@mutmutco/cli 3.8.0 → 3.9.0

package/dist/main.cjs

@@ -9750,6 +9750,19 @@ function requireValue(value, label) {
   if (!value) throw new Error(`${label} could not be resolved`);
   return value;
 }
+function surfaceTrainSubprocessFailure(e, file, args) {
+  if (!(e instanceof Error)) return e;
+  const err = e;
+  const stderr = typeof err.stderr === "string" ? err.stderr.trim() : "";
+  const stdout = typeof err.stdout === "string" ? err.stdout.trim() : "";
+  const cmd = `${file} ${args.join(" ")}`.trim();
+  if (!stderr && !stdout) {
+    err.message = `${cmd} failed with no stderr output (exit ${err.code ?? "?"}) \u2014 likely a transient subprocess/network error. [${err.message}]`;
+  } else if (/^Command failed/i.test(err.message) && stderr) {
+    err.message = `${cmd} failed: ${stderr}`;
+  }
+  return err;
+}
 function planTrainApplyRepoGuard(applyRepo, cwdRepo, rerun) {
   if (cwdRepo && cwdRepo.toLowerCase() === applyRepo.toLowerCase()) return { ok: true };
   const where = cwdRepo ? `this checkout is ${cwdRepo}` : "this checkout could not be identified";
@@ -9817,14 +9830,14 @@ async function verifyPublishedRelease(deps, repo, tag, expectedTarget, expectedS
   if (tagSha !== expectedSha) {
     throw new Error(`Release ${tag} tag points at ${tagSha}, expected ${expectedSha}`);
   }
-  const branchOut = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
+  const branchOut = clean(await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/heads/${expectedTarget}`]));
   const branchSha = requireValue(branchOut.split(/\s+/)[0] ?? "", `origin/${expectedTarget} sha`);
   if (branchSha !== expectedSha) {
     throw new Error(`origin/${expectedTarget} points at ${branchSha}, expected ${expectedSha}`);
   }
 }
 async function ffOnlyPull(deps, branch) {
-  await deps.run("git", ["pull", "--ff-only", "origin", branch]);
+  await runGitRemoteRead(deps, ["pull", "--ff-only", "origin", branch]);
 }
 var RELEASE_TOLERATED_PATHS = [".gitignore"];
 var MERGE_TREE_PREFLIGHT_ATTEMPTS = 3;
@@ -9878,7 +9891,7 @@ function ensurePositiveCount(out, emptyMessage) {
   if (count <= 0) throw new Error(emptyMessage);
 }
 async function remoteBranchExists(deps, branch) {
-  const out = clean(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
+  const out = clean(await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/heads/${branch}`]));
   return out.length > 0;
 }
 async function loadReleaseTrackBranchHints(deps) {
@@ -10038,6 +10051,32 @@ var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
+var GIT_NETWORK_ATTEMPTS = 3;
+var GIT_NETWORK_RETRY_DELAY_MS = 1e3;
+function isPersistentGitPushFailure(e) {
+  const msg = `${e instanceof Error ? e.message : String(e)} ${String(e.stderr ?? "")}`;
+  return /non-fast-forward|\[rejected\]|failed to push|protected branch|hook declined|permission denied|could not read Username|authentication failed|Authentication failed|403 Forbidden|GH006|GH013/i.test(msg);
+}
+async function runGitWithRetry(deps, args, shouldRetry) {
+  const sleep = resolveSleep(deps);
+  let lastError;
+  for (let attempt = 1; attempt <= GIT_NETWORK_ATTEMPTS; attempt++) {
+    try {
+      return await deps.run("git", args);
+    } catch (e) {
+      lastError = e;
+      if (attempt >= GIT_NETWORK_ATTEMPTS || !shouldRetry(e)) throw e;
+      await sleep(GIT_NETWORK_RETRY_DELAY_MS * attempt);
+    }
+  }
+  throw lastError;
+}
+function runGitRemoteRead(deps, args) {
+  return runGitWithRetry(deps, args, () => true);
+}
+function runGitPush(deps, args) {
+  return runGitWithRetry(deps, args, (e) => !isPersistentGitPushFailure(e));
+}
 var TRAIN_CHECK_RUNS_JQ = "[.check_runs[]|{name:.name,status:.status,conclusion:.conclusion,startedAt:.started_at}]";
 var TRAIN_COMMIT_STATUS_JQ = "[.statuses[]|{context:.context,state:.state}]";
 var TRAIN_PROTECTION_CONTEXTS_JQ = "[.contexts[]]";
@@ -10312,9 +10351,12 @@ Recovery sequence:
 Do not delete or force-move the pushed tag; rerun the train only after confirming the branch, release, and deploy states above.`
   );
 }
-async function ensureTagPushed(deps, tag, sha) {
-  const remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]);
-  const remoteSha = clean(remoteOut).split(/\s+/)[0] || "";
+async function probeRemoteTag(deps, tag) {
+  const remoteOut = await runGitRemoteRead(deps, ["ls-remote", "origin", `refs/tags/${tag}`]);
+  return clean(remoteOut).split(/\s+/)[0] || "";
+}
+async function ensureTagPushed(deps, tag, sha, probed) {
+  const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
   let localSha = "";
   try {
     localSha = clean(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
@@ -10335,11 +10377,14 @@ async function ensureTagPushed(deps, tag, sha) {
     throw new Error(`local tag ${tag} already points at ${localSha}, not the intended ${sha} \u2014 delete the stale local tag (git tag -d ${tag}) and rerun`);
   }
   if (!localSha) await deps.run("git", ["tag", tag, sha]);
-  await deps.run("git", ["push", "origin", tag]);
+  await runGitPush(deps, ["push", "origin", tag]);
   return { note: `tag ${tag} pushed at ${sha.slice(0, 7)}`, pushed: true };
 }
-async function resolveRcResumeTag(deps, base, sha) {
-  const out = await deps.run("git", ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
+function probeRcResumeTags(deps, base) {
+  return runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
+}
+async function resolveRcResumeTag(deps, base, sha, probed) {
+  const out = probed ?? await runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", `refs/tags/${base}-rc.*`]);
   const onSha = clean(out).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)).filter(([refSha]) => refSha === sha).map(([, ref]) => ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "")).filter((ref) => new RegExp(`^${base.replace(/\./g, "\\.")}-rc\\.\\d+$`).test(ref));
   const unique = [...new Set(onSha)];
   if (unique.length === 0) return { tag: null };
@@ -10590,6 +10635,49 @@ Recovery sequence:
 ${steps.join("\n")}`
   );
 }
+async function recoverFailedRcand(deps, cause, preRcSha) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  const branch = await currentBranch(deps).catch(() => "");
+  const mergeInProgress = await deps.run("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).then(() => true).catch(() => false);
+  if (mergeInProgress) {
+    try {
+      await deps.run("git", ["merge", "--abort"]);
+    } catch (e) {
+      return new Error(
+        `${causeMessage}
+
+rcand failed with an in-progress merge on ${branch || "(unknown branch)"}; automatic \`git merge --abort\` failed: ${e instanceof Error ? e.message : String(e)}. Nothing was pushed to origin.
+Recovery sequence:
+  1. git merge --abort
+  2. git checkout development
+  3. git branch -f rc origin/rc`
+      );
+    }
+  }
+  const rcSha = await deps.run("git", ["rev-parse", "rc"]).then(clean).catch(() => "");
+  const rcDescends = Boolean(preRcSha) && Boolean(rcSha) ? await deps.run("git", ["merge-base", "--is-ancestor", preRcSha, "rc"]).then(() => true).catch(() => false) : false;
+  if (branch === "rc" && rcDescends) {
+    try {
+      await deps.run("git", ["reset", "--hard", preRcSha]);
+      await deps.run("git", ["checkout", "development"]);
+      return new Error(
+        `${causeMessage}
+
+rcand failed after \`git checkout rc\`; local rc was reset to its pre-merge state (${shaLabel(preRcSha)}) and the checkout returned to development. Nothing was pushed to origin. Rerun \`mmi-cli rcand --apply\`.`
+      );
+    } catch {
+    }
+  }
+  return new Error(
+    `${causeMessage}
+
+rcand failed leaving the checkout on ${branch || "(unknown)"} (pre-merge rc=${preRcSha ? shaLabel(preRcSha) : "not captured"}). Nothing was pushed to origin.
+Recovery sequence:
+  1. git checkout development
+  2. git branch -f rc origin/rc   # discard the unpushed local rc merge
+  3. mmi-cli rcand --apply`
+  );
+}
 async function recoverFailedFold(deps, cause, startBranch, preFoldMainSha) {
   const causeMessage = cause instanceof Error ? cause.message : String(cause);
   const probe = await probeFoldFailureState(deps);
@@ -10641,8 +10729,13 @@ async function runFoldStage(deps, startBranch, preFold, fn) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
   }
 }
-async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha) {
-  const tagPush = await ensureTagPushed(deps, tag, releaseSha);
+async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe) {
+  let tagPush;
+  try {
+    tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe);
+  } catch (e) {
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+  }
   const tagPushSince = (deps.now ?? Date.now)();
   const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
   let checks;
@@ -10651,7 +10744,7 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   } catch (e) {
     throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main" });
   }
-  await deps.run("git", ["push", "origin", "main"]);
+  await runGitPush(deps, ["push", "origin", "main"]);
   const releaseUrl = clean(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
@@ -10692,14 +10785,24 @@ async function runTrainApplyPipeline(mode, input) {
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
     const releaseBase = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
     await releaseRcBranchLock(deps);
+    const rcTagProbe = await probeRcResumeTags(deps, releaseBase);
     await deps.run("git", ["checkout", "rc"]);
     await ffOnlyPull(deps, "rc");
-    await deps.run("git", ["merge", "development", "--no-edit"]);
-    const rcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
-    const resume = await resolveRcResumeTag(deps, releaseBase, rcSha);
-    const tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+    const preRcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "pre-merge rc sha");
+    let rcSha;
+    let resume;
+    let tag2;
+    let tagPush;
+    try {
+      await deps.run("git", ["merge", "development", "--no-edit"]);
+      rcSha = requireValue(clean(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
+      resume = await resolveRcResumeTag(deps, releaseBase, rcSha, rcTagProbe);
+      tag2 = resume.tag ?? requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+      tagPush = await ensureTagPushed(deps, tag2, rcSha);
+    } catch (e) {
+      throw await recoverFailedRcand(deps, e, preRcSha);
+    }
     const resumeNote = resume.tag ? resume.note : void 0;
-    const tagPush = await ensureTagPushed(deps, tag2, rcSha);
     const tagPushSince = (deps.now ?? Date.now)();
     const requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
     let checks2;
@@ -10709,7 +10812,7 @@ async function runTrainApplyPipeline(mode, input) {
       throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc" });
     }
     const autoRunSince = (deps.now ?? Date.now)();
-    await deps.run("git", ["push", "origin", "rc"]);
+    await runGitPush(deps, ["push", "origin", "rc"]);
     const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
     return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus };
   }
@@ -10741,6 +10844,7 @@ async function runTrainApplyPipeline(mode, input) {
       "development -> main merge would conflict on untolerated path(s)",
       "The train is misaligned: reconcile main and development via an approved alignment PR, then rerun release."
     );
+    const tagProbe2 = { remoteSha: await probeRemoteTag(deps, tag2) };
     const preFold2 = {};
     const { versionFold: versionFold2, releaseSha: releaseSha2 } = await runFoldStage(deps, "development", preFold2, async () => {
       await executeMergeToMain(deps, "development", "development -> main", tolerated2, predicted2, preFold2);
@@ -10748,7 +10852,7 @@ async function runTrainApplyPipeline(mode, input) {
       const releaseSha3 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
       return { versionFold: versionFold3, releaseSha: releaseSha3 };
     });
-    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2);
+    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2, "development", preFold2, tagProbe2);
     const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
     if (directTrack) {
       return {
@@ -10824,15 +10928,16 @@ async function runTrainApplyPipeline(mode, input) {
     );
   }
   const releasedRcSha = clean(await deps.run("git", ["rev-parse", "origin/rc"]));
+  const tag = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
+  const tagProbe = { remoteSha: await probeRemoteTag(deps, tag) };
   const preFold = {};
-  const { tag, versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
+  const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
     await executeMergeToMain(deps, "rc", "rc -> main", tolerated, predicted, preFold);
-    const tag2 = requireValue(clean(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
-    const versionFold2 = await foldReleaseVersion(deps, deployModel, tag2, foldPaths);
+    const versionFold2 = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
     const releaseSha2 = requireValue(clean(await deps.run("git", ["rev-parse", "main"])), "release sha");
-    return { tag: tag2, versionFold: versionFold2, releaseSha: releaseSha2 };
+    return { versionFold: versionFold2, releaseSha: releaseSha2 };
   });
-  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha);
+  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, "rc", preFold, tagProbe);
   const retirement = await retireRcRuntime(deps, ctx, deployModel, d.deployStatus, releasedRcSha);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   const rcAlignment = await pushRcAlignment(deps);
@@ -10866,7 +10971,7 @@ async function runTrainApply(command, deps, options = {}) {
   const watch = options.watch ?? false;
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
-  await deps.run("git", ["fetch", "origin"]);
+  await runGitRemoteRead(deps, ["fetch", "origin"]);
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
@@ -13659,6 +13764,11 @@ function parseFofuEnabledVar(raw) {
   if (raw === "false") return false;
   throw new Error("project set: fofuEnabled must be true or false");
 }
+function parseRuntimeVaultOnlyVar(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error("project set: runtimeVaultOnly must be true or false");
+}
 function parseConsumesDesignSystemVar(raw) {
   if (raw === "fofu") return raw;
   throw new Error('project set: consumesDesignSystem must be "fofu"');
@@ -13736,6 +13846,7 @@ var SETTABLE_VAR_KEYS = [
   "dsManifestPath",
   "fofuEnabled",
   "consumesDesignSystem",
+  "runtimeVaultOnly",
   "requiredGcpApis",
   "requiredRuntimeSecrets",
   "requiredBuildSecrets",
@@ -13758,6 +13869,7 @@ var SETTABLE_VAR_HINTS = {
   dsManifestPath: "relative path to a package.json, e.g. web/package.json",
   fofuEnabled: "true|false",
   consumesDesignSystem: '"fofu"',
+  runtimeVaultOnly: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath,fofuSubdomain}",
   requiredGcpApis: "comma-string",
@@ -13839,6 +13951,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parsePublishRequiredVar(raw);
     } else if (key === "fofuEnabled") {
       patch[key] = parseFofuEnabledVar(raw);
+    } else if (key === "runtimeVaultOnly") {
+      patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "consumesDesignSystem") {
       patch[key] = parseConsumesDesignSystemVar(raw);
     } else if (key === "publishDir") {
@@ -20887,7 +21001,11 @@ function trainApplyDeps() {
   return {
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+      try {
+        return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+      } catch (e) {
+        throw surfaceTrainSubprocessFailure(e, file, args);
+      }
     },
     runSelf: async (args) => (await execFileP2(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
     trainAuthority: async (repo) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.8.0",
+  "version": "3.9.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",