@mutmutco/cli 3.68.0 → 3.70.0

package/dist/main.cjs

@@ -33,9 +33,11 @@ __export(index_exports, {
   DEFAULT_PRIORITY: () => DEFAULT_PRIORITY,
   awsCallerArn: () => awsCallerArn,
   classifyParseError: () => classifyParseError,
+  commandOwnLongFlags: () => commandOwnLongFlags,
   envHealLockPath: () => envHealLockPath,
   gcPlan: () => gcPlan,
   isOrgRegisteredRepo: () => isOrgRegisteredRepo,
+  positionalTargetForm: () => positionalTargetForm,
   registryClientDeps: () => registryClientDeps,
   repoSlug: () => repoSlug,
   shouldMarkWorktreeActivity: () => shouldMarkWorktreeActivity,
@@ -5003,6 +5005,7 @@ function buildPrMergeResultPayload(input) {
 function buildPrMergeArgs(input) {
   const args = ["pr", "merge", input.number, ...input.repoArgs, input.method];
   if (input.deleteBranch !== false) args.push("--delete-branch");
+  if (input.bodyFile) args.push("--body-file", input.bodyFile);
   if (input.auto) args.push("--auto");
   return args;
 }
@@ -7235,7 +7238,7 @@ function checkGateBudget(files, opts = {}) {
 }
 
 // src/project-model.ts
-var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "non-deployable", "cli-tool", "worker"];
+var PROJECT_TYPES = ["web-app", "hub-service", "content", "desktop-app", "desktop-game", "mobile-app", "non-deployable", "cli-tool", "worker"];
 var DEPLOY_MODELS = ["hub-serverless", "serverless", "tenant-container", "solo-container", "registry-publish", "content", "none"];
 var RELEASE_TRACKS = ["full", "direct", "trunk"];
 var PROJECT_TYPE_SET = new Set(PROJECT_TYPES);
@@ -7272,7 +7275,7 @@ function resolveDeployModel(meta, repo) {
   const projectType = resolveProjectType(meta, repo);
   if (projectType === "content" || meta?.class === "content") return "content";
   if (projectType === "hub-service" || repoIsHub(repo)) return "hub-serverless";
-  if (projectType === "desktop-app" || projectType === "desktop-game" || projectType === "non-deployable") return "none";
+  if (projectType === "desktop-app" || projectType === "desktop-game" || projectType === "mobile-app" || projectType === "non-deployable") return "none";
   if (projectType === "cli-tool") return "registry-publish";
   return "tenant-container";
 }
@@ -7751,7 +7754,13 @@ function collectRegistryRepos(projects) {
   if (![...seen].some((r) => r.toLowerCase() === HUB_REPO.toLowerCase())) seen.add(HUB_REPO);
   return [...seen].sort((a, b) => a.localeCompare(b));
 }
-async function resolveRepoMergeCiPolicy(repo, deps) {
+async function prTriggeredWorkflowsOnRef(deps, repo, branch, repoClass) {
+  const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, branch, PRODUCT_GATE_PATH);
+  const workflowPaths = repoClass === "hub" ? [".github/workflows/gate.yml"] : hasGate ? [PRODUCT_GATE_PATH] : await listWorkflowPaths(deps, repo, branch);
+  if (workflowPaths === void 0) return void 0;
+  return filterPullRequestTriggered(deps, repo, branch, workflowPaths);
+}
+async function resolveRepoMergeCiPolicy(repo, deps, headRef) {
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const repoClass = classifyRepo(repo, meta);
   if (repoClass === "content") {
@@ -7762,17 +7771,25 @@ async function resolveRepoMergeCiPolicy(repo, deps) {
     });
   }
   const baseBranch = "development";
-  const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
-  const workflowPaths = repoClass === "hub" ? [".github/workflows/gate.yml"] : hasGate ? [PRODUCT_GATE_PATH] : await listWorkflowPaths(deps, repo, baseBranch);
-  if (workflowPaths === void 0) {
+  const prTriggered = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, repoClass);
+  if (prTriggered === void 0) {
     return { policy: "wait-for-checks", reason: "workflows listing unreadable (API error) \u2014 failing safe to wait-for-checks" };
   }
-  const prTriggered = await filterPullRequestTriggered(deps, repo, baseBranch, workflowPaths);
-  return resolveMergeCiPolicy({
-    workflowPaths: prTriggered,
+  let effective = prTriggered;
+  let headReason = "";
+  if (!effective.length && headRef && headRef !== baseBranch) {
+    const onHead = await prTriggeredWorkflowsOnRef(deps, repo, headRef, repoClass);
+    if (onHead?.length) {
+      effective = onHead;
+      headReason = ` (on PR head ${headRef}; absent on ${baseBranch})`;
+    }
+  }
+  const resolved = resolveMergeCiPolicy({
+    workflowPaths: effective,
     registryCi: meta?.ci,
     registryRequiredChecks: meta?.requiredChecks
   });
+  return headReason ? { ...resolved, reason: `${resolved.reason}${headReason}` } : resolved;
 }
 async function filterPullRequestTriggered(deps, repo, branch, paths) {
   const kept = [];
@@ -8970,7 +8987,7 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/index.ts
-var import_node_os10 = require("node:os");
+var import_node_os11 = require("node:os");
 
 // src/board.ts
 var import_node_child_process7 = require("node:child_process");
@@ -9464,7 +9481,8 @@ var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
 var ORG_INFRA_SLUG = "_org";
-var KEY_RE = /^(?:[a-z][a-z0-9-]*\/)?[A-Za-z][A-Za-z0-9_]*$/;
+var KEY_MAX_PATH_SEGMENTS = 4;
+var KEY_RE = new RegExp(`^(?:[a-z0-9][a-z0-9-]*/){0,${KEY_MAX_PATH_SEGMENTS}}[A-Za-z][A-Za-z0-9_]*$`);
 function isValidSecretKey(key) {
   if (!key || key.length > 256) return false;
   if (key.includes("..") || key.startsWith("/") || key.includes("*")) return false;
@@ -9663,7 +9681,7 @@ function formatCapabilities(r) {
 no vault credentials visible`;
   const width = Math.max(...items.map((i) => i.scope.length));
   const lines = items.map(
-    (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.reason}`
+    (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.grantScope ? `${i.reason} (${i.grantScope})` : i.reason}`
   );
   const reachable = items.filter((i) => i.accessible).length;
   return [
@@ -9674,6 +9692,7 @@ no vault credentials visible`;
     ...lines,
     "",
     "+ = usable now. Consume keyless: `mmi-cli secrets use <KEY> -- <cmd>` (inject, never printed); validate: `mmi-cli secrets verify <KEY>`. No command prints a raw value (#2844).",
+    "  `grant (read)` = keyless use only \u2014 rotating or removing that key still needs an rw grant (#3652).",
     `  Org-infra (#3463): \`--slug\` is ALWAYS \`${ORG_INFRA_SLUG}\`; the provider is the key's FIRST SEGMENT \u2014 \`mmi-cli secrets use cloudflare/GLOBAL_API_KEY --slug ${ORG_INFRA_SLUG} -- <cmd>\` (master-gated).`
   ].join("\n");
 }
@@ -10338,11 +10357,29 @@ async function secretsRemove(deps, key, opts) {
   }
   deps.log(`removed ${key}`);
 }
-async function secretsGrant(deps, repo, login, key, _opts) {
+var WILDCARD_GRANT_KEY_RE = /^(?:[a-z][a-z0-9-]*\/)?\*$/;
+function isWildcardGrantKey(key) {
+  return WILDCARD_GRANT_KEY_RE.test(key);
+}
+function isValidGrantKey(key) {
+  if (!key || key.length > 256) return false;
+  if (key.includes("..") || key.startsWith("/")) return false;
+  return isWildcardGrantKey(key) || isValidSecretKey(key);
+}
+async function secretsGrant(deps, repo, login, key, opts) {
+  if (!isValidGrantKey(key)) {
+    deps.err(`invalid grant key ${JSON.stringify(key)} \u2014 expected <provider>/<KEY>, or a read-only wildcard \`*\` / \`<provider>/*\``);
+    return;
+  }
+  if (isWildcardGrantKey(key) && !opts.read) {
+    deps.err(`secrets grant: ${key} is a wildcard \u2014 pass --read. A wildcard never confers write, so granting it rw is refused rather than silently narrowed.`);
+    return;
+  }
+  const scope = opts.read ? "read" : "rw";
   const res = await deps.fetch(`${deps.apiUrl}/secrets/grant`, {
     method: "POST",
     headers: await deps.headers({ "content-type": "application/json" }),
-    body: JSON.stringify({ repo, login, key }),
+    body: JSON.stringify({ repo, login, key, scope }),
     signal: AbortSignal.timeout(TIMEOUT_MS)
   });
   if (!res.ok) {
@@ -10351,7 +10388,7 @@ async function secretsGrant(deps, repo, login, key, _opts) {
     );
     return;
   }
-  deps.log(`granted @${login} access to ${key} in ${repo}`);
+  deps.log(`granted @${login} ${scope === "read" ? "read-only" : "read/write"} access to ${key} in ${repo}`);
 }
 async function secretsRevoke(deps, repo, login, key, _opts) {
   const res = await deps.fetch(`${deps.apiUrl}/secrets/revoke`, {
@@ -15943,12 +15980,15 @@ async function resolveOwners(deps) {
 function collaboratorRole(c) {
   return c.role_name ?? (c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : "write");
 }
-async function auditRepoCollaborators(repo, owners, deps) {
+async function auditRepoCollaborators(repo, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), sanctionedAdmins = /* @__PURE__ */ new Set()) {
   const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
   const findings = [];
+  const writeOrBetter = /* @__PURE__ */ new Set();
   for (const c of collabs) {
     if (owners.has(c.login)) continue;
     const role = collaboratorRole(c);
+    writeOrBetter.add(c.login);
+    if (OVERGRANT_ROLES.has(role) && sanctionedAdmins.has(c.login)) continue;
     if (OVERGRANT_ROLES.has(role)) {
       findings.push({
         repo,
@@ -15960,6 +16000,17 @@ async function auditRepoCollaborators(repo, owners, deps) {
       });
     }
   }
+  for (const login of projectAdmins) {
+    if (owners.has(login) || writeOrBetter.has(login)) continue;
+    findings.push({
+      repo,
+      kind: "collaborator-undergrant",
+      severity: "medium",
+      actor: login,
+      detail: `@${login} is a declared project-admin of ${repo} in the registry but holds no direct collaborator role; secrets self-serve and train authority fail closed for them`,
+      remediation: `gh api -X PUT repos/${repo}/collaborators/${login} -f permission=push`
+    });
+  }
   return findings;
 }
 async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
@@ -16007,6 +16058,18 @@ async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @
       });
     }
   }
+  for (const login of projectAdmins) {
+    if (owners.has(login) || users.includes(login)) continue;
+    findings.push({
+      repo,
+      branch,
+      kind: "train-allowlist-missing",
+      severity: "medium",
+      actor: login,
+      detail: `declared project-admin @${login} is missing from the ${branch} push allowlist \u2014 the registry grants them train authority the branch lock denies`,
+      remediation: `gh api -X POST repos/${repo}/branches/${branch}/protection/restrictions/users -f users[]="${login}"`
+    });
+  }
   const apps = (restrictions.apps ?? []).map((a) => a.slug);
   if (!apps.includes(LOCKED_APP)) {
     findings.push({
@@ -16039,9 +16102,9 @@ function auditDataAccessContracts(repo, contracts = { consumers: {} }) {
   }
   return findings;
 }
-async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), dataAccess, releaseTrack) {
+async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), dataAccess, releaseTrack, sanctionedAdmins = /* @__PURE__ */ new Set()) {
   const findings = [];
-  findings.push(...await auditRepoCollaborators(repo, owners, deps));
+  findings.push(...await auditRepoCollaborators(repo, owners, deps, projectAdmins, sanctionedAdmins));
   if (dataAccess) findings.push(...auditDataAccessContracts(repo, dataAccess));
   const track = releaseTrack ?? (repoClass === "content" ? "trunk" : void 0);
   for (const branch of lockedBranches(repoClass, track)) {
@@ -16081,7 +16144,7 @@ async function auditPluginReadAccess(owners, projectAdmins, deps) {
   }
   return findings;
 }
-async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
+async function auditOrgAccess(targets, deps, matrix = {}, dataAccess, sanctioned = {}) {
   if (targets.length === 0) {
     return {
       ok: false,
@@ -16118,7 +16181,16 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
   orgFindings.push(...await auditPluginReadAccess(owners, allProjectAdmins, deps));
   const repos = [];
   for (const target of targets) {
-    repos.push(await auditRepoAccess(target.repo, target.class, owners, deps, new Set(entriesValueByCanonicalRepo(matrix, target.repo) ?? []), dataAccess, target.releaseTrack));
+    repos.push(await auditRepoAccess(
+      target.repo,
+      target.class,
+      owners,
+      deps,
+      new Set(entriesValueByCanonicalRepo(matrix, target.repo) ?? []),
+      dataAccess,
+      target.releaseTrack,
+      new Set(entriesValueByCanonicalRepo(sanctioned, target.repo) ?? [])
+    ));
   }
   const ok = orgFindings.every((f) => f.severity !== "high") && repos.every((r) => r.ok);
   return { ok, owners: [...owners], orgFindings, repos };
@@ -16157,6 +16229,10 @@ function loadAccessMatrix(matrixJson) {
   if (!matrixJson) return {};
   return safeJson(matrixJson, {}).projectAdmins ?? {};
 }
+function loadSanctionedAdmins(matrixJson) {
+  if (!matrixJson) return {};
+  return safeJson(matrixJson, {}).sanctionedAdmins ?? {};
+}
 function loadDataAccessContracts(dataAccessJson) {
   if (!dataAccessJson) return { consumers: {} };
   const parsed = safeJson(dataAccessJson, { consumers: {} });
@@ -16548,6 +16624,43 @@ function evaluate(changed, policy, present = () => false) {
 function git(args, cwd) {
   return (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
+var COAUTHOR_KEY = "Co-authored-by";
+var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
+var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
+function parseTrailers(message, cwd) {
+  try {
+    return (0, import_node_child_process10.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+      cwd,
+      input: message,
+      encoding: "utf8",
+      maxBuffer: 4 * 1024 * 1024
+    }).split("\n").map((l) => l.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function squashBodyWithOverride(commits, cwd) {
+  const overrides = [];
+  const coauthors = [];
+  const bodies = [];
+  for (const commit of commits) {
+    const message = `${commit.headline}
+
+${commit.body}`.trim();
+    for (const trailer of parseTrailers(message, cwd)) {
+      if (trailer.toLowerCase().startsWith(`${TRAILER_KEY.toLowerCase()}:`)) {
+        if (!overrides.includes(trailer)) overrides.push(trailer);
+      } else if (trailer.toLowerCase().startsWith(`${COAUTHOR_KEY.toLowerCase()}:`)) {
+        if (!coauthors.some((c) => c.toLowerCase() === trailer.toLowerCase())) coauthors.push(trailer);
+      }
+    }
+    const source = commits.length > 1 ? message : commit.body;
+    const kept = source.split("\n").filter((line) => !LIFTED_KEYS.test(line.trim()) && !GH_MESSAGE_SEPARATOR.test(line.trim())).join("\n").trim();
+    if (kept) bodies.push(kept);
+  }
+  if (!overrides.length) return null;
+  return [...bodies, [...overrides, ...coauthors].join("\n")].join("\n\n");
+}
 function resolveBase(cwd, explicit) {
   const candidates = [explicit, process.env.TEST_POLICY_BASE, "origin/development", "origin/main"].filter(Boolean);
   for (const ref of candidates) {
@@ -18035,8 +18148,8 @@ function registerSecretsCommands(program3) {
       if (ok === false) process.exitCode = 1;
     });
   });
-  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to one specific org-infra secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
-  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
+  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to an org-infra secret. Default is read/write on one exact key; --read grants keyless USE only, and only --read accepts a wildcard key (`*` = the whole namespace, `<provider>/*` = one provider group) (#3652)").option("--read", "read-only: permits keyless `secrets use`, never `set`/`rm`. Required for a wildcard key.").action((repo, login, key, o) => withSecrets((d) => secretsGrant(d, repo, login, key, { read: o.read })));
+  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access (pass the grant key exactly as granted, wildcard included)").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
 }
 
 // src/app-actor.ts
@@ -21350,6 +21463,7 @@ function registerBoardCommands(program3) {
 var import_node_fs27 = require("node:fs");
 var import_promises6 = require("node:fs/promises");
 var import_node_path26 = require("node:path");
+var import_node_os8 = require("node:os");
 var import_node_child_process12 = require("node:child_process");
 
 // src/board-advance.ts
@@ -22258,8 +22372,36 @@ ${err?.stdout ?? ""}`.split("\n").map((line) => line.trim()).find((line) => line
 var defaultGhMergeAutoIo = {
   gh: async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout
 };
+async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
+  try {
+    const raw = await gh(["pr", "view", prNumber, ...repoArgs, "--json", "commits"], GC_GH_TIMEOUT_MS2);
+    const commits = JSON.parse(raw).commits ?? [];
+    const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
+    if (!body) return void 0;
+    const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os8.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path26.join)(dir, "body.txt");
+    (0, import_node_fs27.writeFileSync)(path2, `${body}
+`, "utf8");
+    return { path: path2, cleanup: () => {
+      try {
+        (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
+      } catch {
+      }
+    } };
+  } catch {
+    return void 0;
+  }
+}
 async function ghMergeAutoEnqueue(prNumber, repo, method, io = defaultGhMergeAutoIo) {
   const args = repo ? ["--repo", repo] : [];
+  const overrideBody = await composeOverrideBodyFile(prNumber, args, io.gh);
+  try {
+    return await mergeAutoEnqueueWithBody(prNumber, args, method, io, overrideBody?.path);
+  } finally {
+    overrideBody?.cleanup();
+  }
+}
+async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile) {
   const headRef = (await io.gh(["pr", "view", prNumber, ...args, "--json", "headRefName", "--jq", ".headRefName"], GC_GH_TIMEOUT_MS2).catch(() => "")).trim();
   const deleteBranch = !isProtectedBranch(headRef);
   const readMergeState = () => readGhPrStateWithRetry(
@@ -22278,7 +22420,7 @@ async function ghMergeAutoEnqueue(prNumber, repo, method, io = defaultGhMergeAut
         return s.ok && s.state === "MERGED";
       },
       reEnqueue: async () => {
-        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch }), GH_MUTATION_TIMEOUT_MS);
+        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
       }
     });
     if (confirmation === "merged") return { mergeStatus: "merged" };
@@ -22286,7 +22428,7 @@ async function ghMergeAutoEnqueue(prNumber, repo, method, io = defaultGhMergeAut
     return { mergeStatus: "failed", error: "auto-merge did not stick \u2014 GitHub reported no autoMergeRequest after enqueue; retry once the PR has a pending check" };
   };
   try {
-    await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch }), GH_MUTATION_TIMEOUT_MS);
+    await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
   } catch (e) {
     const message = String(e.message || "");
     if (/already been merged/i.test(message)) return { mergeStatus: "merged" };
@@ -22294,7 +22436,7 @@ async function ghMergeAutoEnqueue(prNumber, repo, method, io = defaultGhMergeAut
     if (note) return { mergeStatus: "failed", error: note };
     if (mergeAutoRejectedPrAlreadyClean(message)) {
       try {
-        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: false, deleteBranch }), GH_MUTATION_TIMEOUT_MS);
+        await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: false, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
       } catch (e2) {
         const m2 = String(e2.message || "");
         if (/already been merged/i.test(m2)) return { mergeStatus: "merged" };
@@ -22305,7 +22447,7 @@ async function ghMergeAutoEnqueue(prNumber, repo, method, io = defaultGhMergeAut
             return { mergeStatus: "failed", error: `could not confirm PR state after clean-status fallback: ${afterDirect.error}` };
           }
           try {
-            await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch }), GH_MUTATION_TIMEOUT_MS);
+            await io.gh(buildPrMergeArgs({ number: prNumber, repoArgs: args, method, auto: true, deleteBranch, bodyFile }), GH_MUTATION_TIMEOUT_MS);
           } catch (e3) {
             const m3 = String(e3.message || "");
             if (/already been merged/i.test(m3)) return { mergeStatus: "merged" };
@@ -23829,7 +23971,7 @@ function registerDeployCommands(program3) {
 
 // src/discovery-commands.ts
 var import_node_fs31 = require("node:fs");
-var import_node_os8 = require("node:os");
+var import_node_os9 = require("node:os");
 var import_node_path29 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
@@ -24005,7 +24147,7 @@ async function collectOnboardStatus() {
     else if (top) nextCommand = `mmi-cli board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os8.homedir)();
+  const home = (0, import_node_os9.homedir)();
   const plugin = onboardPluginGate({
     readKnown: () => readFileSyncSafe((0, import_node_path29.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs31.readFileSync),
     readSettings: () => readFileSyncSafe((0, import_node_path29.join)(home, ".claude", "settings.json"), import_node_fs31.readFileSync)
@@ -25388,17 +25530,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep2 = platform2 === "win32" ? "\\" : "/";
-  const join26 = (...parts) => parts.join(sep2);
+  const join27 = (...parts) => parts.join(sep2);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join26(explicit, "hosts.yml");
+  if (explicit) return join27(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join26(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join27(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join26(xdg, "gh", "hosts.yml");
+  if (xdg) return join27(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join26(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join27(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -25449,7 +25591,7 @@ function ghAccountCaveat(announcedLogin, accounts) {
 
 // src/doctor-io.ts
 var import_node_fs32 = require("node:fs");
-var import_node_os9 = require("node:os");
+var import_node_os10 = require("node:os");
 var import_node_path30 = require("node:path");
 var import_node_child_process13 = require("node:child_process");
 var import_node_util8 = require("node:util");
@@ -25458,7 +25600,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs32.readFileSync)((0, import_node_path30.join)((0, import_node_os9.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs32.readFileSync)((0, import_node_path30.join)((0, import_node_os10.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -25567,7 +25709,7 @@ function envHealLockPath(home) {
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os10.homedir)()),
+      envHealLockPath((0, import_node_os11.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -25662,9 +25804,9 @@ function mmiDoctorDeps(opts = {}) {
     },
     pluginCache: () => {
       const plan = buildPluginCachePlan(
-        (0, import_node_os10.homedir)(),
+        (0, import_node_os11.homedir)(),
         runningPluginVersion(process.env, resolveClientVersion()),
-        pluginCacheFsDeps((0, import_node_os10.homedir)(), () => 0)
+        pluginCacheFsDeps((0, import_node_os11.homedir)(), () => 0)
       );
       return {
         stale: plan.prune,
@@ -25713,7 +25855,7 @@ function mmiDoctorDeps(opts = {}) {
     // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
     marketplaceRows: () => {
       try {
-        const home = (0, import_node_os10.homedir)();
+        const home = (0, import_node_os11.homedir)();
         return marketplaceRows(
           MMI_MARKETPLACE_NAME,
           readFileSyncSafe((0, import_node_path31.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs33.readFileSync),
@@ -25734,23 +25876,6 @@ async function requireFreshTrainCli(commandName) {
   if (report.ok) return;
   throw new Error(staleTrainCliMessage(report, commandName));
 }
-var cachedLongFlags;
-function allLongFlags() {
-  if (cachedLongFlags) return cachedLongFlags;
-  const acc = /* @__PURE__ */ new Set();
-  const walk2 = (node) => {
-    if (!isCanonicalSuggestion(node)) return;
-    for (const opt of node.options) {
-      if (opt.discovery) continue;
-      const m = /--[\w-]+/.exec(opt.flags);
-      if (m) acc.add(m[0]);
-    }
-    for (const child2 of node.subcommands) walk2(child2);
-  };
-  walk2(buildCommandManifest(program2).tree);
-  cachedLongFlags = [...acc];
-  return cachedLongFlags;
-}
 var cachedCommandPaths;
 function allCommandPaths() {
   if (cachedCommandPaths) return cachedCommandPaths;
@@ -25817,6 +25942,22 @@ function commandPath2(cmd) {
   }
   return parts.join(" ");
 }
+function commandOwnLongFlags(cmd) {
+  if (!cmd) return [];
+  const flags = /* @__PURE__ */ new Set();
+  for (const opt of cmd.options) {
+    if (opt.long) flags.add(opt.long);
+  }
+  return [...flags];
+}
+var TARGET_SELECTOR_FLAGS = /* @__PURE__ */ new Set(["--repo", "--ref", "--target", "--project"]);
+function positionalTargetForm(cmd) {
+  if (!cmd) return void 0;
+  const args = cmd.registeredArguments ?? [];
+  const first = args[0];
+  if (!first) return void 0;
+  return `mmi-cli ${commandPath2(cmd)} <${first.name()}>`;
+}
 function resolveParseHint() {
   if (lastParseErrorKind === "unknown-command") {
     const path3 = lastUnknownCommand ? suggestCommandPath(lastUnknownCommand, allCommandPaths()) : void 0;
@@ -25845,10 +25986,13 @@ function envelopeAwareWriteErr(str) {
   if (match) {
     const flag = match[1];
     if (argvWantsJson2()) {
-      const suggestion = didYouMean(flag, allLongFlags());
+      const invoked = resolveCommandFromArgv(program2, process.argv.slice(2));
+      const suggestion = didYouMean(flag, commandOwnLongFlags(invoked));
       const corrected = suggestion ? `mmi-cli ${process.argv.slice(2).map((a) => a === flag ? suggestion : a).join(" ")}` : void 0;
+      const positional = !suggestion && TARGET_SELECTOR_FLAGS.has(flag) ? positionalTargetForm(invoked) : void 0;
+      const message = positional ? `unknown option '${flag}' \u2014 this command takes its target as a positional: ${positional}` : `unknown option '${flag}'`;
       process.stderr.write(
-        formatErrorEnvelope(`unknown option '${flag}'`, {
+        formatErrorEnvelope(message, {
           code: ERROR_CODES.ERR_UNKNOWN_FLAG,
           offending_flag: flag,
           ...suggestion ? { did_you_mean: suggestion } : {},
@@ -27304,14 +27448,19 @@ async function listCiWorkflowPaths(cwd = process.cwd()) {
     }
   }).map((name) => `.github/workflows/${name}`);
 }
-async function resolveMergeCiPolicyForCheckout(repoOpt) {
+async function resolveMergeCiPolicyForCheckout(repoOpt, headRef) {
   const repo = repoOpt ?? await resolveRepo();
   if (repo) {
-    return resolveRepoMergeCiPolicy(repo, ciAuditDeps());
+    return resolveRepoMergeCiPolicy(repo, ciAuditDeps(), headRef);
   }
   const workflowPaths = await listCiWorkflowPaths();
   return resolveMergeCiPolicy({ workflowPaths });
 }
+async function prHeadRefForCiProbe(prNumber, repo) {
+  const snapshot = await fetchRestPrSnapshot(prNumber, repo).catch(() => null);
+  if (!snapshot || snapshot.headIsFork || !snapshot.headRef) return void 0;
+  return snapshot.headRef;
+}
 function ciAuditDeps() {
   const cfgPromise = loadConfig();
   const root = hubRoot();
@@ -27350,9 +27499,11 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     timeoutMs = Math.round(minutes * 6e4);
   }
   const repo = await requireRepo(o.repo);
-  const baseBranch = await fetchRestPrSnapshot(number, repo).then((s) => s.baseRef).catch(() => "development");
+  const snapshot = await fetchRestPrSnapshot(number, repo).catch(() => null);
+  const baseBranch = snapshot?.baseRef ?? "development";
+  const ciHeadRef = snapshot && !snapshot.headIsFork && snapshot.headRef ? snapshot.headRef : void 0;
   const result = await waitForPrChecks({
-    resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
+    resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef),
     pollChecks: () => pollRestPrChecks(number, repo),
     pollMergeable: () => pollRestPrMergeable(number, repo),
     pollRateLimit: () => fetchRestCorePool(),
@@ -27497,12 +27648,13 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
-  const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo);
+  const ciHeadRef = repoForPostCleanup ? await prHeadRefForCiProbe(number, repoForPostCleanup) : void 0;
+  const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef);
   if (o.wait) {
     const repo = await requireRepo(o.repo);
     const baseBranch = await fetchRestPrSnapshot(number, repo).then((s) => s.baseRef).catch(() => "development");
     const wait = await waitForPrChecks({
-      resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
+      resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef),
       pollChecks: () => pollRestPrChecks(number, repo),
       pollMergeable: () => pollRestPrMergeable(number, repo),
       pollRateLimit: () => fetchRestCorePool(),
@@ -27527,44 +27679,50 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   let remoteDeleteAttempted = false;
   let upgradedToAuto = false;
   let remoteNotAttemptedReason = headIsProtected ? "protected-branch" : void 0;
-  await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto, deleteBranch: !headIsProtected }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch(async (e) => {
-    const message = String(e.message || "");
-    if (/already been merged/i.test(message)) {
-      remoteNotAttemptedReason = "pr-already-merged";
-      return;
-    }
-    const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
-    if (note) throw new Error(`gh pr merge ${number}: ${note}`);
-    if (o.auto && mergeAutoRejectedPrAlreadyClean(message)) {
-      await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: !headIsProtected }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
-        const m2 = String(e2.message || "");
-        if (/already been merged/i.test(m2)) {
-          remoteNotAttemptedReason = "pr-already-merged";
-          return;
-        }
-        const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
-        if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
-        if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
-      });
-      return;
-    }
-    if (!o.auto && basePolicyBlocksImmediateMerge(message)) {
-      console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
-      upgradedToAuto = true;
-      await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: !headIsProtected }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
-        const m2 = String(e2.message || "");
-        if (/already been merged/i.test(m2)) {
-          remoteNotAttemptedReason = "pr-already-merged";
-          return;
-        }
-        const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
-        if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
-        if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
-      });
-      return;
-    }
-    if (!ghPrMergeLocalBranchDeleteWarning(message)) throw e;
-  });
+  const overrideBody = await composeOverrideBodyFile(number, repoArgs, async (a, t) => (await execFileP2("gh", a, { timeout: t })).stdout);
+  const bodyFile = overrideBody?.path;
+  try {
+    await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto, deleteBranch: !headIsProtected, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch(async (e) => {
+      const message = String(e.message || "");
+      if (/already been merged/i.test(message)) {
+        remoteNotAttemptedReason = "pr-already-merged";
+        return;
+      }
+      const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+      if (note) throw new Error(`gh pr merge ${number}: ${note}`);
+      if (o.auto && mergeAutoRejectedPrAlreadyClean(message)) {
+        await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: !headIsProtected, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
+          const m2 = String(e2.message || "");
+          if (/already been merged/i.test(m2)) {
+            remoteNotAttemptedReason = "pr-already-merged";
+            return;
+          }
+          const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
+          if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
+          if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
+        });
+        return;
+      }
+      if (!o.auto && basePolicyBlocksImmediateMerge(message)) {
+        console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
+        upgradedToAuto = true;
+        await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: !headIsProtected, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
+          const m2 = String(e2.message || "");
+          if (/already been merged/i.test(m2)) {
+            remoteNotAttemptedReason = "pr-already-merged";
+            return;
+          }
+          const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
+          if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
+          if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
+        });
+        return;
+      }
+      if (!ghPrMergeLocalBranchDeleteWarning(message)) throw e;
+    });
+  } finally {
+    overrideBody?.cleanup();
+  }
   const stateRead = await readGhPrStateWithRetry(
     () => execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "state", "--jq", ".state"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => r.stdout)
   );
@@ -27958,7 +28116,8 @@ access.command("audit").description("audit collaborator roles + train-branch pus
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
   const fileContracts = (0, import_node_fs33.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs33.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
+  const sanctioned = (0, import_node_fs33.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs33.readFileSync)("access-matrix.json", "utf8")) : {};
+  const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
@@ -28052,13 +28211,13 @@ function stagingApplyFsGuard(home) {
 }
 program2.command("plugin-prune").description(`prune stale cached MMI plugin versions (keeps running + newest, ${PLUGIN_CACHE_KEEP} total) and orphaned temp_git_* staging dirs; dry-run unless --apply (#2903, #2990)`).option("--apply", "actually delete the stale version dirs + orphaned staging dirs (default: report only)").option("--json", "machine-readable output").action((o) => {
   const plan = buildPluginCachePlan(
-    (0, import_node_os10.homedir)(),
+    (0, import_node_os11.homedir)(),
     runningPluginVersion(process.env, resolveClientVersion()),
-    pluginCacheFsDeps((0, import_node_os10.homedir)(), directoryBytes),
+    pluginCacheFsDeps((0, import_node_os11.homedir)(), directoryBytes),
     { withBytes: true }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs33.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os10.homedir)())) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs33.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os11.homedir)())) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -28141,9 +28300,11 @@ program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGr
   DEFAULT_PRIORITY,
   awsCallerArn,
   classifyParseError,
+  commandOwnLongFlags,
   envHealLockPath,
   gcPlan,
   isOrgRegisteredRepo,
+  positionalTargetForm,
   registryClientDeps,
   repoSlug,
   shouldMarkWorktreeActivity,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.68.0",
+  "version": "3.70.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",