@mutmutco/cli 3.79.0 → 3.80.0

package/dist/main.cjs

@@ -6432,7 +6432,7 @@ function scanInstallDirs(root, fs2 = realFsProbe) {
   return [factsFor(""), ...children.map(factsFor).filter((f) => f.hasPackageJson)];
 }
 function npmInstallTargets(dirs) {
-  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install" }));
+  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install --no-package-lock" }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
   return fs2.isFile((0, import_node_path10.join)(root, ".git"));
@@ -9512,6 +9512,57 @@ async function runReleaseAbort(deps, options = {}) {
     note: `removed the unpublished ${tag} candidate and restored local main; repair development before recutting`
   };
 }
+async function runReleasePublishRetry(deps, runId, options = {}) {
+  if (!options.approved) {
+    throw new Error("release --retry-publish requires --apply after explicit approval; nothing was written");
+  }
+  if (!Number.isSafeInteger(runId) || runId <= 0) throw new Error(`invalid publish run id ${runId}`);
+  const ctx = await buildTrainApplyContext(deps);
+  if (!isHubControlRepo(ctx.repo)) {
+    throw new Error("release --retry-publish is limited to mutmutco/MMI-Hub");
+  }
+  await requireCleanTree(deps);
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const readRun = async () => {
+    const raw = await deps.run("gh", ["run", "view", String(runId), "--repo", ctx.repo, "--json", "databaseId,workflowName,event,headBranch,headSha,status,conclusion,url"]);
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`publish run ${runId} metadata was not valid JSON`);
+    }
+  };
+  const run = await readRun();
+  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || run.conclusion !== "failure") {
+    throw new Error(`run ${runId} is not a completed failed Hub publish release run; nothing was written`);
+  }
+  const tag = run.headBranch ?? "";
+  const tagSha = run.headSha ?? "";
+  if (!/^v\d+\.\d+\.\d+$/.test(tag) || !/^[0-9a-f]{40}$/.test(tagSha)) {
+    throw new Error(`run ${runId} has invalid release identity (${tag || "(no tag)"} / ${tagSha || "(no sha)"}); nothing was written`);
+  }
+  if (await probeRemoteTag(deps, tag) !== tagSha) {
+    throw new Error(`run ${runId} does not match origin ${tag}; nothing was written`);
+  }
+  await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
+  await deps.run("gh", ["run", "rerun", String(runId), "--repo", ctx.repo, "--failed"]);
+  if (options.watch) {
+    await deps.run("gh", ["run", "watch", String(runId), "--repo", ctx.repo, "--exit-status"]);
+    const completed = await readRun();
+    if (completed.status !== "completed" || completed.conclusion !== "success") {
+      throw new Error(`publish run ${runId} did not finish successfully after retry`);
+    }
+  }
+  return {
+    command: "release-retry-publish",
+    repo: ctx.repo,
+    tag,
+    tagSha,
+    runId,
+    runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
+    status: options.watch ? "success" : "pending",
+    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} failed jobs queued for retry`
+  };
+}
 async function runTrainApplyPipeline(mode, input) {
   const { deps, ctx, command, meta, branchHints, watch, options } = input;
   const directTrack = input.directTrack ?? false;
@@ -14552,9 +14603,10 @@ async function fetchNpmReleasedVersion() {
   }
 }
 var NPM_INSTALL_TIMEOUT_MS = 12e4;
-async function npmSelfUpdateCli(target) {
+async function npmSelfUpdateCli(target, onStep) {
   const command = cliUpdateCommand(target);
   try {
+    onStep?.(command);
     await runHostBin("npm", ["install", "-g", `@mutmutco/cli@${target ?? "latest"}`], { timeout: NPM_INSTALL_TIMEOUT_MS });
     return { ok: true, detail: `${command} exited 0` };
   } catch (e) {
@@ -14620,9 +14672,6 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     ) : (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
-function activePluginGuardState(isOrgRepo) {
-  return buildPluginGuardDecision(snapshotPluginGuardInput(detectSurface(process.env), isOrgRepo)).state;
-}
 async function runClaudePlugin(args) {
   try {
     await runHostBin("claude", args, { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
@@ -14792,27 +14841,35 @@ async function applyPluginHeal(surface, log, opts) {
   if (restored) log(`  ${restored}`);
   return true;
 }
-async function healClaudePluginForDoctor(surface = detectSurface(process.env)) {
+async function healClaudePluginForDoctor(surface = detectSurface(process.env), onStep) {
   if (surfaceToken(surface) !== "claude") {
     return { ok: false, detail: `not a Claude surface (${surface}) \u2014 no Hub-shipped plugin to reinstall` };
   }
   const steps = [];
-  const ok = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const ok = await applyPluginHeal(surface, (msg) => {
+    const line = msg.trim();
+    steps.push(line);
+    if (line) onStep?.(line);
+  });
   const pinNote = steps.find((s) => s.startsWith("re-pinned ") || s.includes("re-pin by hand"));
   return {
     ok,
     detail: ok ? `marketplace remove \u2192 add \u2192 install succeeded${pinNote ? `; ${pinNote}` : ""}` : `\`claude plugin\` reinstall failed or was skipped${steps.length ? ` (${steps[steps.length - 1]})` : ""}`
   };
 }
-async function healActivePluginForDoctor(surface = detectSurface(process.env)) {
+async function healActivePluginForDoctor(surface = detectSurface(process.env), onStep) {
   const token = surfaceToken(surface);
   if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "kilo") {
     return { ok: false, detail: `not a supported plugin surface (${surface})` };
   }
-  if (token === "claude") return healClaudePluginForDoctor(surface);
+  if (token === "claude") return healClaudePluginForDoctor(surface, onStep);
   if (token === "cursor") return installCursorPluginCheckout();
   const steps = [];
-  const applied = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const applied = await applyPluginHeal(surface, (msg) => {
+    const line = msg.trim();
+    steps.push(line);
+    if (line) onStep?.(line);
+  });
   const snapshot = applied ? snapshotPluginGuardInput(surface, true) : void 0;
   const guardState = snapshot ? buildPluginGuardDecision(snapshot).state : "unresolved";
   const ok = applied && guardState === "healthy";
@@ -27301,19 +27358,6 @@ function renderTally(checks) {
   const healthy = total - checks.filter((c) => !c.ok).length;
   return healthy === total ? `\u2713 all ${total} checks healthy` : `\u2713 ${healthy} of ${total} checks healthy`;
 }
-function renderDoctorText(checks, opts) {
-  const lines = [];
-  const shown = opts.verbose ? checks : checks.filter((c) => !c.ok || c.warn);
-  for (const check of shown) {
-    lines.push(renderCheckLine(check));
-    if (opts.verbose) {
-      for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
-    }
-  }
-  lines.push(renderTally(checks));
-  if (opts.restartPending) lines.push(RESTART_LINE);
-  return lines.join("\n");
-}
 function doctorReportExitCode(checks) {
   return checks.some((c) => !c.ok && !c.reportOnly) ? 1 : 0;
 }
@@ -28003,7 +28047,8 @@ var DOCTOR_SURFACES = Object.freeze(
     installLocator: surface.install.locator,
     upgradeMechanism: surface.upgrade.mechanism,
     reload: surface.upgrade.reload,
-    repairOwner: surface.ownership.repair === "mmi-cli" ? "mmi-cli" : "operator"
+    repairOwner: surface.ownership.repair === "mmi-cli" ? "mmi-cli" : "operator",
+    trustOwner: surface.ownership.trust === "operator" ? "operator" : "host"
   }))
 );
 function doctorSurface(token) {
@@ -28036,11 +28081,8 @@ function diagnoseSurface(evidence) {
   return { ...base, state: "clean" };
 }
 function reloadInstruction(descriptor) {
-  if (descriptor.token === "claude") return "restart Claude";
-  if (descriptor.token === "codex") return "restart Codex";
-  if (descriptor.token === "kimi") return "restart Kimi Code CLI";
-  if (descriptor.token === "kilo") return "restart Kilo Code";
-  return descriptor.reload === "workspace" ? `reload ${descriptor.displayName}` : `restart ${descriptor.displayName}`;
+  const verb = descriptor.reload === "workspace" ? "reload" : "restart";
+  return `${verb} ${descriptor.displayName}`;
 }
 function planSurfaceRepair(diagnosis) {
   if (diagnosis.state === "clean" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
@@ -28085,10 +28127,16 @@ function buildSurfaceDoctorCheck(diagnosis) {
     detail: detailByState[state],
     ...plan ? { fix: plan.instruction } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
     verbose: [
+      // The three numbers the legacy builder used to print. They belong here now that this is the only
+      // plugin row, and a report that names a state without naming the versions behind it is not evidence.
+      `installed: ${diagnosis.installedVersion ?? "(none)"}`,
+      `released:  ${diagnosis.releasedVersion ?? "(not checked \u2014 offline or --fast)"}`,
+      `state: ${state}`,
       `registry surface: ${descriptor.token}`,
       `install: ${descriptor.installMechanism} (${descriptor.installLocator})`,
       `repair owner: ${descriptor.repairOwner}`,
-      `artifacts: ${descriptor.artifactIds.join(", ")}`
+      `artifacts: ${descriptor.artifactIds.join(", ")}`,
+      ...diagnosis.repairDetail ? [`heal: ${diagnosis.repairDetail}`] : []
     ]
   };
 }
@@ -28186,77 +28234,23 @@ function checkWorktreeRoots(probe) {
     verbose: evidence
   };
 }
-function pluginHealTrigger(probe) {
-  if (probe.guardState === "no-install" || probe.guardState === "unresolved") return "unresolved";
-  const behind = Boolean(probe.installed && probe.released) && compareVersions(probe.installed, probe.released) < 0;
-  return behind ? "behind" : null;
-}
-function checkClaudePlugin(probe) {
-  const { installed, released, guardState } = probe;
-  const codex = probe.surface === "codex";
-  const kilo = probe.surface === "kilo";
-  const cursor = probe.surface === "cursor";
-  const id = codex ? "codex-plugin" : kilo ? "kilo-plugin" : cursor ? "cursor-plugin" : "claude-plugin";
-  const label = codex ? "Codex plugin" : kilo ? "Kilo plugin" : cursor ? "Cursor plugin" : "Claude plugin";
-  const restart = codex ? "restart Codex" : kilo ? "reload Kilo" : cursor ? "reload Cursor" : "restart Claude";
-  const evidence = [
-    `installed: ${installed ?? "(none)"}`,
-    // #3485 item 7: when the value was reused from the banner's once-a-day cache, say so and say how old.
-    `released:  ${released ?? "(not checked \u2014 offline or --fast)"}${released && probe.releasedNote ? ` ${probe.releasedNote}` : ""}`,
-    `resolvable: ${guardState}`
-  ];
-  const trigger = pluginHealTrigger(probe);
-  if (trigger === "unresolved") {
-    return {
-      id,
-      ok: false,
-      label,
-      detail: guardState === "no-install" ? "not installed" : "unresolved (delivery/cache missing)",
-      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall the MMI plugin, then ${restart}`,
-      verbose: evidence
-    };
-  }
-  if (trigger === "behind") {
-    return {
-      id,
-      ok: false,
-      label,
-      detail: `${installed} \u2192 ${released}`,
-      // Name the CLI verb that actually fixes it, like every other red row — `/plugin` is the manual
-      // fallback, not the first resort (#3282).
-      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall it, then ${restart}`,
-      verbose: evidence
-    };
-  }
-  if (!released) {
-    return {
-      id,
-      ok: false,
-      reportOnly: true,
-      label,
-      detail: `${installed ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
-      fix: "check it directly: `npm view @mutmutco/cli version`, then `mmi-cli plugin heal` if behind",
-      verbose: evidence
-    };
-  }
-  return { id, ok: true, label, ...installed ? { detail: installed } : {}, verbose: evidence };
-}
-function checkCodexHookTrust(probe) {
+function checkCodexHookTrust(probe, displayName = "Codex") {
   if (!probe?.applicable) return null;
   const evidence = [
     `stored approval rows: ${probe.trustedCount}/${probe.requiredCount}`,
     "current command hashes: verify interactively in /hooks"
   ];
+  const label = `${displayName} hook trust`;
   if (probe.trusted) {
-    return { id: "codex-hook-trust", ok: true, label: "Codex hook trust", detail: "trusted", verbose: evidence };
+    return { id: "codex-hook-trust", ok: true, label, detail: "trusted", verbose: evidence };
   }
   return {
     id: "codex-hook-trust",
     ok: true,
     warn: true,
-    label: "Codex hook trust",
+    label,
     detail: probe.requiredCount > 0 ? `${probe.trustedCount}/${probe.requiredCount} approval rows present \u2014 current hashes unverified` : "hook bundle could not be verified",
-    fix: probe.requiredCount > 0 ? "Codex does not allow silent hook approval; run `/hooks`, review the MMI commands, and trust them" : "run `mmi-cli plugin heal`, restart Codex, then review and trust MMI under `/hooks`",
+    fix: probe.requiredCount > 0 ? `${displayName} does not allow silent hook approval; run \`/hooks\`, review the MMI commands, and trust them` : `run \`mmi-cli plugin heal\`, restart ${displayName}, then review and trust MMI under \`/hooks\``,
     verbose: evidence
   };
 }
@@ -28481,6 +28475,12 @@ function gcReapable(plan) {
 async function runDoctorClean(opts, io, deps) {
   const applyEnv = Boolean(opts.apply) || Boolean(opts.preflight);
   const applyRepo = Boolean(opts.apply) && opts.repoWrites !== false;
+  const lane = {
+    banner: Boolean(opts.banner),
+    fast: Boolean(opts.fast),
+    preflight: Boolean(opts.preflight),
+    full: !opts.fast && !opts.banner && !opts.preflight
+  };
   const probeReleased = !opts.fast || Boolean(opts.self);
   const probeAws = !opts.fast && !opts.banner;
   const [login, isOrgRepo, released, callerArn, reach] = await Promise.all([
@@ -28495,108 +28495,69 @@ async function runDoctorClean(opts, io, deps) {
     opts.banner || opts.preflight || opts.fast && !opts.self ? Promise.resolve(void 0) : deps.githubRepoReach?.() ?? Promise.resolve(void 0)
   ]);
   const ghInstalled2 = login ? true : await deps.ghInstalled();
-  const registryEvidence = deps.surfaceEvidence?.(isOrgRepo);
-  const installed = registryEvidence?.installedVersion ?? deps.installedPluginVersion();
-  const pluginSurface = deps.pluginSurface?.() ?? "claude-cli";
-  const codexSurface = registryEvidence?.descriptor.token === "codex" || pluginSurface === "codex";
-  const cursorSurface = pluginSurface === "cursor";
-  const restartAction = registryEvidence ? surfaceRestartAction(registryEvidence.descriptor) : codexSurface ? "restart Codex" : cursorSurface ? "reload Cursor" : pluginSurface === "kilo" ? "restart Kilo Code" : "restart Claude";
+  const registryEvidence = deps.surfaceEvidence(isOrgRepo);
+  const restartAction = registryEvidence ? surfaceRestartAction(registryEvidence.descriptor) : "restart the agent host";
   const checks = [];
   let restartPending = false;
-  checks.push(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.githubPools) {
-    checks.push(...checkGithubPools(await deps.githubPools()));
-  }
-  const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
-  if (aws) checks.push(aws);
-  checks.push(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
-  if (isOrgRepo) {
-    const current = deps.readGitignore();
-    const gi = planGitignore(current);
-    const giEvidence = [
-      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
-      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
-    ];
-    if (gi.ok) {
-      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
-    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
-      checks.push({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
-      restartPending = true;
-    } else {
-      checks.push({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
-    }
-  }
-  const releasedNote = deps.releasedVersionNote?.();
-  const pluginProbe = {
-    installed,
-    released,
-    guardState: registryEvidence?.guardState ?? deps.pluginGuardState(isOrgRepo),
-    releasedNote,
-    surface: pluginSurface
+  const streamed = /* @__PURE__ */ new Set();
+  const worthPrinting = (c) => Boolean(opts.verbose) || !c.ok || Boolean(c.warn);
+  const emitNow = (check) => {
+    checks.push(check);
+    if (opts.json || !worthPrinting(check)) return;
+    streamed.add(check);
+    io.log(renderCheckLine(check));
+    if (opts.verbose) for (const evidence of check.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
   };
-  const registryDiagnosis = registryEvidence ? diagnoseSurface({ ...registryEvidence, releasedVersion: released }) : void 0;
-  const registryRepairPlan = registryDiagnosis ? planSurfaceRepair(registryDiagnosis) : null;
-  const healTrigger = registryDiagnosis ? registryRepairPlan?.supported ? registryDiagnosis.state : null : pluginHealTrigger(pluginProbe);
+  const healIntent = (line) => {
+    if (!opts.json) io.log(`\u21BB ${line}`);
+  };
+  const healStep = (message) => {
+    if (!opts.json) io.log(`${VERBOSE_INDENT}${message.trim()}`);
+  };
+  const releasedNote = deps.releasedVersionNote?.();
   let pluginHealed = false;
-  if (applyEnv && deps.healPlugin && healTrigger && (!registryRepairPlan || registryRepairPlan.supported)) {
-    const heal = await deps.healPlugin();
-    pluginHealed = heal.ok;
-    if (registryEvidence) {
-      const repairedDiagnosis = diagnoseSurface({
+  async function runPluginRow() {
+    if (!registryEvidence) return;
+    const diagnosis = diagnoseSurface({ ...registryEvidence, releasedVersion: released });
+    const repair = planSurfaceRepair(diagnosis);
+    if (applyEnv && deps.healPlugin && repair?.supported) {
+      const { descriptor } = registryEvidence;
+      healIntent(`${descriptor.displayName} plugin \u2014 healing via ${descriptor.installMechanism} (${descriptor.installLocator})`);
+      const heal = await deps.healPlugin(healStep);
+      pluginHealed = heal.ok;
+      const row = buildSurfaceDoctorCheck(diagnoseSurface({
         ...registryEvidence,
         releasedVersion: released,
         repair: { attempted: true, ok: heal.ok, detail: heal.detail }
-      });
-      const repairedCheck = buildSurfaceDoctorCheck(repairedDiagnosis);
-      if (heal.skipped) repairedCheck.reportOnly = true;
-      checks.push(repairedCheck);
-      if (!heal.skipped) restartPending = true;
-    } else {
-      const measured = healTrigger === "behind" ? `${installed} \u2192 ${released}` : "unresolved install";
-      const healEvidence = [
-        `installed: ${installed ?? "(none)"}`,
-        `released:  ${released ?? "(not checked \u2014 offline or --fast)"}`,
-        `resolvable: ${pluginProbe.guardState}`,
-        `heal: ${heal.detail}`
-      ];
-      checks.push(heal.ok ? {
-        id: codexSurface ? "codex-plugin" : pluginSurface === "kilo" ? "kilo-plugin" : cursorSurface ? "cursor-plugin" : "claude-plugin",
-        ok: true,
-        label: codexSurface ? "Codex plugin" : pluginSurface === "kilo" ? "Kilo plugin" : cursorSurface ? "Cursor plugin" : "Claude plugin",
-        detail: pluginSurface === "kilo" ? `${measured} \u2014 reinstalled via \`kilo plugin\` (the plugin provisions the skills on next load)` : cursorSurface ? `${measured} \u2014 replaced the managed local checkout (previous copy quarantined)` : `${measured} \u2014 reinstalled via the MMI marketplace (remove \u2192 add \u2192 ${codexSurface ? "add" : "install"})${codexSurface ? "; review trust in /hooks" : ""}`,
-        verbose: healEvidence
-      } : {
-        id: codexSurface ? "codex-plugin" : pluginSurface === "kilo" ? "kilo-plugin" : cursorSurface ? "cursor-plugin" : "claude-plugin",
-        ok: false,
-        label: codexSurface ? "Codex plugin" : pluginSurface === "kilo" ? "Kilo plugin" : cursorSurface ? "Cursor plugin" : "Claude plugin",
-        detail: measured,
-        // #3489: a heal skipped because another doctor holds the env-heal lock is a real ✗ — this run did
-        // not fix what it found — but it is not this invocation's to clear. The other process is doing it;
-        // waiting is the correct response and a re-run finds it healed. A heal that RAN and failed is a
-        // genuine gap and still gates.
-        ...heal.skipped ? { reportOnly: true } : {},
-        fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes` : `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then ${codexSurface ? "restart Codex" : pluginSurface === "kilo" ? "reload Kilo" : cursorSurface ? "reload Cursor" : "restart Claude"}`,
-        verbose: healEvidence
-      });
+      }));
+      if (heal.skipped) {
+        row.reportOnly = true;
+        row.fix = `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes`;
+      }
+      emitNow(row);
       if (!heal.skipped) restartPending = true;
+    } else if (diagnosis.state !== "skipped") {
+      const row = buildSurfaceDoctorCheck(diagnosis);
+      emitNow(row);
+      if (!row.ok && repair?.supported) restartPending = true;
+    }
+    if (registryEvidence.descriptor.trustOwner === "operator" && (registryEvidence.guardState === "healthy" || pluginHealed)) {
+      const trust = checkCodexHookTrust(deps.pluginTrustState?.(), registryEvidence.descriptor.displayName);
+      if (trust) emitNow(trust);
+    }
+  }
+  async function runCliRow() {
+    const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
+    const cliReport = buildVersionLagReport(cliInput);
+    if (!(applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm")) {
+      const cli = checkCliVersion(cliInput, releasedNote);
+      if (cli) emitNow(cli);
+      return;
     }
-  } else {
-    const plugin = registryDiagnosis ? buildSurfaceDoctorCheck(registryDiagnosis) : checkClaudePlugin(pluginProbe);
-    if (plugin) {
-      if (!("state" in plugin) || plugin.state !== "skipped") checks.push(plugin);
-      if (!plugin.ok && (registryDiagnosis ? Boolean(registryRepairPlan?.supported) : true)) restartPending = true;
-    }
-  }
-  if (codexSurface && (pluginProbe.guardState === "healthy" || pluginHealed)) {
-    const trust = checkCodexHookTrust(deps.pluginTrustState?.());
-    if (trust) checks.push(trust);
-  }
-  const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
-  const cliReport = buildVersionLagReport(cliInput);
-  if (applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
-    const heal = await deps.updateCli(cliReport.releasedVersion);
+    healIntent(`mmi-cli \u2014 self-updating ${cliReport.currentVersion} \u2192 ${cliReport.releasedVersion} via npm install -g`);
+    const heal = await deps.updateCli(cliReport.releasedVersion, healStep);
     const healEvidence = [`running:  ${cliReport.currentVersion}`, `published: ${cliReport.releasedVersion}`, `heal: ${heal.detail}`];
-    checks.push(heal.ok ? {
+    emitNow(heal.ok ? {
       id: "cli-version",
       ok: true,
       label: "mmi-cli",
@@ -28612,17 +28573,47 @@ async function runDoctorClean(opts, io, deps) {
       fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is updating it now; re-run once it finishes` : `self-update failed (${heal.detail}) \u2014 run \`${cliUpdateCommand(cliReport.releasedVersion)}\``,
       verbose: healEvidence
     });
-  } else {
-    const cli = checkCliVersion(cliInput, releasedNote);
-    if (cli) checks.push(cli);
   }
-  checks.push(checkPluginCache(deps.pluginCache()));
-  if (deps.sessionPayload) {
+  async function runGithubAuthRow() {
+    emitNow(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
+  }
+  async function runGithubPoolsRows() {
+    for (const pool of checkGithubPools(await deps.githubPools())) emitNow(pool);
+  }
+  async function runAwsRow() {
+    const aws = checkAwsIdentity({ isOrgRepo, probed: probeAws, callerArn });
+    if (aws) emitNow(aws);
+  }
+  async function runRepoWorktreesRow() {
+    emitNow(checkRepoWorktrees({ isOrgRepo, hasRepoLocalWorktrees: deps.hasRepoLocalWorktrees() }));
+  }
+  async function runGitignoreRow() {
+    const current = deps.readGitignore();
+    const gi = planGitignore(current);
+    const giEvidence = [
+      `.gitignore: ${current === null ? "absent" : `${current.split("\n").length} lines`}`,
+      `managed block: ${gi.ok ? "present and current" : "missing or out of date"}`
+    ];
+    if (gi.ok) {
+      emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", verbose: giEvidence });
+    } else if (applyRepo && gi.content && deps.writeGitignore(gi.content)) {
+      emitNow({ ok: true, id: "gitignore-block", label: "gitignore block", detail: "rewrote managed block", verbose: giEvidence });
+      restartPending = true;
+    } else {
+      emitNow({ ok: false, id: "gitignore-block", label: "gitignore block", fix: "run `mmi-cli doctor --apply` to write the org-managed .gitignore block", verbose: giEvidence });
+    }
+  }
+  async function runPluginCacheRow() {
+    emitNow(checkPluginCache(deps.pluginCache()));
+  }
+  async function runSessionPayloadRow() {
     const payload = checkSessionPayload(deps.sessionPayload());
-    if (payload) checks.push(payload);
+    if (payload) emitNow(payload);
   }
-  if (deps.marketplaceRows) checks.push(...deps.marketplaceRows());
-  if (!opts.fast && !opts.banner && !opts.preflight) {
+  async function runMarketplaceRows() {
+    for (const row of deps.marketplaceRows()) emitNow(row);
+  }
+  async function runSchedulesRow() {
     const probe = await deps.schedulesNotebook().catch((e) => ({
       armed: 0,
       live: 0,
@@ -28631,32 +28622,32 @@ async function runDoctorClean(opts, io, deps) {
       drift: []
     }));
     const sched = checkSchedules(probe);
-    if (sched) checks.push(sched);
+    if (sched) emitNow(sched);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.redactorLiveness) {
+  async function runRedactorRow() {
     const redactor = checkRedactorLiveness(deps.redactorLiveness());
-    if (redactor) checks.push(redactor);
+    if (redactor) emitNow(redactor);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.docsAudit) {
+  async function runDocsAuditRow() {
     const probe = await deps.docsAudit().catch((e) => ({
       armed: true,
       ok: false,
       detail: `docs-audit probe failed \u2014 ${e.message}`
     }));
     const docsAudit2 = checkDocsAudit(probe);
-    if (docsAudit2) checks.push(docsAudit2);
+    if (docsAudit2) emitNow(docsAudit2);
   }
-  if (!opts.fast && !opts.banner && !opts.preflight && deps.worktreeRoots) {
+  async function runWorktreeRootsRow() {
     const probe = await deps.worktreeRoots().catch(() => void 0);
     const roots = checkWorktreeRoots(probe);
-    if (roots) checks.push(roots);
+    if (roots) emitNow(roots);
   }
-  if (isOrgRepo && !opts.fast && !opts.banner && !opts.preflight) {
+  async function runTrainSyncRow() {
     try {
-      checks.push(checkTrainSync(await deps.syncTrain()));
+      emitNow(checkTrainSync(await deps.syncTrain()));
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
-      checks.push({
+      emitNow({
         ok: false,
         id: "train-branches",
         label: "train branches",
@@ -28664,6 +28655,8 @@ async function runDoctorClean(opts, io, deps) {
         verbose: [`sync threw: ${message}`, "no train branch was fast-forwarded this run"]
       });
     }
+  }
+  async function runHousekeeperRows() {
     const repoRoot2 = await deps.repoRoot();
     try {
       const plan = await deps.gcPlan("origin", 200);
@@ -28674,7 +28667,7 @@ async function runDoctorClean(opts, io, deps) {
         if (r.removedBranches.length || r.removedRemoteBranches.length) detailParts.push(`${r.removedBranches.length + r.removedRemoteBranches.length} merged branches`);
         if (r.removedWorktreeDirs.length) detailParts.push(`${r.removedWorktreeDirs.length} dead worktrees`);
         if (r.removedTrackingRefs.length) detailParts.push(`${r.removedTrackingRefs.length} stale refs`);
-        checks.push({
+        emitNow({
           id: "branches-worktrees",
           ok: true,
           label: "branches / worktrees",
@@ -28697,7 +28690,7 @@ async function runDoctorClean(opts, io, deps) {
           ...plan.trackingRefs.map((r) => `stale tracking ref: ${r.ref}`),
           ...plan.worktreeDirs.map((w) => `dead worktree: ${w.path} (${w.reason})`)
         ];
-        checks.push(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
+        emitNow(n === 0 ? { id: "branches-worktrees", ok: true, label: "branches / worktrees", verbose: ["nothing reapable"] } : {
           id: "branches-worktrees",
           ok: false,
           label: "branches / worktrees",
@@ -28715,12 +28708,35 @@ async function runDoctorClean(opts, io, deps) {
     if (applyRepo && scratch.plan.safeAuto.length > 0) {
       const applied = deps.executeScratchGc(repoRoot2, { apply: true });
       const pruned = applied.applied?.pruned.length ?? 0;
-      checks.push({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
+      emitNow({ id: "scratch", ok: true, label: "scratch", detail: pruned ? `removed ${pruned} aged item(s)` : "nothing stale", verbose: scratchEvidence });
       if (pruned) restartPending = true;
     } else {
-      checks.push(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
-    }
-  }
+      emitNow(scratch.plan.safeAuto.length === 0 ? { id: "scratch", ok: true, label: "scratch", verbose: scratchEvidence } : { id: "scratch", ok: false, label: "scratch", detail: `${scratch.plan.safeAuto.length} aged item(s)`, fix: "run `mmi-cli doctor --apply`", verbose: scratchEvidence });
+    }
+  }
+  const table = [
+    // Heals first: the slowest work starts at second zero, and a stale mmi-cli is the binary every row
+    // below is being measured with (#3954).
+    { id: "plugin", when: true, run: runPluginRow },
+    { id: "cli-version", when: true, run: runCliRow },
+    { id: "github-auth", when: true, run: runGithubAuthRow },
+    { id: "github-pools", when: lane.full, run: runGithubPoolsRows },
+    { id: "aws-identity", when: true, run: runAwsRow },
+    { id: "repo-worktrees", when: true, run: runRepoWorktreesRow },
+    { id: "gitignore-block", when: isOrgRepo, run: runGitignoreRow },
+    { id: "plugin-cache", when: true, run: runPluginCacheRow },
+    { id: "sessionstart-payload", when: true, run: runSessionPayloadRow },
+    { id: "marketplace", when: true, run: runMarketplaceRows },
+    { id: "schedules", when: lane.full, run: runSchedulesRow },
+    { id: "redactor-liveness", when: lane.full, run: runRedactorRow },
+    { id: "docs-audit", when: lane.full, run: runDocsAuditRow },
+    { id: "worktree-roots", when: lane.full, run: runWorktreeRootsRow },
+    // The two most expensive things in this file — a real `git fetch` plus train-branch fast-forward,
+    // and a `gh`-backed gc sweep with a 20s timeout — so org repos on the full lane only (#3485).
+    { id: "train-branches", when: isOrgRepo && lane.full, run: runTrainSyncRow },
+    { id: "housekeeper", when: isOrgRepo && lane.full, run: runHousekeeperRows }
+  ];
+  for (const entry of table) if (entry.when) await entry.run();
   const exitCode = doctorReportExitCode(checks);
   if (opts.json) {
     const payload = opts.verbose ? checks : checks.map(({ verbose: _evidence, ...check }) => check);
@@ -28733,7 +28749,7 @@ async function runDoctorClean(opts, io, deps) {
     return exitCode;
   }
   if (opts.banner) {
-    const actionable = checks.filter((c) => !c.ok || c.warn);
+    const actionable = checks.filter((c) => (!c.ok || c.warn) && !streamed.has(c));
     for (const c of actionable) {
       io.log(renderReport([c], { restartPending: false }));
       if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
@@ -28741,10 +28757,16 @@ async function runDoctorClean(opts, io, deps) {
     if (restartPending) io.log(`\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.`);
     return 0;
   }
-  const legacyRestart = restartAction === "restart Claude";
-  const rendered = renderDoctorText(checks, { verbose: Boolean(opts.verbose), restartPending: restartPending && legacyRestart });
-  io.log(restartPending && !legacyRestart ? `${rendered}
-\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.` : rendered);
+  const rest = checks.filter((c) => !streamed.has(c));
+  const shown = opts.verbose ? rest : rest.filter((c) => !c.ok || c.warn);
+  const lines = [];
+  for (const check of shown) {
+    lines.push(renderCheckLine(check));
+    if (opts.verbose) for (const evidence of check.verbose ?? []) lines.push(`${VERBOSE_INDENT}${evidence}`);
+  }
+  lines.push(renderTally(checks));
+  if (restartPending) lines.push(`\u21BB ${restartAction.charAt(0).toUpperCase()}${restartAction.slice(1)} to finish.`);
+  io.log(lines.join("\n"));
   return exitCode;
 }
 
@@ -29065,10 +29087,7 @@ function mmiDoctorDeps(opts = {}) {
     githubRepoReach: githubRepoReachProbe,
     awsCallerArn,
     isOrgRepo: () => isOrgRepoRoot(),
-    installedPluginVersion: installedActivePluginVersion,
     surfaceEvidence: surfaceEvidenceOnce,
-    pluginGuardState: activePluginGuardState,
-    pluginSurface: () => detectSurface(process.env),
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
@@ -29077,13 +29096,13 @@ function mmiDoctorDeps(opts = {}) {
     // marketplace clone + plugin cache) and neither is idempotent under concurrency. They share ONE lock
     // rather than one each, because they are not independent: the plugin heal reinstalls a bundle that
     // carries a CLI shim, so a concurrent npm global install races the same PATH surface.
-    updateCli: (target) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target)),
+    updateCli: (target, onStep) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target, onStep)),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
-    healPlugin: () => {
+    healPlugin: (onStep) => {
       const surface = detectSurface(process.env);
-      const host = surface === "codex" ? "Codex" : surface === "kilo" ? "Kilo" : surface === "cursor" ? "Cursor" : "Claude";
-      return withEnvHealLock(`${host} plugin reinstall`, () => healActivePluginForDoctor(surface));
+      const host = surfaceEvidenceOnce(true)?.descriptor.displayName ?? surface;
+      return withEnvHealLock(`${host} plugin reinstall`, () => healActivePluginForDoctor(surface, onStep));
     },
     currentCliVersion: resolveClientVersion,
     readGitignore,
@@ -31485,6 +31504,9 @@ function renderReleaseResume(r) {
 function renderReleaseAbort(r) {
   return `mmi-cli release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
 }
+function renderReleasePublishRetry(r) {
+  return `mmi-cli release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
+}
 function renderRcandResume(r) {
   return `mmi-cli rcand --resume: promoted ${r.repo} \u2192 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
 }
@@ -31532,7 +31554,8 @@ for (const commandName of ["rcand", "release"]) {
     { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line Hub Slack summary; required for a new MMI-Hub --apply (#883/#3901)" },
     { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
     { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
-    { flags: "--abort", description: "with --apply, delete only a proven unpublished failed Hub tag and restore local main for a clean recut (#3944)" }
+    { flags: "--abort", description: "with --apply, delete only a proven unpublished failed Hub tag and restore local main for a clean recut (#3944)" },
+    { flags: "--retry-publish <run-id>", description: "with --apply, retry failed jobs of one proven Hub publish release run (#3949)" }
   ];
   for (const f of RELEASE_ONLY_FLAGS) {
     if (commandName === "release") {
@@ -31559,6 +31582,25 @@ for (const commandName of ["rcand", "release"]) {
     if (o.abort && commandName !== "release") {
       return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished Hub release tag. Run: mmi-cli release --abort --apply`);
     }
+    if (o.retryPublish && commandName !== "release") {
+      return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli release --retry-publish <run-id> --apply --watch`);
+    }
+    if (o.retryPublish) {
+      if (o.resume || o.abort) return fail("release: --retry-publish cannot be combined with --resume or --abort");
+      if (!o.apply) return fail("release: --retry-publish requires --apply after explicit approval; nothing was written");
+      if (o.announceSummaryFile || o.ack || o.dev) return fail("release: --retry-publish accepts only --apply, --watch, --repo and --json");
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli release --retry-publish ${o.retryPublish} --apply${o.watch ? " --watch" : ""}`);
+        if (!guard.ok) return fail(`release: ${guard.message}`);
+      }
+      const runId = Number.parseInt(o.retryPublish, 10);
+      try {
+        const result = await runReleasePublishRetry(trainApplyDeps(), runId, { approved: true, watch: o.watch });
+        return printLine(o.json ? JSON.stringify(result, null, 2) : renderReleasePublishRetry(result));
+      } catch (e) {
+        return failGraceful(`release --retry-publish: ${e.message}`);
+      }
+    }
     if (o.abort) {
       if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
       if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.79.0",
+  "version": "3.80.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",