@mutmutco/cli 3.6.0 → 3.7.0

package/dist/main.cjs

@@ -5897,7 +5897,7 @@ function parseGhPrChecksOutput(stdout) {
   if (!lines.length) return "no-checks-reported";
   let anyPending = false;
   for (const line of lines) {
-    const parts = line.split(/\s+/);
+    const parts = line.includes("	") ? line.split("	") : line.split(/\s+/);
     const state = (parts[1] ?? "").toLowerCase();
     if (state === "fail" || state === "failure" || state === "error") return "failure";
     if (state === "pass" || state === "success" || state === "skipping" || state === "skipped") continue;
@@ -5916,22 +5916,46 @@ var PR_CHECKS_POLL_MS = 3e4;
 var PR_CHECKS_TIMEOUT_MS = 10 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
 var PR_CHECKS_CONFIRM_MS = 5e3;
+var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
+function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none") {
+  if (checks === "no-checks-reported") return { action: "proceed" };
+  const staleNote = `registry says no-ci (${policyReason}), but live PR checks exist`;
+  if (checks === "success") {
+    return { action: "proceed", note: `${staleNote}; proceeding because they are green` };
+  }
+  return {
+    action: "refuse",
+    message: [
+      `${staleNote} and are not green (${checks}).`,
+      "Fix the checks or use `mmi-cli pr land` so the CLI waits.",
+      "Then correct registry META: `mmi-cli project set <owner/repo> --var requiredChecks=<check-run-display-names>`."
+    ].join(" ")
+  };
+}
 async function waitForPrChecks(deps) {
-  const { policy, reason } = await deps.resolvePolicy();
+  let { policy, reason } = await deps.resolvePolicy();
+  const queuedStates = [];
   if (policy === "no-ci") {
-    return { policy, status: "skipped", reason };
+    const firstState = await deps.pollChecks();
+    if (firstState === "no-checks-reported") {
+      return { policy, status: "skipped", reason };
+    }
+    reason = NO_CI_LIVE_CHECKS_CONTRADICTION_REASON;
+    deps.log?.(`merge CI policy contradiction: ${reason}; waiting for live PR checks`);
+    policy = "wait-for-checks";
+    queuedStates.push(firstState);
   }
   const now = deps.now ?? (() => Date.now());
   const deadline = now() + PR_CHECKS_TIMEOUT_MS;
   let lastDetail = "pending";
   let successStreak = 0;
   while (now() < deadline) {
-    const state = await deps.pollChecks();
-    if (state === "failure") return { policy, status: "failure", detail: lastDetail };
+    const state = queuedStates.shift() ?? await deps.pollChecks();
+    if (state === "failure") return { policy, status: "failure", reason, detail: lastDetail };
     if (state === "success") {
       successStreak += 1;
       if (successStreak >= PR_CHECKS_SUCCESS_CONFIRMATIONS) {
-        return { policy, status: "success", detail: "checks-success" };
+        return { policy, status: "success", reason, detail: "checks-success" };
       }
       lastDetail = "confirming-success";
       await deps.sleep(PR_CHECKS_CONFIRM_MS);
@@ -5946,7 +5970,7 @@ async function waitForPrChecks(deps) {
     lastDetail = state;
     await deps.sleep(PR_CHECKS_POLL_MS);
   }
-  return { policy, status: "timeout", detail: lastDetail };
+  return { policy, status: "timeout", reason, detail: lastDetail };
 }
 
 // src/bootstrap-ruleset.ts
@@ -6736,6 +6760,22 @@ async function auditRepoCi(repo, deps) {
     detail: info.delete_branch_on_merge === true ? void 0 : "false or unavailable"
   });
   const hasGateWorkflow = repoClass === "hub" ? true : repoClass === "content" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
+  let emittedPrContexts;
+  const getEmittedPrContexts = async () => {
+    emittedPrContexts ??= await resolveEmittedPrContexts(deps, repo, baseBranch);
+    return emittedPrContexts;
+  };
+  if (explicitNoCi) {
+    const emitted = await getEmittedPrContexts();
+    if (emitted.length > 0) {
+      checks.push({
+        ok: false,
+        label: "registry no-ci contradicts PR workflows",
+        detail: `registry META declares no-ci but pull_request workflows emit [${emitted.join(", ")}]`,
+        remediation: `Fix the workflows or correct registry META: mmi-cli project set ${repo} --var requiredChecks=${JSON.stringify(emitted)}`
+      });
+    }
+  }
   if (deployableGated) {
     checks.push({
       ok: hasGateWorkflow,
@@ -6770,7 +6810,7 @@ async function auditRepoCi(repo, deps) {
       remediation: hasRequiredChecks ? void 0 : `Import ${PRODUCT_RULESET_REF} as an active repository ruleset (GitHub \u2192 Settings \u2192 Rules \u2192 Rulesets) \u2014 target: bootstrap --apply automation (#1440)`
     });
     if (hasGateWorkflow) {
-      const emitted = registryRequiredContexts(meta) ?? await resolveEmittedPrContexts(deps, repo, baseBranch);
+      const emitted = registryRequiredContexts(meta) ?? await getEmittedPrContexts();
       if (emitted.length > 0) {
         const aligned = contextsMatchRuleset(statusChecks, new Set(emitted));
         checks.push({
@@ -13365,11 +13405,12 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
-var SECRET_CONSUMERS = ["runtime", "lambda", "actions", "agent", "box"];
+var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
 function parseSecretsCatalogVar(raw) {
   let parsed;
   try {
@@ -13433,6 +13474,21 @@ function parseRuntimeSecretsVar(raw) {
   }
   return out;
 }
+function parseBuildSecretsVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('project set: requiredBuildSecrets must be JSON, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]');
+  }
+  if (!Array.isArray(parsed)) {
+    throw new Error("project set: requiredBuildSecrets must be a flat array (build secrets are not stage-mapped)");
+  }
+  if (parsed.some((n) => typeof n !== "string" || !BUILD_SECRET_REF_RE.test(n) || n === "@github-packages-token")) {
+    throw new Error("project set: requiredBuildSecrets must be a flat array of ENVID=<ref> or bare <ref> strings");
+  }
+  return parsed;
+}
 function parseEdgeDomainsVar(raw) {
   let parsed;
   try {
@@ -13657,6 +13713,7 @@ var SETTABLE_VAR_KEYS = [
   "consumesDesignSystem",
   "requiredGcpApis",
   "requiredRuntimeSecrets",
+  "requiredBuildSecrets",
   "edgeDomains",
   "statusFieldId",
   "statusOptions",
@@ -13680,7 +13737,8 @@ var SETTABLE_VAR_HINTS = {
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
-  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 prefer --secrets-file",
+  requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
+  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; clear with --unset secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
   priorityOptions: "JSON {Urgent,High,Medium,Low}\u2192id map",
@@ -13736,6 +13794,8 @@ function buildProjectSetPatch(input) {
       patch[key] = n;
     } else if (key === "requiredRuntimeSecrets") {
       patch[key] = parseRuntimeSecretsVar(raw);
+    } else if (key === "requiredBuildSecrets") {
+      patch[key] = parseBuildSecretsVar(raw);
     } else if (key === "secrets") {
       patch[key] = parseSecretsCatalogVar(raw);
     } else if (key === "edgeDomains") {
@@ -15715,59 +15775,6 @@ function buildInstalledPluginVersionCheck(input) {
     staleSurfaces: stale
   };
 }
-var MANAGED_PLUGINS = [
-  {
-    // Marketplace-qualified key exactly as installed_plugins.json stores it (same convention as
-    // MMI_PLUGIN_ID = 'mmi@mutmutco') — a bare 'jervaise-powertools' would never match a real record
-    // and the check would be a permanent no-op. The same `<marketplace>/<name>` segments also address its
-    // Cursor Team Marketplace cache dir (~/.cursor/plugins/cache/jervaise/jervaise-powertools/<version>/).
-    id: "jervaise-powertools@jervaise",
-    label: "jervaise-powertools",
-    healCommand: "jerv-cli doctor --apply",
-    opencodePackage: "@jervaise/opencode-jerv"
-  }
-];
-function parseManagedPluginId(id) {
-  const at = id.lastIndexOf("@");
-  if (at <= 0 || at === id.length - 1) return null;
-  return { name: id.slice(0, at), marketplace: id.slice(at + 1) };
-}
-var MANAGED_PLUGIN_DRIFT_LABEL = "managed org plugin version drift (cross-surface)";
-function managedPluginDriftFix(drifted) {
-  return drifted.map((d) => {
-    const versions = d.versions.map((v) => `${v.version} (${v.surface})`).join(" vs ");
-    return `${d.label} drift: ${versions} \u2192 run \`${d.healCommand}\``;
-  }).join(" ; ");
-}
-function buildManagedPluginDriftCheck(input) {
-  const base = { ok: true, label: MANAGED_PLUGIN_DRIFT_LABEL, fix: "" };
-  if (!input.isOrgRepo) return base;
-  const registry2 = input.plugins ?? MANAGED_PLUGINS;
-  const drifted = [];
-  const normalize = (v) => v.replace(/^v/, "");
-  for (const descriptor of registry2) {
-    const versions = [];
-    for (const source of input.sources) {
-      if (source.directVersions && descriptor.id in source.directVersions) {
-        const version2 = source.directVersions[descriptor.id];
-        if (isSemverVersion(version2)) versions.push({ surface: source.surface, version: normalize(version2) });
-        continue;
-      }
-      const records = source.installed?.plugins?.[descriptor.id];
-      if (!Array.isArray(records) || records.length === 0) continue;
-      const recordVersion = bestRecord(records).version;
-      const version = isSemverVersion(recordVersion) ? recordVersion : highestSemver(source.cacheVersions?.[descriptor.id] ?? []);
-      if (!isSemverVersion(version)) continue;
-      versions.push({ surface: source.surface, version: normalize(version) });
-    }
-    if (versions.length < 2) continue;
-    const distinctVersions = new Set(versions.map((v) => v.version));
-    if (distinctVersions.size < 2) continue;
-    drifted.push({ pluginId: descriptor.id, label: descriptor.label, healCommand: descriptor.healCommand, versions });
-  }
-  if (drifted.length === 0) return base;
-  return { ...base, ok: false, fix: managedPluginDriftFix(drifted), drifted };
-}
 var OPENCODE_VERSION_LABEL = "installed OpenCode MMI adapter version (vs latest release)";
 function buildOpencodeVersionCheck(input) {
   const fix = pluginRecoveryFix("opencode");
@@ -17235,77 +17242,6 @@ function installedPluginSources() {
     }
   });
 }
-function managedPluginSurfaceSources() {
-  const claudeCodex = installedPluginSources().map(({ surface, installed }) => {
-    const cacheVersions = {};
-    for (const descriptor of MANAGED_PLUGINS) {
-      const segments = parseManagedPluginId(descriptor.id);
-      if (!segments) continue;
-      try {
-        cacheVersions[descriptor.id] = (0, import_node_fs18.readdirSync)(
-          (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "cache", segments.marketplace, segments.name),
-          { withFileTypes: true }
-        ).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-      } catch {
-      }
-    }
-    return { surface, installed, cacheVersions };
-  });
-  return [
-    ...claudeCodex,
-    { surface: "cursor", directVersions: managedPluginCursorDirectVersions() },
-    { surface: "opencode", directVersions: managedPluginOpencodeDirectVersions() }
-  ];
-}
-function managedPluginCursorDirectVersions() {
-  const out = {};
-  for (const descriptor of MANAGED_PLUGINS) {
-    const segments = parseManagedPluginId(descriptor.id);
-    if (!segments) continue;
-    try {
-      const versions = (0, import_node_fs18.readdirSync)(
-        (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", segments.marketplace, segments.name),
-        { withFileTypes: true }
-      ).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
-      out[descriptor.id] = highestSemver(versions);
-    } catch {
-    }
-  }
-  return out;
-}
-function managedPluginOpencodeDirectVersions() {
-  const out = {};
-  for (const descriptor of MANAGED_PLUGINS) {
-    if (!descriptor.opencodePackage) continue;
-    out[descriptor.id] = readOpencodePackageVersion(descriptor.opencodePackage);
-  }
-  return out;
-}
-function readOpencodePackageVersionFrom(packageJsonPath) {
-  try {
-    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function readOpencodePackageVersion(packageName) {
-  const [scope, name] = packageName.startsWith("@") ? packageName.slice(1).split("/", 2) : [void 0, packageName];
-  if (!name) return void 0;
-  const diskCandidates = [
-    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"),
-    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json")
-  ];
-  const diskVersion = diskCandidates.map(readOpencodePackageVersionFrom).find((v) => v !== void 0);
-  const packagesRoot = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", ...scope ? [`@${scope}`] : []);
-  let cacheVersion;
-  try {
-    const cacheVersions = (0, import_node_fs18.readdirSync)(packagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${name}@`) && !e.name.startsWith(".")).map((e) => readOpencodePackageVersionFrom((0, import_node_path18.join)(packagesRoot, e.name, "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"))).filter((v) => Boolean(v));
-    if (cacheVersions.length) cacheVersion = cacheVersions.reduce((lowest, v) => compareVersions(v, lowest) < 0 ? v : lowest);
-  } catch {
-  }
-  return pickOpencodeActiveVersion({ cacheVersion, diskVersion });
-}
 function readClaudeSettings() {
   try {
     return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
@@ -18192,7 +18128,6 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     }
   }
   checks.push(installedVersionCheck);
-  checks.push(buildManagedPluginDriftCheck({ isOrgRepo, sources: managedPluginSurfaceSources() }));
   let openCodeConfigSnapshot = opencodeConfigSnapshot();
   const inspectOpenCode = surface === "opencode" || openCodeConfigSnapshot.hasConfig || runExtended;
   if (inspectOpenCode) {
@@ -19551,7 +19486,7 @@ project.command("attest [owner/repo]").description("attest this repo's app-owned
   const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
   return reportWrite("project attest", res);
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and set it as --var secrets (robust for large maps)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -20185,7 +20120,8 @@ pr.command("checks-wait <number>").description("bounded wait for PR checks; skip
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    log: (message) => console.warn(message)
   });
   if (o.json) printLine(JSON.stringify(result));
   else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
@@ -20212,7 +20148,8 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
-      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+      log: (message) => console.warn(message)
     }),
     // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
@@ -20423,6 +20360,12 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
+  const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo);
+  if (ciPolicy.policy === "no-ci") {
+    const guard = decidePrMergeNoCiGuard(await pollGhPrChecks(number, repoArgs), ciPolicy.reason);
+    if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
+    if (guard.note) console.warn(`pr merge: ${guard.note}`);
+  }
   const remoteBefore = await remoteBranchExists2(headRef);
   let remoteDeleteAttempted = false;
   let remoteNotAttemptedReason;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",