@mutmutco/cli 3.83.0 → 3.84.0

package/dist/main.cjs

@@ -8624,16 +8624,33 @@ function partialTrainRecoveryError(cause, input) {
   const resumeCommand = input.stage === "rc" ? "mmi-cli rcand --resume" : "mmi-cli release --resume";
   const tenant2 = input.deployModel === "tenant-container";
   const deployLine = tenant2 ? `  - deploy: dispatched by the train after the branch push; recover with \`mmi-cli runtime tenant redeploy ${input.repo} ${input.stage} --watch\` once the branch and release exist.` : `  - deploy: this repo is \`${input.deployModel ?? "not tenant-container"}\` \u2014 it has NO tenant runtime. Its own release/main-push workflows publish and deploy once the branch and Release exist. Do NOT run the tenant redeployer.`;
-  return new Error(
-    `${causeMessage}
-
-partial train state for ${input.tag}:
+  const stateBlock = `partial train state for ${input.tag}:
   - tag ${input.tag}: PUSHED to origin
   - origin/${branch}: NOT pushed
   - ${releaseState}
-` + deployLine + `
+` + deployLine;
+  const failedHubMainGate = input.stage === "main" && input.repo.toLowerCase() === HUB_REPO.toLowerCase() && /^required train check failed:/i.test(causeMessage);
+  if (failedHubMainGate) {
+    return new Error(
+      `${causeMessage}
+
+` + stateBlock + `
 
-The tag is public and correct \u2014 do not delete or force-move it.
+The tag is public and immutable, but it FAILED a required gate. Do not resume it unchanged: \`${resumeCommand}\` cannot alter tagged code or make the failed check pass.
+
+Diagnose the failed check, then choose the proven recovery:
+  - transient workflow failure: rerun the failed tag workflow; only after it passes, use \`${resumeCommand}\`.
+  - tagged-code defect: obtain fresh destructive approval to remove ${input.tag}, run \`mmi-cli release --abort --apply\`, repair development, and cut the release again through the guarded train.
+
+Do not push main or create the GitHub Release by hand.`
+    );
+  }
+  return new Error(
+    `${causeMessage}
+
+` + stateBlock + `
+
+The tag is public and immutable \u2014 do not delete or force-move it.
 
 Resume it:  ${resumeCommand}
 
@@ -23049,7 +23066,7 @@ function renderBootstrapVerifyReport(report) {
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
 var ORG_LOGIN = "mutmutco";
-var ORG_NO_AGENT_FILES_EXCLUDED_REPOS = ["Jerv-PowerTools"];
+var ORG_NO_AGENT_FILES_EXCLUDED_REPOS = ["Jerv-PowerTools", "Jerv-JervCode"];
 var NO_AGENT_FILES_GLOBS = [
   "AGENTS.md",
   "**/AGENTS.md",
@@ -23126,8 +23143,8 @@ OK \u2014 live ruleset matches the codified IaC (${NO_AGENT_FILES_GLOBS.length}
     `${head}`,
     verb,
     ...plan.drift.map((d) => `  - ${d}`),
-    "This command is read-only; it never mutates the live ruleset. Recreate/repair via the GitHub UI or a",
-    "deliberate POST/PUT of orgNoAgentFilesRulesetDesired() \u2014 see cli/src/bootstrap-org-ruleset.ts."
+    "Read-only preview \u2014 a master-admin may reconcile this exact desired state with",
+    "`mmi-cli bootstrap org-ruleset --apply`."
   ].join("\n");
 }
 async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
@@ -23136,6 +23153,27 @@ async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
   if (summary?.id == null) return null;
   return await client.rest("GET", `orgs/${org}/rulesets/${summary.id}`, { timeoutMs: 2e4 }) ?? null;
 }
+async function reconcileOrgNoAgentFilesRuleset(plan, client, org = ORG_LOGIN) {
+  if (plan.action === "noop") {
+    return { action: "noop", id: plan.id, verified: true, desired: plan.desired };
+  }
+  if (plan.action === "create") {
+    await client.rest("POST", `orgs/${org}/rulesets`, { body: plan.desired, timeoutMs: 2e4 });
+  } else {
+    if (plan.id == null) throw new Error(`cannot update '${plan.desired.name}': live ruleset id is missing`);
+    await client.rest("PUT", `orgs/${org}/rulesets/${plan.id}`, { body: plan.desired, timeoutMs: 2e4 });
+  }
+  const verified = planOrgNoAgentFilesRuleset(await fetchOrgNoAgentFilesRuleset(client, org));
+  if (verified.action !== "noop") {
+    throw new Error(`org ruleset reconcile did not settle: ${verified.drift.join("; ")}`);
+  }
+  return {
+    action: plan.action === "create" ? "created" : "updated",
+    id: verified.id,
+    verified: true,
+    desired: verified.desired
+  };
+}
 
 // src/bootstrap-commands.ts
 function registerBootstrapCommands(program3) {
@@ -23190,13 +23228,28 @@ function registerBootstrapCommands(program3) {
     console.log(o.json ? JSON.stringify(report, null, 2) : renderBootstrapVerifyReport(report));
     if (!report.ok) process.exitCode = 1;
   });
-  bootstrap.command("org-ruleset").description("drift-check the codified org no-agent-files push ruleset (mmi-no-agent-files-org) against live; read-only, never mutates (#2196)").option("--json", "machine-readable output").action(async () => {
+  bootstrap.command("org-ruleset").description("drift-check the codified org no-agent-files push ruleset; optionally reconcile it under master authority (#2196/#4001)").option("--json", "machine-readable output").option("--apply", "create or update the one named org ruleset to exact desired state (master-admin required)").action(async () => {
     const json = rawFlag("--json");
-    const live = await fetchOrgNoAgentFilesRuleset(defaultGitHubClient());
+    const apply = rawFlag("--apply");
+    const client = defaultGitHubClient();
+    const live = await fetchOrgNoAgentFilesRuleset(client);
     const plan = planOrgNoAgentFilesRuleset(live);
-    if (json) console.log(JSON.stringify({ action: plan.action, id: plan.id, drift: plan.drift, desired: plan.desired }, null, 2));
-    else console.log(renderOrgRulesetDriftReport(plan));
-    if (plan.action !== "noop") process.exitCode = 1;
+    if (!apply) {
+      if (json) console.log(JSON.stringify({ action: plan.action, id: plan.id, drift: plan.drift, desired: plan.desired }, null, 2));
+      else console.log(renderOrgRulesetDriftReport(plan));
+      if (plan.action !== "noop") process.exitCode = 1;
+      return;
+    }
+    const verdict = await fetchTrainAuthority("mutmutco/MMI-Hub", registryClientDeps(await loadConfig()));
+    if (!verdict.ok || verdict.authority.role !== "master") {
+      return fail("bootstrap org-ruleset --apply: master-admin required");
+    }
+    const result = await reconcileOrgNoAgentFilesRuleset(plan, client);
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`mmi-cli bootstrap org-ruleset --apply: ${result.action}`);
+      console.log(renderOrgRulesetDriftReport(planOrgNoAgentFilesRuleset(await fetchOrgNoAgentFilesRuleset(client))));
+    }
   });
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
@@ -25622,10 +25675,13 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
     await execFileP2("git", fullArgs, { timeout: timeoutMs });
     return { step, status: "done" };
   } catch (e) {
-    const msg = e.message.split("\n")[0];
-    if (/not found|already|no such|does not exist|not a valid|couldn't|unable to resolve/i.test(msg)) {
+    const err = e;
+    const detail = `${err.message}
+${err.stderr ?? ""}`;
+    if (/not found|already|no such|does not exist|not a valid|couldn't|unable to resolve/i.test(detail)) {
       return { step, status: "already gone" };
     }
+    const msg = (err.stderr?.trim() || err.message).split("\n")[0];
     return { step, status: `failed: ${msg}` };
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.83.0",
+  "version": "3.84.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",