lines, j, mm[1].trim(), lines[j].indent);
+      continue;
+    }
+  }
+  return out;
+}
+function parseStepLines(lines) {
+  const step = {};
+  const base = Math.min(...lines.map((l) => l.indent));
+  for (let i = 0; i < lines.length; i++) {
+    const { indent, text } = lines[i];
+    if (indent !== base) continue;
+    const m = text.match(/^([A-Za-z][\w-]*):\s?(.*)$/);
+    if (!m) continue;
+    const key = m[1];
+    const val = m[2].trim();
+    if (key === "uses") step.uses = unquoteInline(val);
+    else if (key === "run") step.run = readScalar(lines, i, val, base);
+    else if (key === "with") {
+      const w = readWith(lines, i, val, base);
+      step.withCommand = w.command;
+      step.withMaxSeconds = w.maxSeconds;
+    }
+  }
+  return step;
+}
+function parseGateSteps(body) {
+  const lines = body.split(/\r?\n/);
+  const steps = [];
+  let stepsIndent = -1;
+  let itemIndent = -1;
+  let current = null;
+  const flush2 = () => {
+    if (current && current.length) steps.push(parseStepLines(current));
+    current = null;
+  };
+  for (const raw of lines) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const indent = raw.match(/^(\s*)/)[1].length;
+    if (stepsIndent === -1) {
+      if (/^steps:\s*$/.test(trimmed)) stepsIndent = indent;
+      continue;
+    }
+    if (indent <= stepsIndent) {
+      flush2();
+      itemIndent = -1;
+      stepsIndent = /^steps:\s*$/.test(trimmed) ? indent : -1;
+      continue;
+    }
+    if (/^-\s?/.test(trimmed) && (itemIndent === -1 || indent === itemIndent)) {
+      itemIndent = indent;
+      flush2();
+      current = [{ indent: indent + 2, text: trimmed.replace(/^-\s?/, "") }];
+      continue;
+    }
+    if (current) current.push({ indent, text: trimmed });
+  }
+  flush2();
+  return steps;
+}
+function isNoOpCommand(command) {
+  const parts = command.split(/&&|\|\||;|\r?\n/).map((p) => p.trim()).filter(Boolean);
+  if (parts.length === 0) return true;
+  return parts.every((p) => /^(?::$|true$|false$|exit(?:\s|$)|echo(?:\s|$)|printf(?:\s|$)|#)/.test(p));
+}
+var TEST_RUNNER_AT_START = new RegExp(
+  "^(?:(?:npm|yarn|pnpm|bun)\\s+(?:run\\s+)?(?:test|t)(?:[:\\s]|$)|(?:npx|bunx|pnpm\\s+dlx)\\s+(?:vitest|jest|mocha|playwright|cypress|ava|tap)\\b|(?:vitest|jest|mocha|pytest|py\\.test|phpunit|rspec)\\b|python[0-9.]*\\s+-m\\s+(?:pytest|unittest)\\b|(?:poetry|pipenv)\\s+run\\s+(?:pytest|py\\.test|python[0-9.]*\\s+-m\\s+(?:pytest|unittest))\\b|(?:bundle\\s+exec\\s+)?rspec\\b|(?:go|cargo|dotnet|mvn|gradle|swift)\\s+test\\b|(?:rails|php\\s+artisan)\\s+test\\b|playwright\\s+test\\b)",
+  "i"
+);
+function runsTestRunner(command) {
+  return command.split(/&&|\|\||;|\||\r?\n/).map((sub) => sub.trim().replace(/^[!(]+\s*/, "")).some((sub) => TEST_RUNNER_AT_START.test(sub));
+}
+function firstLine(command) {
+  return command.split(/\r?\n/).map((l) => l.trim()).find(Boolean) ?? command.trim();
+}
 function checkGateBudget(files, opts = {}) {
   const failures = [];
   const notes = [];
@@ -9555,18 +9507,35 @@ function checkGateBudget(files, opts = {}) {
         notes.push(`${path2}: run-with-budget pinned to ${remote[1].slice(0, 12)} (blessed ${BLESSED_RUN_WITH_BUDGET_SHA.slice(0, 12)}) \u2014 valid but outdated`);
       }
     }
-    const ceilingLines = [...body.matchAll(/^\s*max-seconds:\s*(.+?)\s*$/gm)].map((m) => m[1].replace(/\s+#.*$/, ""));
-    if (ceilingLines.length === 0) {
-      failures.push(`${path2}: run-with-budget has no max-seconds input \u2014 the budget step guards nothing`);
-      continue;
+    const steps = parseGateSteps(body);
+    const budgetSteps = steps.filter((step) => step.uses?.includes("run-with-budget"));
+    if (budgetSteps.length === 0) {
+      if (![...body.matchAll(/^\s*max-seconds:\s*(.+?)\s*$/gm)].some((m) => /^['"]?\d+['"]?$/.test(m[1].replace(/\s+#.*$/, "").trim()))) {
+        failures.push(`${path2}: run-with-budget has no max-seconds input \u2014 the budget step guards nothing`);
+      }
     }
-    for (const raw of ceilingLines) {
-      const literal = /^['"]?(\d+)['"]?$/.exec(raw);
-      const seconds = literal ? Number(literal[1]) : NaN;
-      if (!literal || seconds < 1) {
-        failures.push(`${path2}: max-seconds '${raw}' is not a literal positive integer`);
-      } else if (seconds > MAX_SECONDS_CEILING) {
-        failures.push(`${path2}: max-seconds ${seconds} exceeds the org ceiling ${MAX_SECONDS_CEILING} \u2014 a budget that generous guards nothing; measure the gate and set a real ceiling`);
+    for (const step of budgetSteps) {
+      if (!step.withCommand) {
+        failures.push(`${path2}: run-with-budget step has no with.command \u2014 the budget wraps nothing; put the gate's check command in it`);
+      } else if (isNoOpCommand(step.withCommand)) {
+        failures.push(`${path2}: run-with-budget step wraps a no-op command '${firstLine(step.withCommand)}' \u2014 a budgeted decoy leaves the real gate check unbounded (#3247)`);
+      }
+      const rawMs = step.withMaxSeconds?.replace(/\s+#.*$/, "").trim();
+      if (!rawMs) {
+        failures.push(`${path2}: run-with-budget step has no max-seconds input \u2014 the budget step guards nothing`);
+      } else {
+        const literal = /^['"]?(\d+)['"]?$/.exec(rawMs);
+        const seconds = literal ? Number(literal[1]) : NaN;
+        if (!literal || seconds < 1) {
+          failures.push(`${path2}: max-seconds '${rawMs}' is not a literal positive integer`);
+        } else if (seconds > MAX_SECONDS_CEILING) {
+          failures.push(`${path2}: max-seconds ${seconds} exceeds the org ceiling ${MAX_SECONDS_CEILING} \u2014 a budget that generous guards nothing; measure the gate and set a real ceiling`);
+        }
+      }
+    }
+    for (const step of steps) {
+      if (step.run && runsTestRunner(step.run)) {
+        failures.push(`${path2}: the gate's check command runs in an unbudgeted 'run:' step ('${firstLine(step.run)}') \u2014 wrap it in the run-with-budget step so it has a wall-clock ceiling (#3247)`);
       }
     }
   }
@@ -10490,6 +10459,13 @@ var import_node_fs14 = require("node:fs");
 var import_node_path12 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util6 = require("node:util");
+
+// src/rules-sync.ts
+function normalizeEol(s) {
+  return s.replace(/\r\n/g, "\n");
+}
+
+// src/stage-runner.ts
 var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process7.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
@@ -11100,10 +11076,6 @@ async function runStage(config = {}, opts = {}) {
 }
 
 // src/wave-status.ts
-function parseNorthStarSlugFromHead(headText) {
-  const m = /northstar:`([^`]+)`/.exec(headText);
-  return m?.[1];
-}
 function parseNextFromHead(headText) {
   const m = /\*\*NEXT:\*\*\s*(.+)/.exec(headText);
   return m?.[1]?.trim();
@@ -11136,7 +11108,6 @@ function formatWaveStatus(rows) {
     lines.push(`    ${tags.join(" \xB7 ")}`);
     if (row.pr) lines.push(`    PR #${row.pr.number} (${row.pr.state})${row.pr.url ? ` ${row.pr.url}` : ""}`);
     if (row.stage) lines.push(`    stage: port ${row.stage.port}${row.stage.url ? ` ${row.stage.url}` : ""}`);
-    if (row.northStarSlug) lines.push(`    compass: northstar:${row.northStarSlug}`);
     if (row.next) lines.push(`    next: ${row.next}`);
   }
   return lines.join("\n");
@@ -11162,7 +11133,6 @@ async function collectWaveStatus(deps) {
       primary: wt.path === primaryPath,
       dirty,
       stage: readStageSummary(wt.path),
-      northStarSlug: headText ? parseNorthStarSlugFromHead(headText) : void 0,
       next: headText ? parseNextFromHead(headText) : void 0
     });
   }
@@ -11266,6 +11236,17 @@ function buildIssueArgs({ type, title, body, priority, repo, labels }) {
   for (const label of labels ?? []) args.push("--label", label);
   return args;
 }
+async function ensureLabelsExist(labels, repo, deps = {}) {
+  const run = deps.run ?? execFileP2;
+  for (const label of new Set(labels)) {
+    const args = ["label", "create", label, "--color", "ededed"];
+    if (repo) args.push("--repo", repo);
+    try {
+      await run("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
+    } catch {
+    }
+  }
+}
 async function bodyArgsViaFile(args, deps = {}) {
   const i = args.indexOf("--body");
   if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
@@ -11991,6 +11972,10 @@ function parseNpmVersion(stdout) {
 function staleTrainCliMessage(report, commandName) {
   return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`npm install -g @mutmutco/cli@latest\` to update to ${report.releasedVersion} (a standalone CLI shadows a plugin-provided mmi-cli on PATH and needs no Claude restart), then rerun ${commandName} so it uses the current train path. This gate runs before any train mutation, so this invocation changed nothing; any partial train state (local merge, pushed tag) is from an earlier run and the rerun resumes it safely`;
 }
+function versionAutoUpdateAction(report, releasedSource) {
+  if (report.ok || report.staleAgainst !== "released") return "none";
+  return releasedSource === "gh" ? "npm-unreachable" : "npm";
+}
 
 // src/plugin-cache-prune.ts
 var PLUGIN_CACHE_KEEP = 2;
@@ -17453,8 +17438,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
     throw new Error(`schedules lift: ${expectedId} header \`llm: ${h.llm}\` does not classify (yes / no / embeddings) \u2014 an unreadable declaration would register a row whose LLM column lies.`);
   }
   const target = header.target;
-  if (target !== void 0 && !/^[A-Za-z0-9_-]{1,140}$/.test(target)) {
-    throw new Error(`schedules lift: ${expectedId} header \`target: ${target}\` is not a bare lambda function name (allowed: A-Z a-z 0-9 _ -; max 140).`);
+  if (target !== void 0 && !/^mmi-fleet-[A-Za-z0-9_-]{1,130}$/.test(target)) {
+    throw new Error(`schedules lift: ${expectedId} header \`target: ${target}\` must be a bare lambda function name in the reserved fleet namespace \`mmi-fleet-*\` (allowed after the prefix: A-Z a-z 0-9 _ -; total max 140). The dispatcher can only invoke mmi-fleet-* functions.`);
   }
   return {
     id: expectedId,
@@ -20751,6 +20736,7 @@ function validateBatchSpecs(specs) {
   return { ok: errors.length === 0, errors, validated };
 }
 async function createIssuesBatch(specs, options, deps = {}) {
+  const ensureLabels = deps.ensureLabels ?? ensureLabelsExist;
   const client = deps.client ?? defaultGitHubClient();
   const validation = validateBatchSpecs(specs);
   if (!validation.ok) {
@@ -20763,6 +20749,14 @@ ${lines}`);
     throw new Error("could not resolve repo \u2014 pass --repo owner/repo or set repo per row");
   }
   const rowRepo = (spec) => spec.repo ?? defaultRepo;
+  const labelsByRepo = /* @__PURE__ */ new Map();
+  for (const { spec } of validation.validated) {
+    if (!spec.labels?.length) continue;
+    const bucket = labelsByRepo.get(rowRepo(spec)) ?? /* @__PURE__ */ new Set();
+    for (const label of spec.labels) bucket.add(label);
+    labelsByRepo.set(rowRepo(spec), bucket);
+  }
+  for (const [repo, labels] of labelsByRepo) await ensureLabels([...labels], repo);
   const created = [];
   const failures = [];
   for (const entry of validation.validated) {
@@ -21170,6 +21164,15 @@ async function fetchNpmReleasedVersion() {
     return void 0;
   }
 }
+var NPM_INSTALL_TIMEOUT_MS = 12e4;
+async function npmSelfUpdateCli() {
+  try {
+    await runHostBin("npm", ["install", "-g", "@mutmutco/cli@latest"], { timeout: NPM_INSTALL_TIMEOUT_MS });
+    return { ok: true, detail: "npm install -g @mutmutco/cli@latest exited 0" };
+  } catch (e) {
+    return { ok: false, detail: e.message.trim().slice(0, 200).replace(/\s+/g, " ") };
+  }
+}
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
   const installed = readInstalledPlugins(surface);
@@ -22597,7 +22600,25 @@ async function runDoctorClean(opts, io, deps) {
   const plugin = checkClaudePlugin({ installed, released, guardState: deps.pluginGuardState(isOrgRepo) });
   checks.push(plugin);
   if (!plugin.ok) restartPending = true;
-  checks.push(checkCliVersion({ currentVersion: deps.currentCliVersion(), releasedVersion: released }));
+  const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
+  const cliReport = buildVersionLagReport(cliInput);
+  if (apply && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
+    const heal = await deps.updateCli();
+    const healEvidence = [`running:  ${cliReport.currentVersion}`, `published: ${cliReport.releasedVersion}`, `heal: ${heal.detail}`];
+    checks.push(heal.ok ? {
+      ok: true,
+      label: `mmi-cli ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion}`,
+      detail: "self-updated via npm install -g; the next mmi-cli invocation runs the new version",
+      verbose: healEvidence
+    } : {
+      ok: false,
+      label: `mmi-cli ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion}`,
+      fix: `self-update failed (${heal.detail}) \u2014 run \`npm install -g @mutmutco/cli@latest\``,
+      verbose: healEvidence
+    });
+  } else {
+    checks.push(checkCliVersion(cliInput));
+  }
   checks.push(checkPluginCache(deps.pluginCache()));
   if (!opts.fast && !opts.banner && !opts.preflight) {
     const probe = await deps.schedulesNotebook().catch((e) => ({
@@ -22803,6 +22824,8 @@ function mmiDoctorDeps() {
     installedPluginVersion: installedClaudePluginVersion,
     pluginGuardState: claudePluginGuardState,
     releasedVersion: fetchNpmReleasedVersion,
+    // #3272: the --apply self-heal for a stale running CLI — npm global, shadows any plugin shim (#2879).
+    updateCli: npmSelfUpdateCli,
     currentCliVersion: resolveClientVersion,
     readGitignore,
     writeGitignore,
@@ -23068,7 +23091,7 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
     process.exit(process.exitCode ?? 0);
   });
 });
-gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch and plans whose current hash is confirmed synced to North Star (#1864) instead of git branches/refs").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
+gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").action(async (o) => {
   if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
@@ -23888,6 +23911,7 @@ withExamples(mutating(
   let title;
   let issueType;
   let extraLabels = [];
+  let targetRepo2;
   try {
     issueType = resolveCreateType(o.type, "issue create");
     title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
@@ -23895,33 +23919,30 @@ withExamples(mutating(
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
     priority = resolveCreatePriority(o.priority, "issue create");
     extraLabels = [...o.label ?? []];
+    targetRepo2 = await resolveRepo(o.repo);
+    if (!targetRepo2) {
+      return fail("issue create: could not resolve the target repo \u2014 run inside a git checkout or pass --repo <owner/repo>");
+    }
     args = buildIssueArgs({
       type: issueType,
       title,
       body,
       priority,
-      repo: o.repo,
+      repo: targetRepo2,
       labels: extraLabels.length ? extraLabels : void 0
     });
     if (o.parent !== void 0) parseIssueRef(o.parent);
   } catch (e) {
     return fail(`issue create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
-  for (const label of extraLabels) {
-    const la = ["label", "create", label, "--color", "ededed"];
-    if (o.repo) la.push("--repo", o.repo);
-    try {
-      await execFileP2("gh", la, { timeout: GH_MUTATION_TIMEOUT_MS });
-    } catch {
-    }
-  }
+  await ensureLabelsExist(extraLabels, targetRepo2);
   const created = await ghCreate(args);
-  const { projectItemId, onBoard } = await attachToProject(created.number, o.repo, priority);
+  const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo2, priority);
   let parent;
   let parentLinkError;
   if (o.parent !== void 0) {
     try {
-      parent = await linkSubIssue(ghRunner2, o.parent, created.url, o.repo);
+      parent = await linkSubIssue(ghRunner2, o.parent, created.url, targetRepo2);
     } catch (e) {
       const err = e;
       parentLinkError = (err.stderr || err.message || String(e)).trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.36.1",
+  "version": "3.38.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",