@mutmutco/cli 3.65.0 → 3.67.0

package/dist/main.cjs

@@ -6128,6 +6128,32 @@ var DEFAULT_SURFACE = "claude";
 function activityLogPath(cwd) {
   return repoRuntimeStatePath(cwd, "hooks", "activity.jsonl");
 }
+var REDACTOR_WINDOW_MS = 48 * 60 * 60 * 1e3;
+var REDACTOR_SCAN_BYTES = 512 * 1024;
+function redactorLivenessProbe(cwd, now = /* @__PURE__ */ new Date()) {
+  try {
+    const raw = (0, import_node_fs10.readFileSync)(activityLogPath(cwd), "utf8");
+    const tail = raw.length > REDACTOR_SCAN_BYTES ? raw.slice(raw.length - REDACTOR_SCAN_BYTES) : raw;
+    const floor = now.getTime() - REDACTOR_WINDOW_MS;
+    let failed = 0;
+    let lastTs;
+    for (const line of tail.split("\n")) {
+      if (!line.includes('"secret-redact"') || !line.includes('"failed"')) continue;
+      try {
+        const row = JSON.parse(line);
+        if (row.script !== "secret-redact" || row.outcome !== "failed") continue;
+        const ts = row.ts ? Date.parse(row.ts) : Number.NaN;
+        if (Number.isNaN(ts) || ts < floor) continue;
+        failed += 1;
+        if (!lastTs || row.ts > lastTs) lastTs = row.ts;
+      } catch {
+      }
+    }
+    return { failed, ...lastTs ? { lastTs } : {} };
+  } catch {
+    return void 0;
+  }
+}
 function appendHookActivity(cwd, entry) {
   try {
     const path2 = activityLogPath(cwd);
@@ -16397,7 +16423,17 @@ var import_node_path17 = require("node:path");
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
+var REC = "";
+var FLD = "";
+var WAIVABLE_KINDS = [
+  "mandatory-zone-untested",
+  "unrequested-test-file",
+  "protected-removed",
+  "stale-protected-entry",
+  "stale-satisfied-by"
+];
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -16523,6 +16559,89 @@ function resolveBase(cwd, explicit) {
   }
   return null;
 }
+function isShallowRepository(cwd) {
+  try {
+    return git(["rev-parse", "--is-shallow-repository"], cwd).trim() !== "false";
+  } catch {
+    return true;
+  }
+}
+function untrustworthyRange(cwd, base) {
+  if (!base) {
+    return {
+      kind: "unresolvable-base",
+      paths: [],
+      detail: "NO COMPARISON BASE \u2014 none of --base, TEST_POLICY_BASE, origin/development or origin/main resolved.\n  With no base there is no change set, and a gate that cannot see the change set has nothing it\n  can honestly pass. Fetch the default branch, or name the base with --base / TEST_POLICY_BASE."
+    };
+  }
+  if (!isShallowRepository(cwd)) return null;
+  return {
+    kind: "untrusted-range",
+    paths: [],
+    detail: `UNTRUSTWORTHY RANGE \u2014 this clone is SHALLOW, so ${base.slice(0, 8)}..HEAD is not the change set.
+  A grafted commit has no visible parents, so excluding the base excludes the base ALONE and the
+  range silently widens to everything reachable from HEAD. Measured in the fleet (#3628): an
+  earlier CI step ran \`git fetch --depth=1\`, and a Test-Policy-Override trailer from a commit
+  merged the previous day then passed every PR green. A gate that cannot identify the change set
+  must not evaluate one, and must never waive one.
+  Fetch full history \u2014 actions/checkout with \`fetch-depth: 0\`, or \`git fetch --unshallow\`.`
+  };
+}
+function parseScope(value) {
+  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
+  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
+  const named = scoped[1].split(",").map((k) => k.trim()).filter(Boolean);
+  return {
+    kinds: named,
+    reason: scoped[2].trim(),
+    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k))
+  };
+}
+function invisibleTrailer(sha, line) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
+    ${line}
+  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
+  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
+  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
+  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
+  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
+  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.`
+  };
+}
+function unknownScope(sha, unknown) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `UNKNOWN OVERRIDE SCOPE \u2014 commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(", ")}, which this
+  gate cannot report.
+  Waivable kinds: ${WAIVABLE_KINDS.join(", ")}.
+  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns
+  into a blanket exemption without anyone deciding it should.`
+  };
+}
+function readOverride(base, cwd) {
+  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
+  const refusals = [];
+  let override = null;
+  for (const record of git(["log", `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
+    const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
+    if (!sha) continue;
+    const value = (trailer ?? "").trim();
+    if (!value) {
+      const shaped = OVERRIDE_RE.exec(body ?? "");
+      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
+      continue;
+    }
+    if (override) continue;
+    const { kinds, reason, unknown } = parseScope(value);
+    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
+    else override = { sha, reason, kinds };
+  }
+  return { override, refusals };
+}
 function changedFilesSince(base, cwd) {
   const raw = git(["diff", "--name-status", "-M", `${base}...HEAD`], cwd).trim();
   if (!raw) return [];
@@ -16539,9 +16658,9 @@ function runTestPolicy(root, deps = {}) {
   const exists = deps.exists ?? ((path2) => (0, import_node_fs19.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
-  const changed = deps.changed ?? (base ? changedFilesSince(base, root) : []);
-  const override = deps.overrideReason !== void 0 ? deps.overrideReason : !deps.changed && base ? OVERRIDE_RE.exec(git(["log", `${base}..HEAD`, "--format=%B"], root))?.[1]?.trim() ?? null : null;
-  if (override) return { ok: true, findings: [], changedCount: changed.length, base, overriddenBy: override, ...counts };
+  const refusal = deps.changed ? null : untrustworthyRange(root, base);
+  const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
+  const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
   const present = (path2) => exists((0, import_node_path17.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
@@ -16563,13 +16682,20 @@ function runTestPolicy(root, deps = {}) {
 ` + staleSatisfiers.map((p) => `    ${p}`).join("\n") + "\n  A glob discharged by coverage that is not there is a glob enforcing nothing, quietly.\n  Restore the file, or drop it from satisfiedBy so the glob asks for a test again."
     });
   }
-  if (staleFindings.length > 0) {
-    return { ok: false, base, changedCount: changed.length, ...counts, findings: staleFindings };
+  const override = lookup.override;
+  const waived = [];
+  const sift = (found) => {
+    waived.push(...found.filter((f) => override?.kinds.includes(f.kind)));
+    return found.filter((f) => !override?.kinds.includes(f.kind));
+  };
+  const blocking = sift([...refusal ? [refusal] : [], ...lookup.refusals, ...staleFindings]);
+  const findings = blocking.length > 0 ? blocking : sift(evaluate(changed, policy, present));
+  const result = { ok: findings.length === 0, findings, changedCount: changed.length, base, ...counts };
+  if (override) {
+    result.overriddenBy = override;
+    result.waived = waived;
   }
-  if (!deps.changed && !base) return { ok: true, findings: [], changedCount: 0, base: null, ...counts };
-  if (changed.length === 0) return { ok: true, findings: [], changedCount: 0, base, ...counts };
-  const findings = evaluate(changed, policy, present);
-  return { ok: findings.length === 0, findings, changedCount: changed.length, base, ...counts };
+  return result;
 }
 
 // src/docs-audit-command.ts
@@ -24942,6 +25068,22 @@ function checkDocsAudit(probe) {
   }
   return { ok: true, id: "docs-audit", label: "docs-audit", detail: probe.detail, verbose: [probe.detail] };
 }
+function checkRedactorLiveness(probe) {
+  if (!probe) return null;
+  const evidence = [`secret-redact failed rows in the last 48h: ${probe.failed}${probe.lastTs ? ` (last ${probe.lastTs})` : ""}`];
+  if (probe.failed === 0) {
+    return { ok: true, id: "redactor-liveness", label: "secret-redact liveness", verbose: evidence };
+  }
+  return {
+    ok: false,
+    id: "redactor-liveness",
+    label: "secret-redact liveness",
+    reportOnly: true,
+    detail: `${probe.failed} crash marker${probe.failed === 1 ? "" : "s"} in 48h`,
+    fix: "the redactor is crashing during scans \u2014 read `.git/mmi-runtime/hooks/activity.jsonl` for the error and fix it; every crash is a scan that never ran",
+    verbose: evidence
+  };
+}
 function checkSessionPayload(probe) {
   if (!probe) return null;
   const { chars } = probe;
@@ -25119,6 +25261,10 @@ async function runDoctorClean(opts, io, deps) {
     const sched = checkSchedules(probe);
     if (sched) checks.push(sched);
   }
+  if (!opts.fast && !opts.banner && !opts.preflight && deps.redactorLiveness) {
+    const redactor = checkRedactorLiveness(deps.redactorLiveness());
+    if (redactor) checks.push(redactor);
+  }
   if (!opts.fast && !opts.banner && !opts.preflight && deps.docsAudit) {
     const probe = await deps.docsAudit().catch((e) => ({
       armed: true,
@@ -25559,6 +25705,9 @@ function mmiDoctorDeps(opts = {}) {
     // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
     // A local record read — cheap enough for every lane, including the banner.
     sessionPayload: () => readSessionPayload(process.cwd()),
+    // #3630: recent secret-redact crash markers from the shared hook-activity trace — with the Stop
+    // hook retired, the full/scheduled doctor is the trace's only reader. Local tail-scan, fail-soft.
+    redactorLiveness: () => redactorLivenessProbe(process.cwd()),
     // #3485 items 9 and 8: why the MMI plugin has never printed an "updated — please restart" notice, and
     // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
     marketplaceRows: () => {
@@ -26255,12 +26404,10 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
       if (!result.ok) process.exitCode = 1;
       return;
     }
-    if (result.base === null && result.ok) {
-      console.log("tests policy: no comparison base (origin/development or origin/main) \u2014 skipping.");
-      return;
-    }
-    if (result.overriddenBy) {
-      console.log(`tests policy: overridden by commit trailer \u2014 ${result.overriddenBy}`);
+    if (result.overriddenBy && result.ok) {
+      const { sha, reason, kinds } = result.overriddenBy;
+      const scope = (result.waived ?? []).map((f) => f.kind).join(", ") || "nothing";
+      console.log(`tests policy: overridden by ${sha.slice(0, 8)} (waiving ${scope}; scope ${kinds.join(", ")}) \u2014 ${reason}`);
       return;
     }
     if (result.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.65.0",
+  "version": "3.67.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",