@mutmutco/cli 3.64.0 → 3.66.0

package/dist/main.cjs

@@ -5165,16 +5165,20 @@ function validateDeadWorktreeDirContent(planned, inspected) {
   return { ok: false, reason: "unknown dead worktree cleanup kind" };
 }
 function validateBranchCleanupHead(planned, currentHeads) {
+  const currentHeadOid = currentHeads.find((h) => h.branch === planned.branch)?.oid;
+  if (planned.containedInBase && planned.plannedHeadOid) {
+    if (!currentHeadOid) return { ok: false, reason: "local branch head could not be read" };
+    return currentHeadOid === planned.plannedHeadOid ? { ok: true } : { ok: false, reason: `branch moved since planning (${currentHeadOid} != ${planned.plannedHeadOid})` };
+  }
   const reviewedHeadOids = planned.reviewedHeadOids?.filter(Boolean) ?? [];
   if (!reviewedHeadOids.length) {
     return { ok: false, reason: "planned branch head was not verified against a PR head" };
   }
-  const currentHead = currentHeads.find((h) => h.branch === planned.branch)?.oid;
-  if (!currentHead) {
+  if (!currentHeadOid) {
     return { ok: false, reason: "local branch head could not be verified against the PR head" };
   }
-  if (!reviewedHeadOids.includes(currentHead)) {
-    return { ok: false, reason: `${currentHead} != ${reviewedHeadOids.join("|")}` };
+  if (!reviewedHeadOids.includes(currentHeadOid)) {
+    return { ok: false, reason: `${currentHeadOid} != ${reviewedHeadOids.join("|")}` };
   }
   return { ok: true };
 }
@@ -5274,6 +5278,7 @@ function buildGcPlan(inputs) {
   const unpushedWorktrees = new Set((inputs.worktrees ?? []).filter((w) => w.unpushed).map((w) => w.branch));
   const preservedBranches2 = new Set(inputs.preservedBranches ?? []);
   const preservedWorktrees = new Set((inputs.worktrees ?? []).filter((w) => w.preserved).map((w) => w.branch));
+  const mergedIntoBase = new Set((inputs.mergedIntoBase ?? []).map((b) => b.trim()).filter(Boolean));
   const skipped = [];
   const branches = [];
   const skipTrackingBranches = /* @__PURE__ */ new Set();
@@ -5313,7 +5318,8 @@ function buildGcPlan(inputs) {
       continue;
     }
     const localHead = branchHeads?.get(branch);
-    if (worktree2?.unpushed || branchHeads && (!localHead || !state.headOids.length || !state.headOids.includes(localHead))) {
+    const containedInBase = mergedIntoBase.has(branch);
+    if (!containedInBase && (worktree2?.unpushed || branchHeads && (!localHead || !state.headOids.length || !state.headOids.includes(localHead)))) {
       const detail = worktree2?.unpushed ? worktree2.path : localHead && state.headOids.length ? `${localHead} != ${state.headOids.join("|")}` : "local branch head could not be verified against the PR head";
       skipped.push({ branch, reason: "unpushed-branch", detail });
       skipTrackingBranches.add(branch);
@@ -5324,7 +5330,8 @@ function buildGcPlan(inputs) {
       prState: state.state,
       prNumbers: state.numbers,
       worktreePath: worktree2?.path,
-      ...state.headOids.length ? { reviewedHeadOids: state.headOids } : {}
+      ...state.headOids.length ? { reviewedHeadOids: state.headOids } : {},
+      ...containedInBase ? { containedInBase: true, ...localHead ? { plannedHeadOid: localHead } : {} } : {}
     });
   }
   const trackingRefs = [...new Set(inputs.staleTrackingRefs ?? [])].map((ref) => {
@@ -6121,6 +6128,32 @@ var DEFAULT_SURFACE = "claude";
 function activityLogPath(cwd) {
   return repoRuntimeStatePath(cwd, "hooks", "activity.jsonl");
 }
+var REDACTOR_WINDOW_MS = 48 * 60 * 60 * 1e3;
+var REDACTOR_SCAN_BYTES = 512 * 1024;
+function redactorLivenessProbe(cwd, now = /* @__PURE__ */ new Date()) {
+  try {
+    const raw = (0, import_node_fs10.readFileSync)(activityLogPath(cwd), "utf8");
+    const tail = raw.length > REDACTOR_SCAN_BYTES ? raw.slice(raw.length - REDACTOR_SCAN_BYTES) : raw;
+    const floor = now.getTime() - REDACTOR_WINDOW_MS;
+    let failed = 0;
+    let lastTs;
+    for (const line of tail.split("\n")) {
+      if (!line.includes('"secret-redact"') || !line.includes('"failed"')) continue;
+      try {
+        const row = JSON.parse(line);
+        if (row.script !== "secret-redact" || row.outcome !== "failed") continue;
+        const ts = row.ts ? Date.parse(row.ts) : Number.NaN;
+        if (Number.isNaN(ts) || ts < floor) continue;
+        failed += 1;
+        if (!lastTs || row.ts > lastTs) lastTs = row.ts;
+      } catch {
+      }
+    }
+    return { failed, ...lastTs ? { lastTs } : {} };
+  } catch {
+    return void 0;
+  }
+}
 function appendHookActivity(cwd, entry) {
   try {
     const path2 = activityLogPath(cwd);
@@ -10811,7 +10844,7 @@ function resolveExplicitScanRoot(explicitRoot, repoRoot2) {
   return explicitRepoWorktreesRoot(explicitRoot, repoRoot2, rootDirs);
 }
 async function gcPlan(remote, limit, opts = {}) {
-  const [branches, heads, current, stale, prs, worktrees, siblingDirs, preserved] = await Promise.all([
+  const [branches, heads, current, stale, prs, worktrees, siblingDirs, preserved, mergedIntoBase] = await Promise.all([
     gitOut(["branch", "--format=%(refname:short)"]),
     localBranchHeads(),
     gitOut(["rev-parse", "--abbrev-ref", "HEAD"]),
@@ -10821,7 +10854,8 @@ async function gcPlan(remote, limit, opts = {}) {
     ghPrs(limit),
     worktreeBranches(),
     siblingWorktreeDirs(opts.root),
-    preservedBranches()
+    preservedBranches(),
+    branchesMergedIntoBase(remote)
   ]);
   return buildGcPlan({
     localBranches: branches.split(/\r?\n/).map((b) => b.trim()).filter(Boolean),
@@ -10832,9 +10866,23 @@ async function gcPlan(remote, limit, opts = {}) {
     pullRequests: prs,
     worktrees,
     remote,
-    preservedBranches: preserved
+    preservedBranches: preserved,
+    mergedIntoBase
   });
 }
+async function branchesMergedIntoBase(remote) {
+  const out = /* @__PURE__ */ new Set();
+  for (const base of ["development", "main", "master"]) {
+    let listed;
+    try {
+      listed = await gitOut(["branch", "--merged", `${remote}/${base}`, "--format=%(refname:short)"]);
+    } catch {
+      continue;
+    }
+    for (const b of listed.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) out.add(b);
+  }
+  return [...out];
+}
 var STRAY_ROOT_WALK_BUDGET_MS = 4e3;
 function measureWorktreeRoot(root, deadline) {
   let dirs = 0;
@@ -16375,7 +16423,17 @@ var import_node_path17 = require("node:path");
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
+var REC = "";
+var FLD = "";
+var WAIVABLE_KINDS = [
+  "mandatory-zone-untested",
+  "unrequested-test-file",
+  "protected-removed",
+  "stale-protected-entry",
+  "stale-satisfied-by"
+];
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -16429,20 +16487,37 @@ function readFileOrNull2(path2) {
     return null;
   }
 }
-function classify(changed, policy) {
+function removedPaths(changed) {
+  return new Set(
+    changed.map((f) => f.status === "D" ? f.path : f.status === "R" || f.status === "C" ? f.from : void 0).filter((p) => typeof p === "string")
+  );
+}
+function classify(changed, policy, present = () => false) {
   const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp(m.glob) }));
   const mandatoryHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path)));
   const testChanges = changed.filter((f) => isTestPath(f.path));
   const addedTests = testChanges.filter((f) => f.status === "A");
+  const removed = removedPaths(changed);
+  const discharged = (m) => (m.satisfiedBy?.length ?? 0) > 0 && m.satisfiedBy.every((p) => present(p) && !removed.has(p));
+  const untestedHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path) && !discharged(m)));
   const protectedBy = new Map((policy.protected ?? []).map((p) => [p.path, p.why ?? ""]));
-  const removedProtected = changed.map((f) => f.status === "D" ? f.path : f.status === "R" || f.status === "C" ? f.from : void 0).filter((p) => typeof p === "string" && protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
-  return { mandatoryHits, testChanges, addedTests, removedProtected };
+  for (const m of policy.mandatory ?? []) {
+    for (const p of m.satisfiedBy ?? []) {
+      if (!protectedBy.has(p)) protectedBy.set(p, `the standing coverage \`${m.glob}\` is discharged by. Removing it silently empties that glob.`);
+    }
+  }
+  const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
+  return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
 }
 function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs19.existsSync)(path2)) {
   return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path17.join)(root, p)));
 }
-function evaluate(changed, policy) {
-  const { mandatoryHits, testChanges, addedTests, removedProtected } = classify(changed, policy);
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs19.existsSync)(path2)) {
+  const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path17.join)(root, p)));
+}
+function evaluate(changed, policy, present = () => false) {
+  const { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected } = classify(changed, policy, present);
   const findings = [];
   if (removedProtected.length > 0) {
     findings.push({
@@ -16453,12 +16528,12 @@ function evaluate(changed, policy) {
       ${f.why}`).join("\n") + "\n  If you are removing one because it looked unrequired, read the reason above first \u2014 it is\n  the answer to exactly that question. If this removal was asked for, add a commit trailer:\n  Test-Policy-Override: <reason>"
     });
   }
-  if (mandatoryHits.length > 0 && testChanges.length === 0) {
+  if (untestedHits.length > 0 && testChanges.length === 0) {
     findings.push({
       kind: "mandatory-zone-untested",
-      paths: mandatoryHits.map((f) => f.path),
-      detail: `MANDATORY ZONE UNTESTED \u2014 this change touches ${mandatoryHits.length} path(s) in the mandatory zone but changes no test:
-` + mandatoryHits.map((f) => `    ${f.path}`).join("\n") + "\n  These are the paths where a silent failure costs real money, real data, a security breach,\n  or production. Add or update a test that would fail if the guarded property broke."
+      paths: untestedHits.map((f) => f.path),
+      detail: `MANDATORY ZONE UNTESTED \u2014 this change touches ${untestedHits.length} path(s) in the mandatory zone but changes no test:
+` + untestedHits.map((f) => `    ${f.path}`).join("\n") + "\n  These are the paths where a silent failure costs real money, real data, a security breach,\n  or production. Add or update a test that would fail if the guarded property broke."
     });
   }
   if (policy.declared !== false && addedTests.length > 0 && mandatoryHits.length === 0) {
@@ -16484,6 +16559,89 @@ function resolveBase(cwd, explicit) {
   }
   return null;
 }
+function isShallowRepository(cwd) {
+  try {
+    return git(["rev-parse", "--is-shallow-repository"], cwd).trim() !== "false";
+  } catch {
+    return true;
+  }
+}
+function untrustworthyRange(cwd, base) {
+  if (!base) {
+    return {
+      kind: "unresolvable-base",
+      paths: [],
+      detail: "NO COMPARISON BASE \u2014 none of --base, TEST_POLICY_BASE, origin/development or origin/main resolved.\n  With no base there is no change set, and a gate that cannot see the change set has nothing it\n  can honestly pass. Fetch the default branch, or name the base with --base / TEST_POLICY_BASE."
+    };
+  }
+  if (!isShallowRepository(cwd)) return null;
+  return {
+    kind: "untrusted-range",
+    paths: [],
+    detail: `UNTRUSTWORTHY RANGE \u2014 this clone is SHALLOW, so ${base.slice(0, 8)}..HEAD is not the change set.
+  A grafted commit has no visible parents, so excluding the base excludes the base ALONE and the
+  range silently widens to everything reachable from HEAD. Measured in the fleet (#3628): an
+  earlier CI step ran \`git fetch --depth=1\`, and a Test-Policy-Override trailer from a commit
+  merged the previous day then passed every PR green. A gate that cannot identify the change set
+  must not evaluate one, and must never waive one.
+  Fetch full history \u2014 actions/checkout with \`fetch-depth: 0\`, or \`git fetch --unshallow\`.`
+  };
+}
+function parseScope(value) {
+  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
+  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
+  const named = scoped[1].split(",").map((k) => k.trim()).filter(Boolean);
+  return {
+    kinds: named,
+    reason: scoped[2].trim(),
+    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k))
+  };
+}
+function invisibleTrailer(sha, line) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
+    ${line}
+  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
+  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
+  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
+  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
+  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
+  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.`
+  };
+}
+function unknownScope(sha, unknown) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `UNKNOWN OVERRIDE SCOPE \u2014 commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(", ")}, which this
+  gate cannot report.
+  Waivable kinds: ${WAIVABLE_KINDS.join(", ")}.
+  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns
+  into a blanket exemption without anyone deciding it should.`
+  };
+}
+function readOverride(base, cwd) {
+  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
+  const refusals = [];
+  let override = null;
+  for (const record of git(["log", `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
+    const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
+    if (!sha) continue;
+    const value = (trailer ?? "").trim();
+    if (!value) {
+      const shaped = OVERRIDE_RE.exec(body ?? "");
+      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
+      continue;
+    }
+    if (override) continue;
+    const { kinds, reason, unknown } = parseScope(value);
+    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
+    else override = { sha, reason, kinds };
+  }
+  return { override, refusals };
+}
 function changedFilesSince(base, cwd) {
   const raw = git(["diff", "--name-status", "-M", `${base}...HEAD`], cwd).trim();
   if (!raw) return [];
@@ -16499,29 +16657,45 @@ function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
   const exists = deps.exists ?? ((path2) => (0, import_node_fs19.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
-  const unresolved = unresolvedProtectedEntries(policy, root, exists);
+  const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
+  const refusal = deps.changed ? null : untrustworthyRange(root, base);
+  const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
+  const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
+  const present = (path2) => exists((0, import_node_path17.join)(root, path2));
+  const removedByThisDiff = removedPaths(changed);
+  const staleFindings = [];
+  const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
   if (unresolved.length > 0) {
-    return {
-      ok: false,
-      base: null,
-      changedCount: 0,
-      ...counts,
-      findings: [{
-        kind: "stale-protected-entry",
-        paths: unresolved,
-        detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist:
+    staleFindings.push({
+      kind: "stale-protected-entry",
+      paths: unresolved,
+      detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist:
 ` + unresolved.map((p) => `    ${p}`).join("\n") + "\n  An entry naming a missing file reads as protection while protecting nothing.\n  Restore the file, or remove its entry."
-      }]
-    };
+    });
   }
-  const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
-  if (!deps.changed && !base) return { ok: true, findings: [], changedCount: 0, base: null, ...counts };
-  const changed = deps.changed ?? changedFilesSince(base, root);
-  if (changed.length === 0) return { ok: true, findings: [], changedCount: 0, base, ...counts };
-  const override = deps.overrideReason !== void 0 ? deps.overrideReason : OVERRIDE_RE.exec(git(["log", `${base}..HEAD`, "--format=%B"], root))?.[1]?.trim() ?? null;
-  if (override) return { ok: true, findings: [], changedCount: changed.length, base, overriddenBy: override, ...counts };
-  const findings = evaluate(changed, policy);
-  return { ok: findings.length === 0, findings, changedCount: changed.length, base, ...counts };
+  const staleSatisfiers = unresolvedSatisfiers(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
+  if (staleSatisfiers.length > 0) {
+    staleFindings.push({
+      kind: "stale-satisfied-by",
+      paths: staleSatisfiers,
+      detail: `STALE STANDING COVERAGE \u2014 a mandatory glob claims ${staleSatisfiers.length} path(s) as satisfiedBy that do not exist:
+` + staleSatisfiers.map((p) => `    ${p}`).join("\n") + "\n  A glob discharged by coverage that is not there is a glob enforcing nothing, quietly.\n  Restore the file, or drop it from satisfiedBy so the glob asks for a test again."
+    });
+  }
+  const override = lookup.override;
+  const waived = [];
+  const sift = (found) => {
+    waived.push(...found.filter((f) => override?.kinds.includes(f.kind)));
+    return found.filter((f) => !override?.kinds.includes(f.kind));
+  };
+  const blocking = sift([...refusal ? [refusal] : [], ...lookup.refusals, ...staleFindings]);
+  const findings = blocking.length > 0 ? blocking : sift(evaluate(changed, policy, present));
+  const result = { ok: findings.length === 0, findings, changedCount: changed.length, base, ...counts };
+  if (override) {
+    result.overriddenBy = override;
+    result.waived = waived;
+  }
+  return result;
 }
 
 // src/docs-audit-command.ts
@@ -21875,7 +22049,18 @@ function recordGcWorktreeRemoval(primaryRoot, actor, owners, path2, branch) {
   });
   dropWorktreeOwner(primaryRoot, path2);
 }
-function renderGcApplyResult(result) {
+function renderPrLandCleanupLines(cleanup) {
+  const report = cleanup;
+  const wt = report?.worktree;
+  if (!wt?.path) return [];
+  const lines = [];
+  if (wt.status === "removed") lines.push(`pr land: removed worktree ${wt.path} \u2014 that directory is gone; cd elsewhere before your next command`);
+  else if (wt.status === "deferred") lines.push(`pr land: worktree ${wt.path} could not be removed yet and is registered for a later sweep`);
+  else lines.push(`pr land: worktree ${wt.path} \u2014 ${wt.status ?? "unknown"}${wt.reason ? ` (${wt.reason})` : ""}`);
+  if (wt.deferredNote) lines.push(`pr land: ${wt.deferredNote}`);
+  return lines;
+}
+function renderGcApplyResult(result, skipped = []) {
   const lines = ["worktree gc apply result:"];
   lines.push(`  branches removed: ${result.removedBranches.length ? result.removedBranches.join(", ") : "none"}`);
   lines.push(`  remote branches removed: ${result.removedRemoteBranches.length ? result.removedRemoteBranches.join(", ") : "none"}`);
@@ -21892,9 +22077,15 @@ function renderGcApplyResult(result) {
   }
   const removedNothing = result.removedBranches.length === 0 && result.removedRemoteBranches.length === 0 && result.removedTrackingRefs.length === 0 && result.removedWorktreeDirs.length === 0;
   if (removedNothing && !result.refused.length) {
-    lines.push("  NOTHING WAS REMOVED. A stale worktree whose directory still exists is not reachable by");
-    lines.push("  this verb \u2014 remove it from inside it with `mmi-cli worktree land --apply`, or delete the");
-    lines.push("  directory and re-run to clear its registration.");
+    const actionable = skipped.filter((s) => s.reason !== "protected" && s.reason !== "current-branch");
+    if (actionable.length) {
+      lines.push(`  NOTHING WAS REMOVED \u2014 every candidate was skipped for a stated reason (${actionable.length}):`);
+      for (const s of actionable) lines.push(`    - ${s.branch}: ${s.reason}${s.detail ? ` (${s.detail})` : ""}`);
+    } else {
+      lines.push("  NOTHING WAS REMOVED. A stale worktree whose directory still exists is not reachable by");
+      lines.push("  this verb \u2014 remove it from inside it with `mmi-cli worktree land --apply`, or delete the");
+      lines.push("  directory and re-run to clear its registration.");
+    }
   }
   return lines.join("\n");
 }
@@ -24877,6 +25068,22 @@ function checkDocsAudit(probe) {
   }
   return { ok: true, id: "docs-audit", label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
 }
+function checkRedactorLiveness(probe) {
+  if (!probe) return null;
+  const evidence = [`secret-redact failed rows in the last 48h: ${probe.failed}${probe.lastTs ? ` (last ${probe.lastTs})` : ""}`];
+  if (probe.failed === 0) {
+    return { ok: true, id: "redactor-liveness", label: "secret-redact liveness", verbose: evidence };
+  }
+  return {
+    ok: false,
+    id: "redactor-liveness",
+    label: "secret-redact liveness",
+    reportOnly: true,
+    detail: `${probe.failed} crash marker${probe.failed === 1 ? "" : "s"} in 48h`,
+    fix: "the redactor is crashing during scans \u2014 read `.git/mmi-runtime/hooks/activity.jsonl` for the error and fix it; every crash is a scan that never ran",
+    verbose: evidence
+  };
+}
 function checkSessionPayload(probe) {
   if (!probe) return null;
   const { chars } = probe;
@@ -25054,6 +25261,10 @@ async function runDoctorClean(opts, io, deps) {
     const sched = checkSchedules(probe);
     if (sched) checks.push(sched);
   }
+  if (!opts.fast && !opts.banner && !opts.preflight && deps.redactorLiveness) {
+    const redactor = checkRedactorLiveness(deps.redactorLiveness());
+    if (redactor) checks.push(redactor);
+  }
   if (!opts.fast && !opts.banner && !opts.preflight && deps.docsAudit) {
     const probe = await deps.docsAudit().catch((e) => ({
       armed: true,
@@ -25494,6 +25705,9 @@ function mmiDoctorDeps(opts = {}) {
     // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
     // A local record read — cheap enough for every lane, including the banner.
     sessionPayload: () => readSessionPayload(process.cwd()),
+    // #3630: recent secret-redact crash markers from the shared hook-activity trace — with the Stop
+    // hook retired, the full/scheduled doctor is the trace's only reader. Local tail-scan, fail-soft.
+    redactorLiveness: () => redactorLivenessProbe(process.cwd()),
     // #3485 items 9 and 8: why the MMI plugin has never printed an "updated — please restart" notice, and
     // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
     marketplaceRows: () => {
@@ -25848,7 +26062,7 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
       console.log(formatGcPlan(plan, false));
     } else {
       if (applyResult) console.log(`
-${renderGcApplyResult(applyResult)}`);
+${renderGcApplyResult(applyResult, plan.skipped)}`);
     }
     if (applyResult?.failed.length) process.exitCode = 1;
   } catch (e) {
@@ -26190,12 +26404,10 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
       if (!result.ok) process.exitCode = 1;
       return;
     }
-    if (result.base === null && result.ok) {
-      console.log("tests policy: no comparison base (origin/development or origin/main) \u2014 skipping.");
-      return;
-    }
-    if (result.overriddenBy) {
-      console.log(`tests policy: overridden by commit trailer \u2014 ${result.overriddenBy}`);
+    if (result.overriddenBy && result.ok) {
+      const { sha, reason, kinds } = result.overriddenBy;
+      const scope = (result.waived ?? []).map((f) => f.kind).join(", ") || "nothing";
+      console.log(`tests policy: overridden by ${sha.slice(0, 8)} (waiving ${scope}; scope ${kinds.join(", ")}) \u2014 ${reason}`);
       return;
     }
     if (result.ok) {
@@ -27268,6 +27480,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   if (o.json) printLine(JSON.stringify(result));
   else {
     printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
+    for (const line of renderPrLandCleanupLines(result.cleanup)) printLine(line);
     if (result.cleanupError) printLine(`pr land cleanup: ${result.cleanupError}`);
   }
   if (result.status === "failed" || result.cleanupError) process.exitCode = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.64.0",
+  "version": "3.66.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",