@mutmutco/cli 3.48.0 → 3.49.0

package/dist/main.cjs

@@ -6754,11 +6754,17 @@ async function secretsVerify(deps, key, opts) {
     deps.err(`invalid secret key ${JSON.stringify(key)}`);
     return false;
   }
-  if (!providerForSecretKey(key)) {
-    deps.err(`no provider verifier configured for ${secretLeafName(key)}`);
-    return false;
-  }
+  const hasProviderVerifier = Boolean(providerForSecretKey(key));
   const value = await fetchSecretValue(deps, key, opts);
+  if (!hasProviderVerifier) {
+    if (!value) {
+      deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
+      deps.err(`Locate a key across every vault you can reach: mmi-cli org access capabilities${opts.repo ? ` --repo ${opts.repo}` : ""}`);
+      return false;
+    }
+    deps.log(`${key}: PRESENT (${value.length} chars) \u2014 reachability only; no provider verifier is configured for ${secretLeafName(key)}, so the credential itself was not validated`);
+    return true;
+  }
   if (!value) {
     deps.err(`secrets verify: could not read ${key}; no value was printed`);
     return false;
@@ -6903,6 +6909,11 @@ async function secretsDeclare(deps, key, opts) {
   const body = await readJsonBody(res);
   if (!res.ok) {
     deps.err(await upgradeMessage(res, body) ?? `secrets declare failed: HTTP ${res.status}${errorDetail(body)}`);
+    if (res.status === 404 && !errorDetail(body)) {
+      deps.err(
+        `The Hub did not recognize the declare route (no error body \u2014 an API-gateway 404, not an authority refusal). Fall back to the master-side catalog write: mmi-cli org project set ${repo} --secrets-file <catalog.json> (shape: keyed by env name; each entry {key,purpose,group,owner,stages[],consumers[]} \u2014 see docs/Guides/oauth-provision.md \xA7 Cred catalog shape).`
+      );
+    }
     return false;
   }
   if (opts.json) {
@@ -7115,7 +7126,12 @@ async function secretsUse(deps, key, opts) {
         "  \u2022 Runtime: the central deploy injects the declared stage env; broker consumers use the workload's scoped runtime token. Never bake a value into an image or commit it.",
         `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
         "  \u2022 Own project: the stageless canonical and any declared dev/rc/main overrides are project-admin self-service.",
-        "  \u2022 Org-infra/cross-slug keys remain master-gated unless exactly granted."
+        "  \u2022 Org-infra/cross-slug keys remain master-gated unless exactly granted.",
+        "",
+        "Answer it without consuming it (#3436):",
+        "  \u2022 WHERE does a key live, across every vault you can reach: `mmi-cli org access capabilities` (names + tier + scope, never values). `secrets list` is this repo only and cannot see _org.",
+        `  \u2022 DOES it exist here: \`mmi-cli secrets verify ${key}${opts.slug ? ` --slug ${opts.slug}` : ""}\` \u2014 PRESENT/ABSENT even with no provider verifier configured.`,
+        "  \u2022 PowerShell note: `mmi-cli` resolves to npm's mmi-cli.ps1, whose binder eats the `--` separator. The wrapped command works either way; if a flag still misbinds, call `mmi-cli.cmd` explicitly."
       ].join("\n")
     );
     return;
@@ -9179,8 +9195,11 @@ async function waitForPrChecks(deps) {
       failureStreak += 1;
       if (failureStreak >= PR_CHECKS_FAILURE_CONFIRMATIONS) {
         const diagnosis = deps.diagnoseFailure ? await deps.diagnoseFailure().catch(() => null) : null;
-        if (diagnosis?.cause === "ci-budget-kill") {
-          return { policy, status: "failure", reason: diagnosis.reason, detail: "ci-budget-kill" };
+        if (diagnosis?.cause === "stale-head") {
+          return { policy, status: "failure", reason: diagnosis.reason, detail: "stale-head" };
+        }
+        if (diagnosis?.cause === "runner-infra") {
+          return { policy, status: "failure", reason: diagnosis.reason, detail: "runner-infra" };
         }
         return { policy, status: "failure", reason, detail: "checks-failure" };
       }
@@ -11808,27 +11827,36 @@ function setCommandMetadata(command, metadata) {
 function commandMetadata(command) {
   return command[COMMAND_METADATA];
 }
-function classifyTree(command, path2, inherited) {
-  const metadata = PATH_OVERRIDES[path2] ?? inherited;
+var REQUIRED_OPTION_HELP = {
+  optionDescription(option) {
+    const described = Help.prototype.optionDescription.call(this, option);
+    return option.mandatory ? `(required) ${described}` : described;
+  }
+};
+function classifyTree(command, path2, inherited, hideFromParent) {
+  const override = PATH_OVERRIDES[path2];
+  const metadata = override ?? inherited;
   setCommandMetadata(command, metadata);
-  if (metadata.discovery !== "primary") {
+  if ((override !== void 0 || hideFromParent) && metadata.discovery !== "primary") {
     command._hidden = true;
   }
   for (const option of command.options) {
     if ((HIDDEN_OPTIONS[path2] ?? []).includes(option.long ?? option.short ?? "")) option.hideHelp();
   }
+  command.configureHelp(REQUIRED_OPTION_HELP);
   for (const child2 of command.commands) {
     const childPath = path2 ? `${path2} ${child2.name()}` : child2.name();
-    classifyTree(child2, childPath, PATH_OVERRIDES[childPath] ?? metadata);
+    classifyTree(child2, childPath, metadata, false);
   }
 }
 function applyCommandTaxonomy(program3) {
   for (const command of program3.commands) {
     const metadata = topLevelMetadata(command.name());
     command.helpGroup(metadata.help_group);
-    classifyTree(command, command.name(), metadata);
+    classifyTree(command, command.name(), metadata, true);
   }
   program3.configureHelp({
+    ...REQUIRED_OPTION_HELP,
     visibleCommands(command) {
       const visible = command.commands.filter((child2) => !child2._hidden);
       const helpCommand = command._getHelpCommand();
@@ -14506,6 +14534,24 @@ async function deriveHotfixVersion(deps) {
 function hotfixBranch(tag) {
   return `hotfix/${tag}`;
 }
+async function restoreAfterFailedPort(deps, opts) {
+  const { startBranch, branch, created } = opts;
+  if (!startBranch || startBranch === "HEAD" || startBranch === branch) {
+    return `Local state left as-is (could not determine the branch to return to).`;
+  }
+  try {
+    await deps.run("git", ["checkout", startBranch]);
+  } catch {
+    return `Could NOT return to ${startBranch} \u2014 the checkout is still on ${branch} (origin/main content); switch back before editing anything.`;
+  }
+  if (!created) return `Returned to ${startBranch}; the pre-existing local ${branch} was left in place.`;
+  try {
+    await deps.run("git", ["branch", "-D", branch]);
+    return `Returned to ${startBranch} and removed the local ${branch}.`;
+  } catch {
+    return `Returned to ${startBranch}; the local ${branch} could not be removed \u2014 delete it by hand.`;
+  }
+}
 async function resolveHotfixDeployModel(deps, ctx) {
   const load = await loadProjectMeta(deps, ctx);
   const meta = requireProjectMetaForTrain(load, ctx.repo);
@@ -14604,12 +14650,17 @@ async function runHotfixStart(deps, options) {
     await deps.run("git", ["pull", "--ff-only", "origin", branch]);
     notes.push(`branch ${branch} already on origin \u2014 reused (cherry-pick/bump assumed present; PR step resumes)`);
   } else {
+    const startBranch = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
+    const preexistingLocal = clean3(await deps.run("git", ["branch", "--list", branch]));
     await deps.run("git", ["checkout", "-B", branch, "origin/main"]);
     try {
       await deps.run("git", ["cherry-pick", "-x", sha]);
     } catch (e) {
       await deps.run("git", ["cherry-pick", "--abort"]);
-      throw new Error(`cherry-pick of ${label} onto ${branch} conflicted \u2014 aborted; resolve by hand on a manual hotfix branch, keeping the -x trailer (${e.message ?? e})`);
+      const recovery = await restoreAfterFailedPort(deps, { startBranch, branch, created: !preexistingLocal });
+      throw new Error(
+        `cherry-pick of ${label} onto ${branch} conflicted \u2014 aborted; nothing was pushed. Land the conflict resolution on development through a normal PR, then rerun \`mmi-cli hotfix start --from <that PR's merge sha>\` \u2014 never hand-resolve the port onto main. ${recovery} (${e.message ?? e})`
+      );
     }
     notes.push(`cherry-picked ${label} onto ${branch} (from origin/main, -x trailer recorded)`);
     if (deployModel === "hub-serverless") {
@@ -16849,7 +16900,7 @@ async function withSecrets(run) {
 function registerSecretsCommands(program3) {
   const secrets = program3.command("secrets").description("project vault \u2014 project-admins self-serve their own repo's full tree (stageless + dev/rc/main); org-infra namespaces are master-gated");
   secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsWhere(d, o)));
-  secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
+  secrets.command("list").description("list secret NAMES + tier for THIS repo (never values). To locate a key you cannot place \u2014 including org-infra (_org) \u2014 use the cross-slug view: `mmi-cli org access capabilities` (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
   secrets.command("find <intent>").description("resolve a plain-language intent to canonical secret names + the exact keyless-use command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
     if (!await secretsFind(d, intent, o)) process.exitCode = 1;
   }));
@@ -16972,7 +17023,7 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("verify <key>").description("validate a known provider secret without printing its value").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets(async (d) => {
+  secrets.command("verify <key>").description("validate a known provider secret without printing its value; a key with no configured provider verifier falls back to a value-free PRESENT/ABSENT reachability check (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
   }));
@@ -17022,7 +17073,7 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   }));
   secrets.command("rm <key>").description("remove a secret from your own full project vault; org-infra requires master or an exact grant. --slug _org removes an org-infra <provider>/<KEY> value (#3315)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value removal \u2014 master or an exact grant (#3315)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
-  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
+  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it. The wrapped command keeps its OWN flags (`-- node -e \u2026`, `-- curl -H \u2026`) with or without the `--`, because npm's PowerShell shim swallows `--` before the CLI sees it (#3436)").allowUnknownOption().option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
     const ok = await secretsUse(d, key, { ...o, command });
     if (ok === false) process.exitCode = 1;
   }));
@@ -20725,14 +20776,30 @@ function parseRestPrSnapshot(json) {
   const pr2 = json ?? {};
   const headSha = pr2.head?.sha ?? "";
   if (!headSha) throw new Error("pulls endpoint returned no head SHA");
+  const headRepo = pr2.head?.repo?.full_name;
+  const baseRepo = pr2.base?.repo?.full_name;
   return {
     headSha,
+    headRef: pr2.head?.ref ?? "",
+    // Only call it a fork when BOTH names are known and differ — an absent name (private/deleted fork)
+    // must not read as same-repo and send a git-ref probe at a branch the base repo does not have.
+    headIsFork: Boolean(headRepo && baseRepo && headRepo !== baseRepo),
     mergeable: pr2.mergeable === true ? "MERGEABLE" : pr2.mergeable === false ? "CONFLICTING" : "UNKNOWN",
     baseRef: pr2.base?.ref ?? "development",
     merged: pr2.merged === true,
     state: pr2.state ?? ""
   };
 }
+async function fetchBranchTipSha(repo, ref, gh = defaultGhApi) {
+  if (!ref) return null;
+  try {
+    const parsed = JSON.parse(await gh([`repos/${repo}/git/ref/heads/${ref}`]));
+    const sha = parsed.object?.sha;
+    return typeof sha === "string" && sha ? sha : null;
+  } catch {
+    return null;
+  }
+}
 async function fetchRestPrSnapshot(prNumber, repo, gh = defaultGhApi) {
   return parseRestPrSnapshot(JSON.parse(await gh([`repos/${repo}/pulls/${prNumber}`])));
 }
@@ -20767,36 +20834,54 @@ async function pollRestPrMerged(prNumber, repo, gh = defaultGhApi) {
   }
 }
 var CI_BUDGET_ANNOTATION_TITLE = "CI budget exceeded";
+var CI_DISK_ANNOTATION_TITLE = "CI runner disk";
+var CI_TOOLCHAIN_ANNOTATION_TITLE = "CI runner toolchain";
+var RUNNER_INFRA_ANNOTATION_TITLES = /* @__PURE__ */ new Set([
+  CI_BUDGET_ANNOTATION_TITLE,
+  CI_DISK_ANNOTATION_TITLE,
+  CI_TOOLCHAIN_ANNOTATION_TITLE
+]);
 function isErrorAnnotation(a) {
   const level = a.annotation_level?.toLowerCase();
   return level === "failure" || level === "error";
 }
 function classifyFailedChecks(failing) {
-  const budgetKilled = [];
+  const infraFailures = [];
   const otherFailures = [];
   for (const check of failing) {
     const errors = check.annotations.filter(isErrorAnnotation);
-    const allBudget = errors.length > 0 && errors.every((a) => a.title?.trim() === CI_BUDGET_ANNOTATION_TITLE);
-    (allBudget ? budgetKilled : otherFailures).push(check.name);
+    const allInfra = errors.length > 0 && errors.every((a) => RUNNER_INFRA_ANNOTATION_TITLES.has(a.title?.trim() ?? ""));
+    (allInfra ? infraFailures : otherFailures).push(check.name);
   }
-  if (budgetKilled.length && !otherFailures.length) {
+  if (infraFailures.length && !otherFailures.length) {
     return {
-      cause: "ci-budget-kill",
-      budgetKilled,
+      cause: "runner-infra",
+      infraFailures,
       otherFailures,
-      reason: `${budgetKilled.length} check(s) were KILLED for wall-clock, not failed: ${budgetKilled.join(", ")}. No test failed \u2014 this is runner contention (concurrent gates sharing one runner). Rerun once the other gates drain (gh run rerun --failed); do not debug the diff.`
+      reason: `${infraFailures.length} check(s) failed on RUNNER INFRASTRUCTURE, not your diff: ${infraFailures.join(", ")}. No test failed \u2014 the shared runner hit a wall-clock budget kill, ran out of disk, or was missing a toolchain (the check annotation names which). Re-run once the runner drains/heals (gh run rerun --failed); do not debug the diff.`
     };
   }
   return {
     cause: "checks-failure",
-    budgetKilled,
+    infraFailures,
     otherFailures,
-    reason: budgetKilled.length ? `checks failed: ${otherFailures.join(", ")}; separately, ${budgetKilled.join(", ")} was killed for wall-clock, not failed.` : `checks failed: ${otherFailures.join(", ") || "unknown"}.`
+    reason: infraFailures.length ? `checks failed: ${otherFailures.join(", ")}; separately, ${infraFailures.join(", ")} failed on runner infrastructure, not a test.` : `checks failed: ${otherFailures.join(", ") || "unknown"}.`
   };
 }
 async function diagnoseFailedRestChecks(prNumber, repo, gh = defaultGhApi) {
   try {
     const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh);
+    if (!snapshot.headIsFork) {
+      const branchTip = await fetchBranchTipSha(repo, snapshot.headRef, gh);
+      if (branchTip && branchTip !== snapshot.headSha) {
+        return {
+          cause: "stale-head",
+          infraFailures: [],
+          otherFailures: [],
+          reason: `the PR head (${snapshot.headSha.slice(0, 7)}) is BEHIND the branch tip (${branchTip.slice(0, 7)}) \u2014 GitHub likely dropped a \`synchronize\` event, so the reported red is a superseded commit and NO run exists for your current push. This is not your diff failing. Re-push (an empty commit is enough) or close and reopen the PR to re-sync the head and trigger a fresh run.`
+        };
+      }
+    }
     const failing = (await fetchHeadCheckRuns(snapshot.headSha, repo, gh)).filter((run) => classifyCheckRun(run) === "fail" && typeof run.id === "number");
     if (!failing.length) return null;
     const annotated = await Promise.all(failing.map(async (run) => ({
@@ -24525,7 +24610,7 @@ projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# fa
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload));
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|\u2026], "provider":"<optional>"}').option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -24712,7 +24797,15 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
   try {
     oc = parseOauthConfig(meta ?? {}, slug);
   } catch (e) {
-    return failGraceful(`org oauth plan: ${e.message}`);
+    const message = e.message;
+    if (/^oauth is not configured for /.test(message)) {
+      return failGraceful(
+        `org oauth plan: ${message}. Declare it in the registry META first:
+  mmi-cli org project set ${o.repo ?? `mutmutco/${slug}`} --var 'oauth={"subdomains":["${defaultSubdomain(slug)}"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}'
+  New repo? The GCP project and its Google Auth Platform consent screen must exist too \u2014 docs/Guides/oauth-provision.md \xA7 New repo.`
+      );
+    }
+    return failGraceful(`org oauth plan: ${message}`);
   }
   const origins = expectedJsOrigins(oc);
   const redirects = expectedRedirectUris(oc);
@@ -25269,8 +25362,10 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     printLine(`pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.`);
   } else if (result.status === "rate-limited") {
     printLine(`pr checks-wait: rate-limited \u2014 ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
-  } else if (result.detail === "ci-budget-kill") {
-    printLine(`pr checks-wait: failure (wall-clock budget kill, NOT a test failure) \u2014 ${result.reason}`);
+  } else if (result.detail === "runner-infra") {
+    printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) \u2014 ${result.reason}`);
+  } else if (result.detail === "stale-head") {
+    printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) \u2014 ${result.reason}`);
   } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.48.0",
+  "version": "3.49.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",