@mutmutco/cli 3.7.0 → 3.9.0

package/dist/main.cjs

@@ -9270,7 +9270,7 @@ function parseNpmVersion(stdout) {
   return /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(v) ? v : void 0;
 }
 function staleTrainCliMessage(report, commandName) {
-  return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`mmi-cli doctor --apply --no-repo-writes\` to update to ${report.releasedVersion}, then rerun ${commandName} so it uses the current train path`;
+  return `running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; this is recoverable \u2014 run \`mmi-cli doctor --apply --no-repo-writes\` to update to ${report.releasedVersion}, then rerun ${commandName} so it uses the current train path. This gate runs before any train mutation, so this invocation changed nothing; any partial train state (local merge, pushed tag) is from an earlier run and the rerun resumes it safely`;
 }
 async function resolveReleasedVersion(runners) {
   try {
@@ -9750,6 +9750,19 @@ function requireValue(value, label) {
   if (!value) throw new Error(`${label} could not be resolved`);
   return value;
 }
+function surfaceTrainSubprocessFailure(e, file, args) {
+  if (!(e instanceof Error)) return e;
+  const err = e;
+  const stderr = typeof err.stderr === "string" ? err.stderr.trim() : "";
+  const stdout = typeof err.stdout === "string" ? err.stdout.trim() : "";
+  const cmd = `${file} ${args.join(" ")}`.trim();
+  if (!stderr && !stdout) {
+    err.message = `${cmd} failed with no stderr output (exit ${err.code ?? "?"}) \u2014 likely a transient subprocess/network error. [${err.message}]`;
+  } else if (/^Command failed/i.test(err.message) && stderr) {
+    err.message = `${cmd} failed: ${stderr}`;
+  }
+  return err;
+}
 function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun) {
   if (cwdRepo && cwdRepo.toLowerCase() === applyRepo.toLowerCase()) return { ok: true };
   const where = cwdRepo ? `this checkout is ${cwdRepo}` : "this checkout could not be identified";
@@ -9817,14 +9830,14 @@ async function verifyPublishedRelease(deps, repo, tag, expectedTarget, expectedS
   if (tagSha !== expectedSha) {
     throw new Error(`Release ${tag} tag points at ${tagSha}, expected ${expectedSha}`);
   }
-  const branchOut = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
+  const branchOut = clean(await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
   const branchSha = requireValue(branchOut.split(/\s+/)[0] ?? "", `origin/${expectedTarget} sha`);
   if (branchSha !== expectedSha) {
     throw new Error(`origin/${expectedTarget} points at ${branchSha}, expected ${expectedSha}`);
   }
 }
 async function ffOnlyPull(deps, branch) {
-  await deps.run("git", ["pull", "--ff-only", "origin", branch]);
+  await runGitRemoteRead(deps, ["pull", "--ff-only", "origin", branch]);
 }
 var RELEASE_TOLERATED_PATHS = [".gitignore"];
 var MERGE_TREE_PREFLIGHT_ATTEMPTS = 3;
@@ -9878,7 +9891,7 @@ function ensurePositiveCount(out, emptyMessage) {
   if (count <= 0) throw new Error(emptyMessage);
 }
 async function remoteBranchExists(deps, branch) {
-  const out = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const out = clean(await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/heads/${branch}`]));
   return out.length > 0;
 }
 async function loadReleaseTrackBranchHints(deps) {
@@ -10038,7 +10051,33 @@ var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
-var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion}]";
+var GIT_NETWORK_ATTEMPTS = 3;
+var GIT_NETWORK_RETRY_DELAY_MS = 1e3;
+function isPersistentGitPushFailure(e) {
+  const msg = `${e instanceof Error ? e.message : String(e)} ${String(e.stderr ?? "")}`;
+  return /non-fast-forward|\[rejected\]|failed to push|protected branch|hook declined|permission denied|could not read Username|authentication failed|Authentication failed|403 Forbidden|GH006|GH013/i.test(msg);
+}
+async function runGitWithRetry(deps, args, shouldRetry) {
+  const sleep = resolveSleep(deps);
+  let lastError;
+  for (let attempt = 1; attempt <= GIT_NETWORK_ATTEMPTS; attempt++) {
+    try {
+      return await deps.run("git", args);
+    } catch (e) {
+      lastError = e;
+      if (attempt >= GIT_NETWORK_ATTEMPTS || !shouldRetry(e)) throw e;
+      await sleep(GIT_NETWORK_RETRY_DELAY_MS * attempt);
+    }
+  }
+  throw lastError;
+}
+function runGitRemoteRead(deps, args) {
+  return runGitWithRetry(deps, args, () => true);
+}
+function runGitPush(deps, args) {
+  return runGitWithRetry(deps, args, (e) => !isPersistentGitPushFailure(e));
+}
+var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion,startedAt:.started_at}]";
 var TRAIN_COMMIT_STATUS_JQ = "[.statuses[]|{context:.context,state:.state}]";
 var TRAIN_PROTECTION_CONTEXTS_JQ = "[.contexts[]]";
 var TRAIN_RULES_CONTEXTS_JQ = '[.[]|select(.type=="required_status_checks")|.parameters.required_status_checks[].context]';
@@ -10046,6 +10085,7 @@ var TRAIN_CHECK_ATTEMPTS = 40;
 var TRAIN_CHECK_DELAY_MS = 15e3;
 var TRAIN_PR_ONLY_AUTOMATION_CONTEXTS = /* @__PURE__ */ new Set(["add-to-project", "mark-merged-pr-done"]);
 var TRAIN_PR_AUTOMATION_GRACE_ATTEMPTS = 3;
+var TRAIN_FRESH_RUN_GRACE_ATTEMPTS = 4;
 async function correlateRun(deps, args) {
   const sleep = resolveSleep(deps);
   const threshold = args.since - CORRELATE_SKEW_SLACK_MS;
@@ -10103,12 +10143,19 @@ async function correlateWorkflowRun(deps, args) {
 }
 async function watchTenantRun(deps, runId, repo = HUB_REPO3) {
   if (runId == null) return "pending";
+  let watchSaidSuccess = true;
   try {
     await deps.run("gh", ["run", "watch", String(runId), "--repo", repo, "--exit-status"]);
-    return "success";
   } catch {
-    return "failure";
+    watchSaidSuccess = false;
+  }
+  try {
+    const out = await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]);
+    const parsed = JSON.parse(out);
+    if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
+  } catch {
   }
+  return watchSaidSuccess ? "success" : "failure";
 }
 async function fetchControlRunLog(deps, runId) {
   try {
@@ -10220,10 +10267,16 @@ function resolveContextState(context, checkRuns, statuses) {
   if (sawSuccess) return "success";
   return sawFailure ? "failed" : "pending";
 }
-async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
+async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince) {
   if (required.length === 0) {
     return "no required status checks configured on the target branch \u2014 check wait skipped (GitHub push gate is the backstop)";
   }
+  const freshThreshold = freshSince !== void 0 ? freshSince - CORRELATE_SKEW_SLACK_MS : void 0;
+  const isFreshRun = (r) => {
+    if (freshThreshold === void 0) return true;
+    const t = Date.parse(String(r.startedAt ?? ""));
+    return !Number.isFinite(t) || t >= freshThreshold;
+  };
   const sleep = resolveSleep(deps);
   let lastStatus = "not checked";
   let lastError;
@@ -10256,7 +10309,14 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
       }
     }
     const pending = required.filter((c) => !autoSatisfied.has(c));
-    const states = pending.map((c) => [c, resolveContextState(c, checkRuns, statuses)]);
+    const holdStale = freshThreshold !== void 0 && attempt < TRAIN_FRESH_RUN_GRACE_ATTEMPTS;
+    const states = pending.map((c) => {
+      if (holdStale) {
+        const runsFor = checkRuns.filter((r) => r.name === c);
+        if (runsFor.length > 0 && !runsFor.some(isFreshRun)) return [c, "pending"];
+      }
+      return [c, resolveContextState(c, checkRuns, statuses)];
+    });
     const satisfiedNote = autoSatisfied.size ? `, auto-satisfied (never runs on a tag, see #2404): ${[...autoSatisfied].join(", ")}` : "";
     lastStatus = `${states.map(([c, s]) => `${c}=${s}`).join(", ")}${satisfiedNote}`;
     const failed = states.filter(([, s]) => s === "failed").map(([c]) => c);
@@ -10291,9 +10351,12 @@ Recovery sequence:
 Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
   );
 }
-async function ensureTagPushed(deps, tag, sha) {
-  const remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]);
-  const remoteSha = clean(remoteOut).split(/\s+/)[0] || "";
+async function probeRemoteTag(deps, tag) {
+  const remoteOut = await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/tags/${tag}`]);
+  return clean(remoteOut).split(/\s+/)[0] || "";
+}
+async function ensureTagPushed(deps, tag, sha, probed) {
+  const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
   let localSha = "";
   try {
     localSha = clean(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
@@ -10308,17 +10371,20 @@ async function ensureTagPushed(deps, tag, sha) {
     if (localSha && localSha !== sha) {
       throw new Error(`local tag ${tag} points at ${localSha} but origin has it at ${sha} \u2014 delete the stale local tag (git tag -d ${tag}) and rerun`);
     }
-    return `tag ${tag} already on origin at ${sha.slice(0, 7)} \u2014 resumed without re-pushing`;
+    return { note: `tag ${tag} already on origin at ${sha.slice(0, 7)} \u2014 resumed without re-pushing`, pushed: false };
   }
   if (localSha && localSha !== sha) {
     throw new Error(`local tag ${tag} already points at ${localSha}, not the intended ${sha} \u2014 delete the stale local tag (git tag -d ${tag}) and rerun`);
   }
   if (!localSha) await deps.run("git", ["tag", tag, sha]);
-  await deps.run("git", ["push", "origin", tag]);
-  return `tag ${tag} pushed at ${sha.slice(0, 7)}`;
+  await runGitPush(deps, ["push", "origin", tag]);
+  return { note: `tag ${tag} pushed at ${sha.slice(0, 7)}`, pushed: true };
 }
-async function resolveRcResumeTag(deps, base, sha) {
-  const out = await deps.run("git", ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
+function probeRcResumeTags(deps, base) {
+  return runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
+}
+async function resolveRcResumeTag(deps, base, sha, probed) {
+  const out = probed ?? await runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
   const onSha = clean(out).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)).filter(([refSha]) => refSha === sha).map(([, ref]) => ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "")).filter((ref) => new RegExp(`^${base.replace(/\./g, "\\.")}-rc\\.\\d+$`).test(ref));
   const unique = [...new Set(onSha)];
   if (unique.length === 0) return { tag: null };
@@ -10569,6 +10635,49 @@ Recovery sequence:
 ${steps.join("\n")}`
   );
 }
+async function recoverFailedRcand(deps, cause, preRcSha) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  const branch = await currentBranch(deps).catch(() => "");
+  const mergeInProgress = await deps.run("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).then(() => true).catch(() => false);
+  if (mergeInProgress) {
+    try {
+      await deps.run("git", ["merge", "--abort"]);
+    } catch (e) {
+      return new Error(
+        `${causeMessage}
+
+rcand failed with an in-progress merge on ${branch || "(unknown branch)"}; automatic \`git merge --abort\` failed: ${e instanceof Error ? e.message : String(e)}. Nothing was pushed to origin.
+Recovery sequence:
+  1. git merge --abort
+  2. git checkout development
+  3. git branch -f rc origin/rc`
+      );
+    }
+  }
+  const rcSha = await deps.run("git", ["rev-parse", "rc"]).then(clean).catch(() => "");
+  const rcDescends = Boolean(preRcSha) && Boolean(rcSha) ? await deps.run("git", ["merge-base", "--is-ancestor", preRcSha, "rc"]).then(() => true).catch(() => false) : false;
+  if (branch === "rc" && rcDescends) {
+    try {
+      await deps.run("git", ["reset", "--hard", preRcSha]);
+      await deps.run("git", ["checkout", "development"]);
+      return new Error(
+        `${causeMessage}
+
+rcand failed after \`git checkout rc\`; local rc was reset to its pre-merge state (${shaLabel(preRcSha)}) and the checkout returned to development. Nothing was pushed to origin. Rerun \`mmi-cli rcand --apply\`.`
+      );
+    } catch {
+    }
+  }
+  return new Error(
+    `${causeMessage}
+
+rcand failed leaving the checkout on ${branch || "(unknown)"} (pre-merge rc=${preRcSha ? shaLabel(preRcSha) : "not captured"}). Nothing was pushed to origin.
+Recovery sequence:
+  1. git checkout development
+  2. git branch -f rc origin/rc   # discard the unpushed local rc merge
+  3. mmi-cli rcand --apply`
+  );
+}
 async function recoverFailedFold(deps, cause, startBranch, preFoldMainSha) {
   const causeMessage = cause instanceof Error ? cause.message : String(cause);
   const probe = await probeFoldFailureState(deps);
@@ -10620,16 +10729,22 @@ async function runFoldStage(deps, startBranch, preFold, fn) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
   }
 }
-async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
-  await ensureTagPushed(deps, tag, releaseSha);
+async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe) {
+  let tagPush;
+  try {
+    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe);
+  } catch (e) {
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+  }
+  const tagPushSince = (deps.now ?? Date.now)();
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
   let checks;
   try {
-    checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks);
+    checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
   } catch (e) {
     throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
   }
-  await deps.run("git", ["push", "origin", "main"]);
+  await runGitPush(deps, ["push", "origin", "main"]);
   const releaseUrl = clean(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
@@ -10670,23 +10785,34 @@ async function runTrainApplyPipeline(mode, input) {
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
     const releaseBase = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
     await releaseRcBranchLock(deps);
+    const rcTagProbe = await probeRcResumeTags(deps, releaseBase);
     await deps.run("git", ["checkout", "rc"]);
     await ffOnlyPull(deps, "rc");
-    await deps.run("git", ["merge", "development", "--no-edit"]);
-    const rcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
-    const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
-    const tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+    const preRcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "pre-merge rc sha");
+    let rcSha;
+    let resume;
+    let tag2;
+    let tagPush;
+    try {
+      await deps.run("git", ["merge", "development", "--no-edit"]);
+      rcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
+      resume = await resolveRcResumeTag(deps, releaseBase, rcSha, rcTagProbe);
+      tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+      tagPush = await ensureTagPushed(deps, tag2, rcSha);
+    } catch (e) {
+      throw await recoverFailedRcand(deps, e, preRcSha);
+    }
     const resumeNote = resume.tag ? resume.note : void 0;
-    await ensureTagPushed(deps, tag2, rcSha);
+    const tagPushSince = (deps.now ?? Date.now)();
     const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
     let checks2;
     try {
-      checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks);
+      checks2 = await waitForRequiredTrainChecks(deps, ctx, rcSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
     } catch (e) {
       throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
     }
     const autoRunSince = (deps.now ?? Date.now)();
-    await deps.run("git", ["push", "origin", "rc"]);
+    await runGitPush(deps, ["push", "origin", "rc"]);
     const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
     return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus };
   }
@@ -10718,6 +10844,7 @@ async function runTrainApplyPipeline(mode, input) {
       "development -> main merge would conflict on untolerated path(s)",
       "The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release."
     );
+    const tagProbe2 = { remoteSha: await probeRemoteTag(deps, tag2) };
     const preFold2 = {};
     const { versionFold: versionFold2, releaseSha: releaseSha2 } = await runFoldStage(deps, "development", preFold2, async () => {
       await executeMergeToMain(deps, "development", "development -> main", tolerated2, predicted2, preFold2);
@@ -10725,7 +10852,7 @@ async function runTrainApplyPipeline(mode, input) {
       const releaseSha3 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
       return { versionFold: versionFold3, releaseSha: releaseSha3 };
     });
-    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2);
+    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2, "development", preFold2, tagProbe2);
     const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
     if (directTrack) {
       return {
@@ -10801,15 +10928,16 @@ async function runTrainApplyPipeline(mode, input) {
     );
   }
   const releasedRcSha = clean(await deps.run("git", ["rev-parse", "origin/rc"]));
+  const tag = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
+  const tagProbe = { remoteSha: await probeRemoteTag(deps, tag) };
   const preFold = {};
-  const { tag, versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
+  const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
     await executeMergeToMain(deps, "rc", "rc -> main", tolerated, predicted, preFold);
-    const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
-    const versionFold2 = await foldReleaseVersion(deps, deployModel, tag2, foldPaths);
+    const versionFold2 = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
     const releaseSha2 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
-    return { tag: tag2, versionFold: versionFold2, releaseSha: releaseSha2 };
+    return { versionFold: versionFold2, releaseSha: releaseSha2 };
   });
-  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha);
+  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, "rc", preFold, tagProbe);
   const retirement = await retireRcRuntime(deps, ctx, deployModel, d.deployStatus, releasedRcSha);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   const rcAlignment = await pushRcAlignment(deps);
@@ -10843,7 +10971,7 @@ async function runTrainApply(command, deps, options = {}) {
   const watch = options.watch ?? false;
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
-  await deps.run("git", ["fetch", "origin"]);
+  await runGitRemoteRead(deps, ["fetch", "origin"]);
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
@@ -11383,9 +11511,11 @@ async function runHotfixRelease(deps, versionInput, options = {}) {
   await deps.run("git", ["merge-base", "--is-ancestor", mergedSha, "origin/main"]).catch(() => {
     throw new Error(`merged hotfix SHA ${mergedSha.slice(0, 7)} is not on origin/main \u2014 refusing to tag`);
   });
-  const tagNote = await ensureTagPushed(deps, tag, mergedSha);
+  const tagPush = await ensureTagPushed(deps, tag, mergedSha);
+  const tagPushSince = Date.now();
+  const tagNote = tagPush.note;
   const required = await discoverRequiredCheckContexts(deps, ctx, "main");
-  const checks = await waitForRequiredTrainChecks(deps, ctx, mergedSha, required);
+  const checks = await waitForRequiredTrainChecks(deps, ctx, mergedSha, required, tagPush.pushed ? tagPushSince : void 0);
   let releaseNote;
   let releaseExists = false;
   try {
@@ -13634,6 +13764,11 @@ function parseFofuEnabledVar(raw) {
   if (raw === "false") return false;
   throw new Error("project set: fofuEnabled must be true or false");
 }
+function parseRuntimeVaultOnlyVar(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error("project set: runtimeVaultOnly must be true or false");
+}
 function parseConsumesDesignSystemVar(raw) {
   if (raw === "fofu") return raw;
   throw new Error('project set: consumesDesignSystem must be "fofu"');
@@ -13711,6 +13846,7 @@ var SETTABLE_VAR_KEYS = [
   "dsManifestPath",
   "fofuEnabled",
   "consumesDesignSystem",
+  "runtimeVaultOnly",
   "requiredGcpApis",
   "requiredRuntimeSecrets",
   "requiredBuildSecrets",
@@ -13733,6 +13869,7 @@ var SETTABLE_VAR_HINTS = {
   dsManifestPath: "relative path to a package.json, e.g. web/package.json",
   fofuEnabled: "true|false",
   consumesDesignSystem: '"fofu"',
+  runtimeVaultOnly: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
@@ -13814,6 +13951,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parsePublishRequiredVar(raw);
     } else if (key === "fofuEnabled") {
       patch[key] = parseFofuEnabledVar(raw);
+    } else if (key === "runtimeVaultOnly") {
+      patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "consumesDesignSystem") {
       patch[key] = parseConsumesDesignSystemVar(raw);
     } else if (key === "publishDir") {
@@ -20862,7 +21001,11 @@ function trainApplyDeps() {
   return {
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+      try {
+        return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+      } catch (e) {
+        throw surfaceTrainSubprocessFailure(e, file, args);
+      }
     },
     runSelf: async (args) => (await execFileP2(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
     trainAuthority: async (repo) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",