@mutmutco/cli 3.4.0 → 3.5.0

package/dist/main.cjs

@@ -10904,7 +10904,7 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
 }
 async function runTenantRedeploy(deps, options) {
   const { stage: stage2 } = options;
-  const ref = options.ref ?? stage2;
+  const ref = options.ref ?? (stage2 === "dev" ? "development" : stage2);
   const watch = options.watch ?? false;
   const repo = options.repo;
   const [owner, name] = repo.split("/");
@@ -12893,7 +12893,7 @@ function runtimeSecretStreamGap(stage2, meta, presentSecrets) {
   for (const name of stageRequiredSecrets(stage2, meta).map(materializedRuntimeSecretName)) {
     if (seen.has(name)) continue;
     seen.add(name);
-    if (!streamed.has(name) && presentSecrets.has(stageKey(stage2, name))) gap.push(name);
+    if (!streamed.has(name) && (presentSecrets.has(stageKey(stage2, name)) || presentSecrets.has(name))) gap.push(name);
   }
   return gap;
 }
@@ -13137,9 +13137,11 @@ async function buildV2Doctor(repoOrSlug, deps) {
     return [stage2, { required, ok: required ? await deps.hasDeployState(slug, stage2) : true }];
   })));
   const secrets = Object.fromEntries(STAGES.map((stage2) => {
-    const required = stageInTrack(meta, stage2) ? stageRequiredSecrets(stage2, meta).map((key) => stageKey(stage2, key)) : [];
-    const present = required.filter((key) => presentSecrets.has(key));
-    const missing = required.filter((key) => !presentSecrets.has(key));
+    const names = stageInTrack(meta, stage2) ? stageRequiredSecrets(stage2, meta) : [];
+    const satisfied = (key) => presentSecrets.has(stageKey(stage2, key)) || !key.includes("/") && presentSecrets.has(key);
+    const required = names.map((key) => stageKey(stage2, key));
+    const present = names.filter(satisfied).map((key) => stageKey(stage2, key));
+    const missing = names.filter((key) => !satisfied(key)).map((key) => stageKey(stage2, key));
     return [stage2, { required, present, missing }];
   }));
   const runtimeSecretStreamWarnings = Object.fromEntries(STAGES.map((stage2) => [
@@ -13268,7 +13270,6 @@ var DEFAULT_DOMAINS = ["mutatismutandis.co", "mutmut.co"];
 var DEFAULT_CALLBACK_PATH = "/api/auth/callback";
 var ENV_PREFIXES = ["", "dev", "rc"];
 var LOOPBACK = ["http://localhost", "http://127.0.0.1"];
-var SSM_ENVS = ["dev", "rc", "main"];
 var SSM_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 var uniq = (xs) => [...new Set(xs)];
 function defaultSubdomain2(slug) {
@@ -13299,7 +13300,7 @@ function expectedRedirectUris(cfg) {
   ]);
 }
 function oauthSsmKeys() {
-  return SSM_ENVS.flatMap((env) => SSM_NAMES.map((name) => `${env}/${name}`));
+  return [...SSM_NAMES];
 }
 function parseOauthClientJson(input) {
   let parsed;
@@ -13373,11 +13374,20 @@ function parseSecretsCatalogVar(raw) {
     throw new Error("project set: secrets must be a map keyed by canonical KEY");
   }
   const nonEmpty = (v) => typeof v === "string" && v.trim().length > 0;
+  const overrideMapKey = /^([A-Z_][A-Z0-9_]*)@(dev|rc|main)$/;
   for (const [mapKey, value] of Object.entries(parsed)) {
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`project set: secrets["${mapKey}"] must be an object`);
     const e = value;
-    if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key) || e.key !== mapKey) {
-      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key and be an env-name (UPPER_SNAKE)`);
+    if (typeof e.key !== "string" || !SECRET_ENV_NAME_RE.test(e.key)) {
+      throw new Error(`project set: secrets["${mapKey}"].key must be an env-name (UPPER_SNAKE)`);
+    }
+    const override = overrideMapKey.exec(mapKey);
+    if (override) {
+      if (e.key !== override[1] || !Array.isArray(e.stages) || e.stages.length !== 1 || e.stages[0] !== override[2]) {
+        throw new Error(`project set: secrets["${mapKey}"] is an override entry (#2528) \u2014 key must be ${override[1]} and stages exactly ["${override[2]}"]`);
+      }
+    } else if (e.key !== mapKey) {
+      throw new Error(`project set: secrets["${mapKey}"].key must equal the map key (or use the KEY@<stage> override form, #2528)`);
     }
     if (!nonEmpty(e.purpose) || !nonEmpty(e.group) || !nonEmpty(e.owner)) throw new Error(`project set: secrets["${mapKey}"] needs non-empty purpose, group, owner`);
     if (e.provider !== void 0 && !nonEmpty(e.provider)) throw new Error(`project set: secrets["${mapKey}"].provider must be a non-empty string`);
@@ -13924,8 +13934,7 @@ function classifyTier(_slug, key) {
   return key.slice(0, slash) === PROJECT_TIER_SEGMENT ? "project" : "org";
 }
 function secretParamName(slug, key) {
-  const rel = key.includes("/") ? key : `${PROJECT_TIER_SEGMENT}/${key}`;
-  return `${SSM_ROOT}/${slug}/${rel}`;
+  return `${SSM_ROOT}/${slug}/${key}`;
 }
 function formatSecretList(items) {
   if (!items.length) return "no secrets";
@@ -13944,10 +13953,10 @@ function vaultPointer(slug) {
       org: [`/mmi-future/{shared,cloudflare,mmi-hub,...}/*  (org-infra, master-gated)`]
     },
     stages: ["dev", "rc", "main"],
-    // Google OAuth is one client per repo; creds live at every stage under the standard key names
-    // (local is port-agnostic and reuses the dev tier). See the oauth-everywhere convention.
+    // Google OAuth is one client per repo = ONE stageless value pair at the slug root (#2244/#2528);
+    // every stage (and local) reads the same pair. The staged {dev,rc,main}/GOOGLE_* shape is retired.
     wellKnown: {
-      googleOAuth: ["dev/GOOGLE_CLIENT_ID", "dev/GOOGLE_CLIENT_SECRET", "rc/GOOGLE_CLIENT_ID", "rc/GOOGLE_CLIENT_SECRET", "main/GOOGLE_CLIENT_ID", "main/GOOGLE_CLIENT_SECRET"]
+      googleOAuth: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]
     }
   };
 }
@@ -14203,8 +14212,9 @@ function formatCatalog(r) {
   return lines.join("\n");
 }
 function formatDrift(d) {
-  if (d.ok) return "vault doctor: zero drift \u2014 SSM matches the catalog.";
-  const lines = ["vault doctor: drift found", ""];
+  const shadows = d.stagedShadow ?? [];
+  if (d.ok && !shadows.length) return "vault doctor: zero drift \u2014 SSM matches the catalog.";
+  const lines = [d.ok ? "vault doctor: zero drift \u2014 SSM matches the catalog. Advisories:" : "vault doctor: drift found", ""];
   const section = (title, rows) => {
     if (!rows.length) return;
     lines.push(`${title} (${rows.length}):`, ...rows.map((r) => `  - ${r}`), "");
@@ -14213,6 +14223,10 @@ function formatDrift(d) {
   section("ORPHAN in SSM, undeclared \u2014 declare or delete", d.orphan.map((o) => o.path));
   section("OFF-SCHEME path", d.offScheme.map((o) => `${o.path}  (${o.reason})`));
   section("STAGE-SPLIT \u2014 collapse to one shared key", (d.stageSplit ?? []).map((s) => `${s.slug}/${s.leaf} split across ${s.stages.join("/")}`));
+  section(
+    "STAGED SHADOW \u2014 the staged override WINS its stage over the stageless canonical (#2522)",
+    shadows.map((s) => `${s.path} shadows ${s.canonicalPath}${s.declared ? "" : "  (UNDECLARED residue \u2014 triage per #2526)"}`)
+  );
   section("DUPLICATE org-infra secret", d.duplicate.map((dup) => `${dup.logical}: ${dup.paths.join(" , ")}`));
   return lines.join("\n").trimEnd();
 }
@@ -14317,10 +14331,11 @@ async function secretsPreflight(deps, opts) {
   }
   const { secrets } = await res.json();
   const present = new Set((secrets ?? []).map((s) => s.key));
-  const required = opts.required.map((key) => stageKey2(opts.stage, key));
-  const missing = required.filter((key) => !present.has(key));
+  const missing = opts.required.filter(
+    (key) => !present.has(stageKey2(opts.stage, key)) && !(key.includes("/") ? false : present.has(key))
+  );
   if (missing.length) {
-    deps.log(`missing ${missing.join(", ")}`);
+    deps.log(`missing ${missing.map((key) => key.includes("/") ? key : `${stageKey2(opts.stage, key)} (and no stageless ${key})`).join(", ")}`);
     return false;
   }
   deps.log(`all required ${opts.stage} secret names are present`);
@@ -14352,7 +14367,8 @@ async function secretsGet(deps, key, opts) {
     );
     return false;
   }
-  const { value } = await res.json();
+  const { value, notes } = await res.json();
+  for (const note of notes ?? []) deps.err(`note: ${note}`);
   deps.log(value ?? "");
   return true;
 }
@@ -14432,6 +14448,8 @@ async function putSecret(deps, key, value, opts) {
     );
     return false;
   }
+  const { warnings } = await res.json();
+  for (const warning of warnings ?? []) deps.err(`warning: ${warning}`);
   const provider = providerForSecretKey(key);
   if (provider) {
     const result = await verifySecretValue(deps, key, value, opts);
@@ -14827,7 +14845,7 @@ function registerSecretsCommands(program3) {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("set <key>").description("write/rotate a secret; value is read from stdin (never an argument)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsSet(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
@@ -17144,6 +17162,14 @@ ${stderr}`);
     return false;
   }
 }
+function healBannerLine(bin, token, refSupported) {
+  const installVerb = token === "codex" ? "add" : "install";
+  return refSupported ? `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add --ref main \u2192 ${installVerb})\u2026` : `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add \u2192 ${installVerb}; release ref pinned by the marketplace manifest)\u2026`;
+}
+function refAbsenceNote(bin, refSupported) {
+  return refSupported ? "" : `
+  Note: \`${bin}\` has no \`--ref\` option; the marketplace manifest pins the released branch, so none is needed (#2516).`;
+}
 async function applyPluginHeal(token, surface, log, opts) {
   if (!opts?.force && surfaceToken(surface) !== token) return false;
   const descriptor = PLUGIN_SURFACE_HEAL[token];
@@ -17152,13 +17178,8 @@ async function applyPluginHeal(token, surface, log, opts) {
   const bin = descriptor.pluginRunner === "codex" ? "codex" : "claude";
   const runner = descriptor.pluginRunner === "codex" ? runCodexPlugin : runClaudePlugin;
   const refSupported = await marketplaceAddRefSupported(bin);
-  const { steps, strippedRef } = adaptHealStepsForRefSupport(tableSteps, refSupported);
-  log(
-    refSupported ? `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add --ref main \u2192 ${token === "codex" ? "add" : "install"})\u2026` : `  \u21BB reinstalling the MMI plugin via \`${bin} plugin\` (marketplace remove \u2192 add \u2192 ${token === "codex" ? "add" : "install"})\u2026`
-  );
-  if (strippedRef) {
-    log(`  \u26A0 \`${bin}\` has no \`--ref\` option \u2014 cloning the default branch; update \`${bin}\` to pin the released \`main\` branch (#2080)`);
-  }
+  const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
+  log(healBannerLine(bin, token, refSupported));
   for (const step of steps) {
     if (healStepAborts(step, await runner([...step.args]))) return false;
   }
@@ -18679,8 +18700,7 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
     const bin = descriptor.pluginRunner === "codex" ? "codex" : "claude";
     const refSupported = await marketplaceAddRefSupported(bin);
     const recovery = refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
-    const note = refSupported ? "" : `
-  Note: \`${bin}\` has no \`--ref\` option here; update \`${bin}\` to pin the released \`main\` branch.`;
+    const note = refAbsenceNote(bin, refSupported);
     console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
   ${recovery}${note}`);
   }
@@ -19242,8 +19262,8 @@ tenant.command("readiness <owner/repo> <stage>").description("alias for tenant s
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false) process.exitCode = 1;
 });
-tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main \u2014 the promoted ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage2, o) => {
-  if (stage2 !== "rc" && stage2 !== "main") return fail("tenant redeploy: <stage> must be rc or main");
+tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage2, o) => {
+  if (stage2 !== "dev" && stage2 !== "rc" && stage2 !== "main") return fail("tenant redeploy: <stage> must be dev, rc, or main");
   try {
     const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage: stage2, ref: o.ref, watch: o.watch });
     return printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantRedeploy(result));
@@ -19704,7 +19724,7 @@ SSM cred params (under /mmi-future/${slug}/):`);
   ssm.forEach((k) => console.log(`  ${k}`));
   console.log("\nProvision/repair the Console client per docs/Guides/oauth-provision.md; store creds with `mmi-cli oauth set-creds`.");
 });
-oauth.command("set-creds").description('store the OAuth client into the canonical {dev,rc,main}/GOOGLE_CLIENT_* SSM keys (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
+oauth.command("set-creds").description('store the OAuth client into the canonical stageless GOOGLE_CLIENT_ID/SECRET pair (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   const raw = await readStdin();
   if (!raw.trim()) {
     return fail("oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli oauth set-creds --repo <owner/repo> < client.json");
@@ -19723,10 +19743,10 @@ oauth.command("set-creds").description('store the OAuth client into the canonica
         return;
       }
     }
-    console.log(`OAuth client stored in all ${oauthSsmKeys().length} canonical keys. Run \`mmi-cli oauth verify\` to confirm the client is port-agnostic.`);
+    console.log(`OAuth client stored in the ${oauthSsmKeys().length} canonical stageless keys. Run \`mmi-cli oauth verify\` to confirm the client is port-agnostic.`);
   });
 });
-oauth.command("verify").description("probe Google authorize with an arbitrary port (:9123) to confirm the client is port-agnostic").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--client-id <id>", "OAuth client_id (else read dev/GOOGLE_CLIENT_ID from SSM)").option("--json", "machine-readable output").action(async (o) => {
+oauth.command("verify").description("probe Google authorize with an arbitrary port (:9123) to confirm the client is port-agnostic").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--client-id <id>", "OAuth client_id (else read the stageless GOOGLE_CLIENT_ID from SSM)").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const slug = (o.repo ? o.repo.split("/").pop() : cfg.project ?? await repoSlug()).toLowerCase();
   const meta = await fetchProjectBySlug(slug, registryClientDeps(cfg));
@@ -19739,11 +19759,11 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   let clientId = o.clientId;
   if (!clientId) {
     await withSecrets(async (d) => {
-      clientId = await fetchSecretValue(d, "dev/GOOGLE_CLIENT_ID", { repo: o.repo }) ?? void 0;
+      clientId = await fetchSecretValue(d, "GOOGLE_CLIENT_ID", { repo: o.repo }) ?? void 0;
     });
   }
   if (!clientId) {
-    return failGraceful("oauth verify: no client_id (pass --client-id, or provision the repo so dev/GOOGLE_CLIENT_ID exists)");
+    return failGraceful("oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
   }
   const redirectUri = probeRedirectUri(oc.callbackPath);
   let body = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",