@mutmutco/cli 3.6.0 → 3.8.0

package/dist/main.cjs

@@ -5897,7 +5897,7 @@ function parseGhPrChecksOutput(stdout) {
   if (!lines.length) return "no-checks-reported";
   let anyPending = false;
   for (const line of lines) {
-    const parts = line.split(/\s+/);
+    const parts = line.includes("	") ? line.split("	") : line.split(/\s+/);
     const state = (parts[1] ?? "").toLowerCase();
     if (state === "fail" || state === "failure" || state === "error") return "failure";
     if (state === "pass" || state === "success" || state === "skipping" || state === "skipped") continue;
@@ -5916,22 +5916,46 @@ var PR_CHECKS_POLL_MS = 3e4;
 var PR_CHECKS_TIMEOUT_MS = 10 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
 var PR_CHECKS_CONFIRM_MS = 5e3;
+var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
+function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none") {
+  if (checks === "no-checks-reported") return { action: "proceed" };
+  const staleNote = `registry says no-ci (${policyReason}), but live PR checks exist`;
+  if (checks === "success") {
+    return { action: "proceed", note: `${staleNote}; proceeding because they are green` };
+  }
+  return {
+    action: "refuse",
+    message: [
+      `${staleNote} and are not green (${checks}).`,
+      "Fix the checks or use `mmi-cli pr land` so the CLI waits.",
+      "Then correct registry META: `mmi-cli project set <owner/repo> --var requiredChecks=<check-run-display-names>`."
+    ].join(" ")
+  };
+}
 async function waitForPrChecks(deps) {
-  const { policy, reason } = await deps.resolvePolicy();
+  let { policy, reason } = await deps.resolvePolicy();
+  const queuedStates = [];
   if (policy === "no-ci") {
-    return { policy, status: "skipped", reason };
+    const firstState = await deps.pollChecks();
+    if (firstState === "no-checks-reported") {
+      return { policy, status: "skipped", reason };
+    }
+    reason = NO_CI_LIVE_CHECKS_CONTRADICTION_REASON;
+    deps.log?.(`merge CI policy contradiction: ${reason}; waiting for live PR checks`);
+    policy = "wait-for-checks";
+    queuedStates.push(firstState);
   }
   const now = deps.now ?? (() => Date.now());
   const deadline = now() + PR_CHECKS_TIMEOUT_MS;
   let lastDetail = "pending";
   let successStreak = 0;
   while (now() < deadline) {
-    const state = await deps.pollChecks();
-    if (state === "failure") return { policy, status: "failure", detail: lastDetail };
+    const state = queuedStates.shift() ?? await deps.pollChecks();
+    if (state === "failure") return { policy, status: "failure", reason, detail: lastDetail };
     if (state === "success") {
       successStreak += 1;
       if (successStreak >= PR_CHECKS_SUCCESS_CONFIRMATIONS) {
-        return { policy, status: "success", detail: "checks-success" };
+        return { policy, status: "success", reason, detail: "checks-success" };
       }
       lastDetail = "confirming-success";
       await deps.sleep(PR_CHECKS_CONFIRM_MS);
@@ -5946,7 +5970,7 @@ async function waitForPrChecks(deps) {
     lastDetail = state;
     await deps.sleep(PR_CHECKS_POLL_MS);
   }
-  return { policy, status: "timeout", detail: lastDetail };
+  return { policy, status: "timeout", reason, detail: lastDetail };
 }
 
 // src/bootstrap-ruleset.ts
@@ -6736,6 +6760,22 @@ async function auditRepoCi(repo, deps) {
     detail: info.delete_branch_on_merge === true ? void 0 : "false or unavailable"
   });
   const hasGateWorkflow = repoClass === "hub" ? true : repoClass === "content" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
+  let emittedPrContexts;
+  const getEmittedPrContexts = async () => {
+    emittedPrContexts ??= await resolveEmittedPrContexts(deps, repo, baseBranch);
+    return emittedPrContexts;
+  };
+  if (explicitNoCi) {
+    const emitted = await getEmittedPrContexts();
+    if (emitted.length > 0) {
+      checks.push({
+        ok: false,
+        label: "registry no-ci contradicts PR workflows",
+        detail: `registry META declares no-ci but pull_request workflows emit [${emitted.join(", ")}]`,
+        remediation: `Fix the workflows or correct registry META: mmi-cli project set ${repo} --var requiredChecks=${JSON.stringify(emitted)}`
+      });
+    }
+  }
   if (deployableGated) {
     checks.push({
       ok: hasGateWorkflow,
@@ -6770,7 +6810,7 @@ async function auditRepoCi(repo, deps) {
       remediation: hasRequiredChecks ? void 0 : `Import ${PRODUCT_RULESET_REF} as an active repository ruleset (GitHub \u2192 Settings \u2192 Rules \u2192 Rulesets) \u2014 target: bootstrap --apply automation (#1440)`
     });
     if (hasGateWorkflow) {
-      const emitted = registryRequiredContexts(meta) ?? await resolveEmittedPrContexts(deps, repo, baseBranch);
+      const emitted = registryRequiredContexts(meta) ?? await getEmittedPrContexts();
       if (emitted.length > 0) {
         const aligned = contextsMatchRuleset(statusChecks, new Set(emitted));
         checks.push({
@@ -9230,7 +9270,7 @@ function parseNpmVersion(stdout) {
   return /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(v) ? v : void 0;
 }
 function staleTrainCliMessage(report, commandName) {
-  return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`mmi-cli doctor --apply --no-repo-writes\` to update to ${report.releasedVersion}, then rerun ${commandName} so it uses the current train path`;
+  return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`mmi-cli doctor --apply --no-repo-writes\` to update to ${report.releasedVersion}, then rerun ${commandName} so it uses the current train path. This gate runs before any train mutation, so this invocation changed nothing; any partial train state (local merge, pushed tag) is from an earlier run and the rerun resumes it safely`;
 }
 async function resolveReleasedVersion(runners) {
   try {
@@ -9998,7 +10038,7 @@ var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
-var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion}]";
+var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion,startedAt:.started_at}]";
 var TRAIN_COMMIT_STATUS_JQ = "[.statuses[]|{context:.context,state:.state}]";
 var TRAIN_PROTECTION_CONTEXTS_JQ = "[.contexts[]]";
 var TRAIN_RULES_CONTEXTS_JQ = '[.[]|select(.type=="required_status_checks")|.parameters.required_status_checks[].context]';
@@ -10006,6 +10046,7 @@ var TRAIN_CHECK_ATTEMPTS = 40;
 var TRAIN_CHECK_DELAY_MS = 15e3;
 var TRAIN_PR_ONLY_AUTOMATION_CONTEXTS = /* @__PURE__ */ new Set(["add-to-project", "mark-merged-pr-done"]);
 var TRAIN_PR_AUTOMATION_GRACE_ATTEMPTS = 3;
+var TRAIN_FRESH_RUN_GRACE_ATTEMPTS = 4;
 async function correlateRun(deps, args) {
   const sleep = resolveSleep(deps);
   const threshold = args.since - CORRELATE_SKEW_SLACK_MS;
@@ -10063,12 +10104,19 @@ async function correlateWorkflowRun(deps, args) {
 }
 async function watchTenantRun(deps, runId, repo = HUB_REPO3) {
   if (runId == null) return "pending";
+  let watchSaidSuccess = true;
   try {
     await deps.run("gh", ["run", "watch", String(runId), "--repo", repo, "--exit-status"]);
-    return "success";
   } catch {
-    return "failure";
+    watchSaidSuccess = false;
+  }
+  try {
+    const out = await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]);
+    const parsed = JSON.parse(out);
+    if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
+  } catch {
   }
+  return watchSaidSuccess ? "success" : "failure";
 }
 async function fetchControlRunLog(deps, runId) {
   try {
@@ -10180,10 +10228,16 @@ function resolveContextState(context, checkRuns, statuses) {
   if (sawSuccess) return "success";
   return sawFailure ? "failed" : "pending";
 }
-async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
+async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince) {
   if (required.length === 0) {
     return "no required status checks configured on the target branch \u2014 check wait skipped (GitHub push gate is the backstop)";
   }
+  const freshThreshold = freshSince !== void 0 ? freshSince - CORRELATE_SKEW_SLACK_MS : void 0;
+  const isFreshRun = (r) => {
+    if (freshThreshold === void 0) return true;
+    const t = Date.parse(String(r.startedAt ?? ""));
+    return !Number.isFinite(t) || t >= freshThreshold;
+  };
   const sleep = resolveSleep(deps);
   let lastStatus = "not checked";
   let lastError;
@@ -10216,7 +10270,14 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
       }
     }
     const pending = required.filter((c) => !autoSatisfied.has(c));
-    const states = pending.map((c) => [c, resolveContextState(c, checkRuns, statuses)]);
+    const holdStale = freshThreshold !== void 0 && attempt < TRAIN_FRESH_RUN_GRACE_ATTEMPTS;
+    const states = pending.map((c) => {
+      if (holdStale) {
+        const runsFor = checkRuns.filter((r) => r.name === c);
+        if (runsFor.length > 0 && !runsFor.some(isFreshRun)) return [c, "pending"];
+      }
+      return [c, resolveContextState(c, checkRuns, statuses)];
+    });
     const satisfiedNote = autoSatisfied.size ? `, auto-satisfied (never runs on a tag, see #2404): ${[...autoSatisfied].join(", ")}` : "";
     lastStatus = `${states.map(([c, s]) => `${c}=${s}`).join(", ")}${satisfiedNote}`;
     const failed = states.filter(([, s]) => s === "failed").map(([c]) => c);
@@ -10268,14 +10329,14 @@ async function ensureTagPushed(deps, tag, sha) {
     if (localSha && localSha !== sha) {
       throw new Error(`local tag ${tag} points at ${localSha} but origin has it at ${sha} \u2014 delete the stale local tag (git tag -d ${tag}) and rerun`);
     }
-    return `tag ${tag} already on origin at ${sha.slice(0, 7)} \u2014 resumed without re-pushing`;
+    return { note: `tag ${tag} already on origin at ${sha.slice(0, 7)} \u2014 resumed without re-pushing`, pushed: false };
   }
   if (localSha && localSha !== sha) {
     throw new Error(`local tag ${tag} already points at ${localSha}, not the intended ${sha} \u2014 delete the stale local tag (git tag -d ${tag}) and rerun`);
   }
   if (!localSha) await deps.run("git", ["tag", tag, sha]);
   await deps.run("git", ["push", "origin", tag]);
-  return `tag ${tag} pushed at ${sha.slice(0, 7)}`;
+  return { note: `tag ${tag} pushed at ${sha.slice(0, 7)}`, pushed: true };
 }
 async function resolveRcResumeTag(deps, base, sha) {
   const out = await deps.run("git", ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
@@ -10581,11 +10642,12 @@ async function runFoldStage(deps, startBranch, preFold, fn) {
   }
 }
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
-  await ensureTagPushed(deps, tag, releaseSha);
+  const tagPush = await ensureTagPushed(deps, tag, releaseSha);
+  const tagPushSince = (deps.now ?? Date.now)();
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
   let checks;
   try {
-    checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+    checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
   } catch (e) {
     throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
   }
@@ -10637,11 +10699,12 @@ async function runTrainApplyPipeline(mode, input) {
     const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
     const tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
     const resumeNote = resume.tag ? resume.note : void 0;
-    await ensureTagPushed(deps, tag2, rcSha);
+    const tagPush = await ensureTagPushed(deps, tag2, rcSha);
+    const tagPushSince = (deps.now ?? Date.now)();
     const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
     let checks2;
     try {
-      checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+      checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
     } catch (e) {
       throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
     }
@@ -11343,9 +11406,11 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   await deps.run("git", ["merge-base", "--is-ancestor", mergedSha, "origin/main"]).catch(() => {
     throw new Error(`merged hotfix SHA ${mergedSha.slice(0, 7)} is not on origin/main \u2014 refusing to tag`);
   });
-  const tagNote = await ensureTagPushed(deps, tag, mergedSha);
+  const tagPush = await ensureTagPushed(deps, tag, mergedSha);
+  const tagPushSince = Date.now();
+  const tagNote = tagPush.note;
   const required = await discoverRequiredCheckContexts(deps, ctx, "main");
-  const checks = await waitForRequiredTrainChecks(deps, ctx, mergedSha, required);
+  const checks = await waitForRequiredTrainChecks(deps, ctx, mergedSha, required, tagPush.pushed ? tagPushSince : void 0);
   let releaseNote;
   let releaseExists = false;
   try {
@@ -13365,11 +13430,12 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
-var SECRET_CONSUMERS = ["runtime", "lambda", "actions", "agent", "box"];
+var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
+var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
 function parseSecretsCatalogVar(raw) {
   let parsed;
   try {
@@ -13433,6 +13499,21 @@ function parseRuntimeSecretsVar(raw) {
   }
   return out;
 }
+function parseBuildSecretsVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('project set: requiredBuildSecrets must be JSON, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]');
+  }
+  if (!Array.isArray(parsed)) {
+    throw new Error("project set: requiredBuildSecrets must be a flat array (build secrets are not stage-mapped)");
+  }
+  if (parsed.some((n) => typeof n !== "string" || !BUILD_SECRET_REF_RE.test(n) || n === "@github-packages-token")) {
+    throw new Error("project set: requiredBuildSecrets must be a flat array of ENVID=<ref> or bare <ref> strings");
+  }
+  return parsed;
+}
 function parseEdgeDomainsVar(raw) {
   let parsed;
   try {
@@ -13657,6 +13738,7 @@ var SETTABLE_VAR_KEYS = [
   "consumesDesignSystem",
   "requiredGcpApis",
   "requiredRuntimeSecrets",
+  "requiredBuildSecrets",
   "edgeDomains",
   "statusFieldId",
   "statusOptions",
@@ -13680,7 +13762,8 @@ var SETTABLE_VAR_HINTS = {
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
-  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 prefer --secrets-file",
+  requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
+  secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; clear with --unset secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
   priorityOptions: "JSON {Urgent,High,Medium,Low}\u2192id map",
@@ -13736,6 +13819,8 @@ function buildProjectSetPatch(input) {
       patch[key] = n;
     } else if (key === "requiredRuntimeSecrets") {
       patch[key] = parseRuntimeSecretsVar(raw);
+    } else if (key === "requiredBuildSecrets") {
+      patch[key] = parseBuildSecretsVar(raw);
     } else if (key === "secrets") {
       patch[key] = parseSecretsCatalogVar(raw);
     } else if (key === "edgeDomains") {
@@ -15715,59 +15800,6 @@ function buildInstalledPluginVersionCheck(input) {
     staleSurfaces: stale
   };
 }
-var MANAGED_PLUGINS = [
-  {
-    // Marketplace-qualified key exactly as installed_plugins.json stores it (same convention as
-    // MMI_PLUGIN_ID = 'mmi@mutmutco') — a bare 'jervaise-powertools' would never match a real record
-    // and the check would be a permanent no-op. The same `<marketplace>/<name>` segments also address its
-    // Cursor Team Marketplace cache dir (~/.cursor/plugins/cache/jervaise/jervaise-powertools/<version>/).
-    id: "jervaise-powertools@jervaise",
-    label: "jervaise-powertools",
-    healCommand: "jerv-cli doctor --apply",
-    opencodePackage: "@jervaise/opencode-jerv"
-  }
-];
-function parseManagedPluginId(id) {
-  const at = id.lastIndexOf("@");
-  if (at <= 0 || at === id.length - 1) return null;
-  return { name: id.slice(0, at), marketplace: id.slice(at + 1) };
-}
-var MANAGED_PLUGIN_DRIFT_LABEL = "managed org plugin version drift (cross-surface)";
-function managedPluginDriftFix(drifted) {
-  return drifted.map((d) => {
-    const versions = d.versions.map((v) => `${v.version} (${v.surface})`).join(" vs ");
-    return `${d.label} drift: ${versions} \u2192 run \`${d.healCommand}\``;
-  }).join(" ; ");
-}
-function buildManagedPluginDriftCheck(input) {
-  const base = { ok: true, label: MANAGED_PLUGIN_DRIFT_LABEL, fix: "" };
-  if (!input.isOrgRepo) return base;
-  const registry2 = input.plugins ?? MANAGED_PLUGINS;
-  const drifted = [];
-  const normalize = (v) => v.replace(/^v/, "");
-  for (const descriptor of registry2) {
-    const versions = [];
-    for (const source of input.sources) {
-      if (source.directVersions && descriptor.id in source.directVersions) {
-        const version2 = source.directVersions[descriptor.id];
-        if (isSemverVersion(version2)) versions.push({ surface: source.surface, version: normalize(version2) });
-        continue;
-      }
-      const records = source.installed?.plugins?.[descriptor.id];
-      if (!Array.isArray(records) || records.length === 0) continue;
-      const recordVersion = bestRecord(records).version;
-      const version = isSemverVersion(recordVersion) ? recordVersion : highestSemver(source.cacheVersions?.[descriptor.id] ?? []);
-      if (!isSemverVersion(version)) continue;
-      versions.push({ surface: source.surface, version: normalize(version) });
-    }
-    if (versions.length < 2) continue;
-    const distinctVersions = new Set(versions.map((v) => v.version));
-    if (distinctVersions.size < 2) continue;
-    drifted.push({ pluginId: descriptor.id, label: descriptor.label, healCommand: descriptor.healCommand, versions });
-  }
-  if (drifted.length === 0) return base;
-  return { ...base, ok: false, fix: managedPluginDriftFix(drifted), drifted };
-}
 var OPENCODE_VERSION_LABEL = "installed OpenCode MMI adapter version (vs latest release)";
 function buildOpencodeVersionCheck(input) {
   const fix = pluginRecoveryFix("opencode");
@@ -17235,77 +17267,6 @@ function installedPluginSources() {
     }
   });
 }
-function managedPluginSurfaceSources() {
-  const claudeCodex = installedPluginSources().map(({ surface, installed }) => {
-    const cacheVersions = {};
-    for (const descriptor of MANAGED_PLUGINS) {
-      const segments = parseManagedPluginId(descriptor.id);
-      if (!segments) continue;
-      try {
-        cacheVersions[descriptor.id] = (0, import_node_fs18.readdirSync)(
-          (0, import_node_path18.join)((0, import_node_os7.homedir)(), `.${surface}`, "plugins", "cache", segments.marketplace, segments.name),
-          { withFileTypes: true }
-        ).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-      } catch {
-      }
-    }
-    return { surface, installed, cacheVersions };
-  });
-  return [
-    ...claudeCodex,
-    { surface: "cursor", directVersions: managedPluginCursorDirectVersions() },
-    { surface: "opencode", directVersions: managedPluginOpencodeDirectVersions() }
-  ];
-}
-function managedPluginCursorDirectVersions() {
-  const out = {};
-  for (const descriptor of MANAGED_PLUGINS) {
-    const segments = parseManagedPluginId(descriptor.id);
-    if (!segments) continue;
-    try {
-      const versions = (0, import_node_fs18.readdirSync)(
-        (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cursor", "plugins", "cache", segments.marketplace, segments.name),
-        { withFileTypes: true }
-      ).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
-      out[descriptor.id] = highestSemver(versions);
-    } catch {
-    }
-  }
-  return out;
-}
-function managedPluginOpencodeDirectVersions() {
-  const out = {};
-  for (const descriptor of MANAGED_PLUGINS) {
-    if (!descriptor.opencodePackage) continue;
-    out[descriptor.id] = readOpencodePackageVersion(descriptor.opencodePackage);
-  }
-  return out;
-}
-function readOpencodePackageVersionFrom(packageJsonPath) {
-  try {
-    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function readOpencodePackageVersion(packageName) {
-  const [scope, name] = packageName.startsWith("@") ? packageName.slice(1).split("/", 2) : [void 0, packageName];
-  if (!name) return void 0;
-  const diskCandidates = [
-    (0, import_node_path18.join)(opencodeConfigDir(), "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"),
-    (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json")
-  ];
-  const diskVersion = diskCandidates.map(readOpencodePackageVersionFrom).find((v) => v !== void 0);
-  const packagesRoot = (0, import_node_path18.join)((0, import_node_os7.homedir)(), ".cache", "opencode", "packages", ...scope ? [`@${scope}`] : []);
-  let cacheVersion;
-  try {
-    const cacheVersions = (0, import_node_fs18.readdirSync)(packagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith(`${name}@`) && !e.name.startsWith(".")).map((e) => readOpencodePackageVersionFrom((0, import_node_path18.join)(packagesRoot, e.name, "node_modules", ...scope ? [`@${scope}`] : [], name, "package.json"))).filter((v) => Boolean(v));
-    if (cacheVersions.length) cacheVersion = cacheVersions.reduce((lowest, v) => compareVersions(v, lowest) < 0 ? v : lowest);
-  } catch {
-  }
-  return pickOpencodeActiveVersion({ cacheVersion, diskVersion });
-}
 function readClaudeSettings() {
   try {
     return JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path18.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
@@ -18192,7 +18153,6 @@ async function runDoctor(opts, io = consoleIo, readOrigin) {
     }
   }
   checks.push(installedVersionCheck);
-  checks.push(buildManagedPluginDriftCheck({ isOrgRepo, sources: managedPluginSurfaceSources() }));
   let openCodeConfigSnapshot = opencodeConfigSnapshot();
   const inspectOpenCode = surface === "opencode" || openCodeConfigSnapshot.hasConfig || runExtended;
   if (inspectOpenCode) {
@@ -19551,7 +19511,7 @@ project.command("attest [owner/repo]").description("attest this repo's app-owned
   const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
   return reportWrite("project attest", res);
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and set it as --var secrets (robust for large maps)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -20185,7 +20145,8 @@ pr.command("checks-wait <number>").description("bounded wait for PR checks; skip
   const result = await waitForPrChecks({
     resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
     pollChecks: () => pollGhPrChecks(number, repoArgs),
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    log: (message) => console.warn(message)
   });
   if (o.json) printLine(JSON.stringify(result));
   else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
@@ -20212,7 +20173,8 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
       pollChecks: () => pollGhPrChecks(prNumber, repo ? ["--repo", repo] : []),
-      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms))
+      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+      log: (message) => console.warn(message)
     }),
     // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
@@ -20423,6 +20385,12 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
+  const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo);
+  if (ciPolicy.policy === "no-ci") {
+    const guard = decidePrMergeNoCiGuard(await pollGhPrChecks(number, repoArgs), ciPolicy.reason);
+    if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
+    if (guard.note) console.warn(`pr merge: ${guard.note}`);
+  }
   const remoteBefore = await remoteBranchExists2(headRef);
   let remoteDeleteAttempted = false;
   let remoteNotAttemptedReason;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.6.0",
+  "version": "3.8.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",