@mutmutco/cli 3.83.0 → 3.85.0

package/dist/main.cjs

@@ -3415,7 +3415,7 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_node_fs36 = require("node:fs");
 var import_node_child_process16 = require("node:child_process");
 
@@ -3982,10 +3982,10 @@ var import_node_fs4 = require("node:fs");
 var injectedStdin;
 function stdinHasPipedInput(statFd = () => (0, import_node_fs4.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
   try {
-    const stat2 = statFd();
-    if (stat2.isFIFO() || stat2.isFile()) return true;
-    if (stat2.isCharacterDevice()) return false;
-    if (stat2.isSocket()) return false;
+    const stat3 = statFd();
+    if (stat3.isFIFO() || stat3.isFile()) return true;
+    if (stat3.isCharacterDevice()) return false;
+    if (stat3.isSocket()) return false;
     if (getIsTTY() === true) return false;
     return true;
   } catch {
@@ -4502,9 +4502,9 @@ function trackedPathStatus(c, realPath, repoAnchor) {
     return null;
   }
 }
-function rootScratchDirSnapshot(root, readdir2, stat2) {
+function rootScratchDirSnapshot(root, readdir2, stat3) {
   try {
-    const rootStat = stat2(root);
+    const rootStat = stat3(root);
     let mtimeMs = rootStat.mtimeMs;
     let bytes = 0;
     const stack = [root];
@@ -4518,7 +4518,7 @@ function rootScratchDirSnapshot(root, readdir2, stat2) {
           return null;
         } catch {
         }
-        const st = stat2(child2);
+        const st = stat3(child2);
         mtimeMs = Math.max(mtimeMs, st.mtimeMs);
         if (ent.isDirectory()) stack.push(child2);
         else if (ent.isFile()) bytes += st.size;
@@ -4531,7 +4531,7 @@ function rootScratchDirSnapshot(root, readdir2, stat2) {
 }
 function collectScratchSnapshot(repoRoot2, deps = {}) {
   const readdir2 = deps.readdir ?? import_node_fs6.readdirSync;
-  const stat2 = deps.stat ?? import_node_fs6.statSync;
+  const stat3 = deps.stat ?? import_node_fs6.statSync;
   const plansRoot = (0, import_node_path4.join)(repoRoot2, "plans");
   const rootScratchFiles = [];
   try {
@@ -4544,10 +4544,10 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       const full = (0, import_node_path4.join)(repoRoot2, ent.name);
       try {
         if (isDir) {
-          const snap = rootScratchDirSnapshot(full, readdir2, stat2);
+          const snap = rootScratchDirSnapshot(full, readdir2, stat3);
           if (snap) rootScratchFiles.push({ path: full, dir: repoRoot2, name: ent.name, mtimeMs: snap.mtimeMs, bytes: snap.bytes, kind: "dir" });
         } else {
-          const st = stat2(full);
+          const st = stat3(full);
           rootScratchFiles.push({ path: full, dir: repoRoot2, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file" });
         }
       } catch {
@@ -4561,7 +4561,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       if (!ent.isFile() || !ent.name.endsWith(".md")) continue;
       const full = (0, import_node_path4.join)(plansRoot, ent.name);
       try {
-        const st = stat2(full);
+        const st = stat3(full);
         planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file" });
       } catch {
       }
@@ -7978,6 +7978,7 @@ function parseVerifyBroker(stdout) {
 
 // src/train-apply.ts
 var import_node_fs13 = require("node:fs");
+var import_promises2 = require("node:fs/promises");
 var import_node_path12 = require("node:path");
 function resolveDeployModel2(meta, repo) {
   const m = meta?.deployModel;
@@ -8624,16 +8625,33 @@ function partialTrainRecoveryError(cause, input) {
   const resumeCommand = input.stage === "rc" ? "mmi-cli rcand --resume" : "mmi-cli release --resume";
   const tenant2 = input.deployModel === "tenant-container";
   const deployLine = tenant2 ? `  - deploy: dispatched by the train after the branch push; recover with \`mmi-cli runtime tenant redeploy ${input.repo} ${input.stage} --watch\` once the branch and release exist.` : `  - deploy: this repo is \`${input.deployModel ?? "not tenant-container"}\` \u2014 it has NO tenant runtime. Its own release/main-push workflows publish and deploy once the branch and Release exist. Do NOT run the tenant redeployer.`;
-  return new Error(
-    `${causeMessage}
-
-partial train state for ${input.tag}:
+  const stateBlock = `partial train state for ${input.tag}:
   - tag ${input.tag}: PUSHED to origin
   - origin/${branch}: NOT pushed
   - ${releaseState}
-` + deployLine + `
+` + deployLine;
+  const failedHubMainGate = input.stage === "main" && input.repo.toLowerCase() === HUB_REPO.toLowerCase() && /^required train check failed:/i.test(causeMessage);
+  if (failedHubMainGate) {
+    return new Error(
+      `${causeMessage}
+
+` + stateBlock + `
+
+The tag is public and immutable, but it FAILED a required gate. Do not resume it unchanged: \`${resumeCommand}\` cannot alter tagged code or make the failed check pass.
 
-The tag is public and correct \u2014 do not delete or force-move it.
+Diagnose the failed check, then choose the proven recovery:
+  - transient workflow failure: rerun the failed tag workflow; only after it passes, use \`${resumeCommand}\`.
+  - tagged-code defect: obtain fresh destructive approval to remove ${input.tag}, run \`mmi-cli release --abort --apply\`, repair development, and cut the release again through the guarded train.
+
+Do not push main or create the GitHub Release by hand.`
+    );
+  }
+  return new Error(
+    `${causeMessage}
+
+` + stateBlock + `
+
+The tag is public and immutable \u2014 do not delete or force-move it.
 
 Resume it:  ${resumeCommand}
 
@@ -8998,35 +9016,41 @@ async function executeMergeToMain(deps, sourceRef, mergeLabel, tolerated, predic
   }
 }
 async function probeFoldFailureState(deps) {
-  const branch = await currentBranch(deps);
+  const branch = await currentBranch(deps).catch(() => "");
   const mergeInProgress = await deps.run("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).then(() => true).catch(() => false);
-  const dirty = porcelainHasBlockingChanges(await deps.run("git", ["status", "--porcelain"]).catch(() => ""));
+  const headSha = await deps.run("git", ["rev-parse", "HEAD"]).then(clean2).catch(() => "");
+  const status = await deps.run("git", ["status", "--porcelain=v1"]).then(clean2).catch((e) => `(unavailable: ${e instanceof Error ? e.message : String(e)})`);
   const mainSha = await deps.run("git", ["rev-parse", "main"]).then(clean2).catch(() => "");
   const originMainSha = await deps.run("git", ["rev-parse", "origin/main"]).then(clean2).catch(() => "");
   const originIsAncestorOfMain = Boolean(mainSha) && Boolean(originMainSha) ? await deps.run("git", ["merge-base", "--is-ancestor", "origin/main", "main"]).then(() => true).catch(() => false) : false;
-  return { branch, mergeInProgress, dirty, mainSha, originMainSha, originIsAncestorOfMain };
+  return { branch, mergeInProgress, headSha, status, mainSha, originMainSha, originIsAncestorOfMain };
 }
 function shaLabel(sha) {
   return sha ? sha.slice(0, 7) : "(unknown)";
 }
-async function finishFoldAutoRestore(deps, causeMessage, startBranch, what) {
+async function finishFoldAutoRestore(deps, causeMessage, startBranch, preFoldMainSha, resumeCommand, what) {
   try {
     await deps.run("git", ["checkout", startBranch]);
   } catch (e) {
-    return new Error(
+    return foldFailureGuidance(
       `${causeMessage}
 
-fold failed; ${what}, but returning to ${startBranch} afterwards failed: ${e instanceof Error ? e.message : String(e)}. Finish manually: git checkout ${startBranch}`
+fold failed; ${what}, but returning to ${startBranch} afterwards failed: ${e instanceof Error ? e.message : String(e)}.`,
+      await probeFoldFailureState(deps),
+      startBranch,
+      preFoldMainSha,
+      `git checkout ${startBranch}`,
+      resumeCommand
     );
   }
   return new Error(
     `${causeMessage}
 
-fold failed; ${what} and the checkout was returned to ${startBranch}. Nothing was pushed to origin and no tag was created \u2014 rerun the release once the fold issue above is fixed.`
+fold failed; ${what} and the checkout was returned to ${startBranch}. Nothing was pushed to origin and no tag was created \u2014 rerun with \`${resumeCommand}\` once the fold issue above is fixed.`
   );
 }
-function foldFailureGuidance(causeMessage, probe, startBranch, preFoldMainSha) {
-  const steps = preFoldMainSha ? [
+function foldFailureGuidance(causeMessage, probe, startBranch, preFoldMainSha, nextCommand, resumeCommand = "mmi-cli release --apply", foldStarted = true) {
+  const steps = !foldStarted ? [`  1. Resolve or wait out the git index lock`, `  2. ${resumeCommand}`] : nextCommand === "git merge --abort" ? [`  1. git merge --abort`, `  2. git checkout ${startBranch}`, `  3. ${resumeCommand}`] : nextCommand === `git checkout ${startBranch}` ? [`  1. git checkout ${startBranch}`, `  2. ${resumeCommand}`] : preFoldMainSha ? [
     `  1. git status                              # inspect what is actually there`,
     `  2. git log --oneline ${preFoldMainSha}..main   # commits beyond the pre-fold main \u2014 confirm they are only this run's merge/fold attempt`,
     `  3. git checkout main && git reset --hard ${preFoldMainSha}   # back to the exact commit the fold built on`,
@@ -9036,14 +9060,60 @@ function foldFailureGuidance(causeMessage, probe, startBranch, preFoldMainSha) {
     `  2. git log --oneline origin/main..main     # this run never committed to main (it failed before the merge) \u2014 any commits here predate this run; preserve them`,
     `  3. git checkout ${startBranch}`
   ];
+  const exactNextCommand = nextCommand ?? "git status";
   return new Error(
     `${causeMessage}
 
-fold failed leaving the checkout in a state train --apply will not auto-restore (branch=${probe.branch || "(unknown)"}, dirty-working-tree=${probe.dirty}, main=${shaLabel(probe.mainSha)}, origin/main=${shaLabel(probe.originMainSha)}, pre-fold main=${preFoldMainSha ? shaLabel(preFoldMainSha) : "not captured"}, origin/main is${probe.originIsAncestorOfMain ? "" : " NOT"} an ancestor of main). Nothing was pushed to origin and no tag was created.
+fold failed leaving the checkout in a state train --apply will not auto-restore (branch=${probe.branch || "(unknown)"}, main=${shaLabel(probe.mainSha)}, origin/main=${shaLabel(probe.originMainSha)}, pre-fold main=${preFoldMainSha ? shaLabel(preFoldMainSha) : "not captured"}, origin/main is${probe.originIsAncestorOfMain ? "" : " NOT"} an ancestor of main). Nothing was pushed to origin and no tag was created.
+Resumable state:
+  current branch: ${probe.branch || "(unknown)"}
+  HEAD: ${probe.headSha || "(unknown)"}
+  pre-fold main: ${preFoldMainSha || "(not captured)"}
+  index/worktree status:
+    ${probe.status || "(clean)"}
+Next command: ${exactNextCommand}
+Resume command after the checkout is clean: ${resumeCommand}
 Recovery sequence:
 ${steps.join("\n")}`
   );
 }
+var GIT_INDEX_LOCK_WAIT_MS = 5e3;
+var GIT_INDEX_LOCK_POLL_MS = 100;
+async function waitForFoldIndexLock(deps, startBranch, resumeCommand) {
+  const preFoldMainSha = await deps.run("git", ["rev-parse", "main"]).then(clean2).catch(() => void 0);
+  const lockPath = requireValue(clean2(await deps.run("git", ["rev-parse", "--git-path", "index.lock"])), "git index lock path");
+  const now = deps.now ?? Date.now;
+  const sleep3 = resolveSleep(deps);
+  const deadline = now() + GIT_INDEX_LOCK_WAIT_MS;
+  for (; ; ) {
+    try {
+      await (0, import_promises2.stat)(lockPath);
+    } catch (e) {
+      if (e.code === "ENOENT") return;
+      throw foldFailureGuidance(
+        `release fold could not inspect git index lock ${lockPath}: ${e instanceof Error ? e.message : String(e)}`,
+        await probeFoldFailureState(deps),
+        startBranch,
+        preFoldMainSha,
+        resumeCommand,
+        resumeCommand,
+        false
+      );
+    }
+    if (now() >= deadline) {
+      throw foldFailureGuidance(
+        `release fold waited ${GIT_INDEX_LOCK_WAIT_MS}ms for active git index lock ${lockPath}; it is still held. The fold did not start. Do not delete the lock; let its owning git process finish.`,
+        await probeFoldFailureState(deps),
+        startBranch,
+        preFoldMainSha,
+        resumeCommand,
+        resumeCommand,
+        false
+      );
+    }
+    await sleep3(Math.min(GIT_INDEX_LOCK_POLL_MS, Math.max(1, deadline - now())));
+  }
+}
 async function recoverFailedRcand(deps, cause, preRcSha) {
   const causeMessage = cause instanceof Error ? cause.message : String(cause);
   const branch = await currentBranch(deps).catch(() => "");
@@ -9087,23 +9157,25 @@ Recovery sequence:
   3. mmi-cli rcand --apply`
   );
 }
-async function recoverFailedFold(deps, cause, startBranch, preFoldMainSha) {
+async function recoverFailedFold(deps, cause, startBranch, preFoldMainSha, resumeCommand) {
   const causeMessage = cause instanceof Error ? cause.message : String(cause);
   const probe = await probeFoldFailureState(deps);
   if (probe.mergeInProgress) {
     try {
       await deps.run("git", ["merge", "--abort"]);
     } catch (e) {
-      return new Error(
+      return foldFailureGuidance(
         `${causeMessage}
 
-fold failed with an in-progress merge left on ${probe.branch || "(unknown branch)"}; automatic \`git merge --abort\` failed: ${e instanceof Error ? e.message : String(e)}. Nothing was pushed to origin and no tag was created.
-Recovery sequence:
-  1. git merge --abort
-  2. git checkout ${startBranch}`
+fold failed with an in-progress merge; automatic \`git merge --abort\` failed: ${e instanceof Error ? e.message : String(e)}.`,
+        await probeFoldFailureState(deps),
+        startBranch,
+        preFoldMainSha,
+        "git merge --abort",
+        resumeCommand
       );
     }
-    return finishFoldAutoRestore(deps, causeMessage, startBranch, "the in-progress merge was aborted");
+    return finishFoldAutoRestore(deps, causeMessage, startBranch, preFoldMainSha, resumeCommand, "the in-progress merge was aborted");
   }
   if (probe.branch === "main" && preFoldMainSha) {
     const mainDescendsFromPreFold = await deps.run("git", ["merge-base", "--is-ancestor", preFoldMainSha, "main"]).then(() => true).catch(() => false);
@@ -9111,13 +9183,15 @@ Recovery sequence:
       try {
         await deps.run("git", ["reset", "--hard", preFoldMainSha]);
       } catch (e) {
-        return new Error(
+        return foldFailureGuidance(
           `${causeMessage}
 
-fold failed after this run's merge/fold committed locally on main (now ${shaLabel(probe.mainSha)}, unpushed, built on the pre-fold main ${shaLabel(preFoldMainSha)}); automatic \`git reset --hard ${shaLabel(preFoldMainSha)}\` failed: ${e instanceof Error ? e.message : String(e)}. Nothing was pushed to origin and no tag was created.
-Recovery sequence:
-  1. git reset --hard ${preFoldMainSha}
-  2. git checkout ${startBranch}`
+fold failed after this run's merge/fold committed locally on main; automatic \`git reset --hard ${shaLabel(preFoldMainSha)}\` failed: ${e instanceof Error ? e.message : String(e)}.`,
+          await probeFoldFailureState(deps),
+          startBranch,
+          preFoldMainSha,
+          `git reset --hard ${preFoldMainSha}`,
+          resumeCommand
         );
       }
       const aheadNote = probe.originMainSha && preFoldMainSha !== probe.originMainSha ? `; local main carried commit(s) origin/main (${shaLabel(probe.originMainSha)}) does not have \u2014 they were preserved` : "";
@@ -9125,17 +9199,20 @@ Recovery sequence:
         deps,
         causeMessage,
         startBranch,
+        preFoldMainSha,
+        resumeCommand,
         `local main was reset to its pre-fold state ${shaLabel(preFoldMainSha)} (discarding only this run's merge/fold commit(s) at ${shaLabel(probe.mainSha)})${aheadNote}`
       );
     }
   }
-  return foldFailureGuidance(causeMessage, probe, startBranch, preFoldMainSha);
+  return foldFailureGuidance(causeMessage, probe, startBranch, preFoldMainSha, void 0, resumeCommand);
 }
-async function runFoldStage(deps, startBranch, preFold, fn) {
+async function runFoldStage(deps, startBranch, preFold, resumeCommand, fn) {
+  await waitForFoldIndexLock(deps, startBranch, resumeCommand);
   try {
     return await fn();
   } catch (e) {
-    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
   }
 }
 async function verifyPublishDryRun(deps, ctx, meta, deployModel) {
@@ -9194,30 +9271,31 @@ async function gateTrueMergeCommit(deps, ctx, tag, releaseSha, requiredChecks) {
   }
 }
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe) {
+  const resumeCommand = options.dev ? "mmi-cli release --dev --apply" : "mmi-cli release --apply";
   try {
     await verifyPublishDryRun(deps, ctx, meta, deployModel);
   } catch (e) {
-    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
   }
   let requiredChecks;
   try {
     requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "main");
   } catch (e) {
-    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
   }
   let trueMergeGateNote;
   if (preFold.isTrueMerge) {
     try {
       trueMergeGateNote = await gateTrueMergeCommit(deps, ctx, tag, releaseSha, requiredChecks);
     } catch (e) {
-      throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+      throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
     }
   }
   let tagPush;
   try {
     tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe, ctx.repo);
   } catch (e) {
-    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha);
+    throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
   }
   const tagPushSince = (deps.now ?? Date.now)();
   let checks;
@@ -9623,7 +9701,8 @@ async function runTrainApplyPipeline(mode, input) {
     );
     const tagProbe2 = { remoteSha: await probeRemoteTag(deps, tag2) };
     const preFold2 = {};
-    const { versionFold: versionFold2, releaseSha: releaseSha2 } = await runFoldStage(deps, "development", preFold2, async () => {
+    const resumeCommand = options.dev ? "mmi-cli release --dev --apply" : "mmi-cli release --apply";
+    const { versionFold: versionFold2, releaseSha: releaseSha2 } = await runFoldStage(deps, "development", preFold2, resumeCommand, async () => {
       await executeMergeToMain(deps, "development", "development -> main", tolerated2, predicted2, preFold2);
       const versionFold3 = await foldReleaseVersion(deps, deployModel2, tag2, foldPaths2);
       const releaseSha3 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
@@ -9708,7 +9787,7 @@ async function runTrainApplyPipeline(mode, input) {
   const tag = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
   const tagProbe = { remoteSha: await probeRemoteTag(deps, tag) };
   const preFold = {};
-  const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, async () => {
+  const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, "mmi-cli release --apply", async () => {
     await executeMergeToMain(deps, "rc", "rc -> main", tolerated, predicted, preFold);
     const versionFold2 = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
     const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
@@ -12186,7 +12265,7 @@ var import_node_child_process6 = require("node:child_process");
 var import_node_os4 = require("node:os");
 
 // src/gh-create.ts
-var import_promises2 = require("node:fs/promises");
+var import_promises3 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path14 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
@@ -12238,9 +12317,9 @@ async function bodyArgsViaFile(args, deps = {}) {
   const i = args.indexOf("--body");
   if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
   } };
-  const write = deps.write ?? import_promises2.writeFile;
-  const remove2 = deps.remove ?? import_promises2.unlink;
-  const ensureDir = deps.ensureDir ?? import_promises2.mkdir;
+  const write = deps.write ?? import_promises3.writeFile;
+  const remove2 = deps.remove ?? import_promises3.unlink;
+  const ensureDir = deps.ensureDir ?? import_promises3.mkdir;
   const dir = deps.dir ?? (0, import_node_os3.tmpdir)();
   const file = (0, import_node_path14.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
   await ensureDir((0, import_node_path14.dirname)(file), { recursive: true }).catch(() => {
@@ -20987,7 +21066,7 @@ function formatBoxTable(boxes) {
   const addrW = w((b) => b.address || "(no public ipv4)", "ADDRESS");
   const projW = w((b) => b.project, "PROJECT");
   const statW = w((b) => b.status, "STATUS");
-  const row = (name, addr, proj, stat2, key) => `${name.padEnd(nameW)}  ${addr.padEnd(addrW)}  ${proj.padEnd(projW)}  ${stat2.padEnd(statW)}  ${key}`;
+  const row = (name, addr, proj, stat3, key) => `${name.padEnd(nameW)}  ${addr.padEnd(addrW)}  ${proj.padEnd(projW)}  ${stat3.padEnd(statW)}  ${key}`;
   const lines = [row("BOX", "ADDRESS", "PROJECT", "STATUS", "SSH KEY (vault path)")];
   for (const b of boxes) {
     lines.push(row(b.name, b.address || "(no public ipv4)", b.project, b.status, b.sshKeyPath));
@@ -21125,7 +21204,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 }
 
 // src/schedules-commands.ts
-var import_promises3 = require("node:fs/promises");
+var import_promises4 = require("node:fs/promises");
 var import_node_child_process13 = require("node:child_process");
 var import_node_util7 = require("node:util");
 
@@ -21735,9 +21814,9 @@ function registerSchedulesCommands(program3) {
           await failGraceful("org schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
           return;
         }
-        const docText = await (0, import_promises3.readFile)(o.doc, "utf8");
+        const docText = await (0, import_promises4.readFile)(o.doc, "utf8");
         const spliced = spliceDoc(docText, renderDocSection(entries, (/* @__PURE__ */ new Date()).toISOString()));
-        await (0, import_promises3.writeFile)(o.doc, spliced, "utf8");
+        await (0, import_promises4.writeFile)(o.doc, spliced, "utf8");
         reportDrift(drift);
         console.log(`org schedules: wrote ${entries.length} entries into ${o.doc}`);
         return;
@@ -21796,7 +21875,7 @@ function registerSchedulesCommands(program3) {
 }
 
 // src/file-lock.ts
-var import_promises4 = require("node:fs/promises");
+var import_promises5 = require("node:fs/promises");
 var import_node_path24 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
@@ -21821,7 +21900,7 @@ async function acquireFileLock(lockPath, opts, deadline) {
   for (; ; ) {
     let handle;
     try {
-      handle = await (0, import_promises4.open)(lockPath, "wx");
+      handle = await (0, import_promises5.open)(lockPath, "wx");
     } catch (e) {
       const code = e.code;
       if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
@@ -21830,10 +21909,10 @@ async function acquireFileLock(lockPath, opts, deadline) {
         if (++immediateRetries > IMMEDIATE_RETRY_BUDGET) await sleep(opts.retryMs);
       };
       try {
-        const age = Date.now() - (await (0, import_promises4.stat)(lockPath)).mtimeMs;
+        const age = Date.now() - (await (0, import_promises5.stat)(lockPath)).mtimeMs;
         if (age > opts.staleMs) {
           try {
-            await (0, import_promises4.unlink)(lockPath);
+            await (0, import_promises5.unlink)(lockPath);
             await retryNow();
             continue;
           } catch (unlinkError) {
@@ -21869,7 +21948,7 @@ async function acquireFileLock(lockPath, opts, deadline) {
 }
 async function fileLockHeldBy(lockPath, token) {
   try {
-    return await (0, import_promises4.readFile)(lockPath, "utf8") === token;
+    return await (0, import_promises5.readFile)(lockPath, "utf8") === token;
   } catch {
     return false;
   }
@@ -21877,12 +21956,12 @@ async function fileLockHeldBy(lockPath, token) {
 async function releaseFileLock(lockPath, guard) {
   await guard.handle.close().catch(() => void 0);
   if (await fileLockHeldBy(lockPath, guard.token)) {
-    await (0, import_promises4.unlink)(lockPath).catch(() => void 0);
+    await (0, import_promises5.unlink)(lockPath).catch(() => void 0);
   }
 }
 async function withFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises4.mkdir)((0, import_node_path24.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises5.mkdir)((0, import_node_path24.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn();
@@ -21892,7 +21971,7 @@ async function withFileLock(lockPath, opts, fn) {
 }
 
 // src/schedules-lift-command.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_path25 = require("node:path");
 
 // src/schedules-lift.ts
@@ -21992,14 +22071,14 @@ var RegistryUnreachableError = class extends Error {
 async function readWorkflowFiles(dir) {
   let names;
   try {
-    names = await (0, import_promises5.readdir)(dir);
+    names = await (0, import_promises6.readdir)(dir);
   } catch {
     return [];
   }
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises5.readFile)((0, import_node_path25.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path25.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -23049,7 +23128,7 @@ function renderBootstrapVerifyReport(report) {
 // src/bootstrap-org-ruleset.ts
 var ORG_NO_AGENT_FILES_RULESET_NAME = "mmi-no-agent-files-org";
 var ORG_LOGIN = "mutmutco";
-var ORG_NO_AGENT_FILES_EXCLUDED_REPOS = ["Jerv-PowerTools"];
+var ORG_NO_AGENT_FILES_EXCLUDED_REPOS = ["Jerv-PowerTools", "Jerv-JervCode"];
 var NO_AGENT_FILES_GLOBS = [
   "AGENTS.md",
   "**/AGENTS.md",
@@ -23126,8 +23205,8 @@ OK \u2014 live ruleset matches the codified IaC (${NO_AGENT_FILES_GLOBS.length}
     `${head}`,
     verb,
     ...plan.drift.map((d) => `  - ${d}`),
-    "This command is read-only; it never mutates the live ruleset. Recreate/repair via the GitHub UI or a",
-    "deliberate POST/PUT of orgNoAgentFilesRulesetDesired() \u2014 see cli/src/bootstrap-org-ruleset.ts."
+    "Read-only preview \u2014 a master-admin may reconcile this exact desired state with",
+    "`mmi-cli bootstrap org-ruleset --apply`."
   ].join("\n");
 }
 async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
@@ -23136,6 +23215,27 @@ async function fetchOrgNoAgentFilesRuleset(client, org = ORG_LOGIN) {
   if (summary?.id == null) return null;
   return await client.rest("GET", `orgs/${org}/rulesets/${summary.id}`, { timeoutMs: 2e4 }) ?? null;
 }
+async function reconcileOrgNoAgentFilesRuleset(plan, client, org = ORG_LOGIN) {
+  if (plan.action === "noop") {
+    return { action: "noop", id: plan.id, verified: true, desired: plan.desired };
+  }
+  if (plan.action === "create") {
+    await client.rest("POST", `orgs/${org}/rulesets`, { body: plan.desired, timeoutMs: 2e4 });
+  } else {
+    if (plan.id == null) throw new Error(`cannot update '${plan.desired.name}': live ruleset id is missing`);
+    await client.rest("PUT", `orgs/${org}/rulesets/${plan.id}`, { body: plan.desired, timeoutMs: 2e4 });
+  }
+  const verified = planOrgNoAgentFilesRuleset(await fetchOrgNoAgentFilesRuleset(client, org));
+  if (verified.action !== "noop") {
+    throw new Error(`org ruleset reconcile did not settle: ${verified.drift.join("; ")}`);
+  }
+  return {
+    action: plan.action === "create" ? "created" : "updated",
+    id: verified.id,
+    verified: true,
+    desired: verified.desired
+  };
+}
 
 // src/bootstrap-commands.ts
 function registerBootstrapCommands(program3) {
@@ -23190,13 +23290,28 @@ function registerBootstrapCommands(program3) {
     console.log(o.json ? JSON.stringify(report, null, 2) : renderBootstrapVerifyReport(report));
     if (!report.ok) process.exitCode = 1;
   });
-  bootstrap.command("org-ruleset").description("drift-check the codified org no-agent-files push ruleset (mmi-no-agent-files-org) against live; read-only, never mutates (#2196)").option("--json", "machine-readable output").action(async () => {
+  bootstrap.command("org-ruleset").description("drift-check the codified org no-agent-files push ruleset; optionally reconcile it under master authority (#2196/#4001)").option("--json", "machine-readable output").option("--apply", "create or update the one named org ruleset to exact desired state (master-admin required)").action(async () => {
     const json = rawFlag("--json");
-    const live = await fetchOrgNoAgentFilesRuleset(defaultGitHubClient());
+    const apply = rawFlag("--apply");
+    const client = defaultGitHubClient();
+    const live = await fetchOrgNoAgentFilesRuleset(client);
     const plan = planOrgNoAgentFilesRuleset(live);
-    if (json) console.log(JSON.stringify({ action: plan.action, id: plan.id, drift: plan.drift, desired: plan.desired }, null, 2));
-    else console.log(renderOrgRulesetDriftReport(plan));
-    if (plan.action !== "noop") process.exitCode = 1;
+    if (!apply) {
+      if (json) console.log(JSON.stringify({ action: plan.action, id: plan.id, drift: plan.drift, desired: plan.desired }, null, 2));
+      else console.log(renderOrgRulesetDriftReport(plan));
+      if (plan.action !== "noop") process.exitCode = 1;
+      return;
+    }
+    const verdict = await fetchTrainAuthority("mutmutco/MMI-Hub", registryClientDeps(await loadConfig()));
+    if (!verdict.ok || verdict.authority.role !== "master") {
+      return fail("bootstrap org-ruleset --apply: master-admin required");
+    }
+    const result = await reconcileOrgNoAgentFilesRuleset(plan, client);
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`mmi-cli bootstrap org-ruleset --apply: ${result.action}`);
+      console.log(renderOrgRulesetDriftReport(planOrgNoAgentFilesRuleset(await fetchOrgNoAgentFilesRuleset(client))));
+    }
   });
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
@@ -24245,7 +24360,7 @@ function registerBoardCommands(program3) {
 
 // src/merge-cleanup.ts
 var import_node_fs30 = require("node:fs");
-var import_promises7 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 var import_node_path30 = require("node:path");
 var import_node_os11 = require("node:os");
 var import_node_child_process14 = require("node:child_process");
@@ -24333,23 +24448,23 @@ function boardAdvanceFailureMessage(result) {
 }
 
 // src/deferred-registry-store.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_path29 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-  await (0, import_promises6.writeFile)(tmp, contents, "utf8");
+  await (0, import_promises7.writeFile)(tmp, contents, "utf8");
   try {
     await renameWithRetry(tmp, target);
   } catch (e) {
-    await (0, import_promises6.unlink)(tmp).catch(() => void 0);
+    await (0, import_promises7.unlink)(tmp).catch(() => void 0);
     throw e;
   }
 }
 async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
   for (let i = 0; ; i++) {
     try {
-      await (0, import_promises6.rename)(from, to);
+      await (0, import_promises7.rename)(from, to);
       return;
     } catch (e) {
       const code = e.code;
@@ -24361,7 +24476,7 @@ async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
 async function readStrict(registryPath) {
   let text;
   try {
-    text = await (0, import_promises6.readFile)(registryPath, "utf8");
+    text = await (0, import_promises7.readFile)(registryPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -24378,19 +24493,19 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     // Lenient read for the sweep's initial fetch: any error (missing/corrupt) yields an empty queue.
     read: async () => {
       try {
-        return parseDeferredWorktreesFile(await (0, import_promises6.readFile)(registryPath, "utf8"));
+        return parseDeferredWorktreesFile(await (0, import_promises7.readFile)(registryPath, "utf8"));
       } catch {
         return [];
       }
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises6.mkdir)((0, import_node_path29.dirname)(registryPath), { recursive: true });
+      await (0, import_promises7.mkdir)((0, import_node_path29.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises6.mkdir)((0, import_node_path29.dirname)(registryPath), { recursive: true });
+      await (0, import_promises7.mkdir)((0, import_node_path29.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -24831,7 +24946,7 @@ var realWorktreeDirRemover = {
       (0, import_node_fs30.unlinkSync)(p);
     }
   },
-  removeTree: (p) => (0, import_promises7.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
 };
 async function resolvePrimaryCheckout(execGit) {
   try {
@@ -25088,7 +25203,7 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 
 // src/worktree-lifecycle-commands.ts
 var import_node_fs31 = require("node:fs");
-var import_promises8 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 var import_node_path31 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
@@ -25432,13 +25547,13 @@ function registerWorktreeCommands(program3) {
       }
       const landStatus = (await execFileP2("git", ["-C", wtPath, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "unreadable" }))).stdout || "";
       const gitInWorktree = async (args) => (await execFileP2("git", ["-C", wtPath, ...args], { timeout: GIT_TIMEOUT_MS })).stdout;
-      const orphanDirt = headBorn ? void 0 : await classifyOrphanWorktreeDirt(landStatus, { git: gitInWorktree, readTextFile: (p) => (0, import_promises8.readFile)(p, "utf8") });
+      const orphanDirt = headBorn ? void 0 : await classifyOrphanWorktreeDirt(landStatus, { git: gitInWorktree, readTextFile: (p) => (0, import_promises9.readFile)(p, "utf8") });
       const landDirty = headBorn ? landStatus.trim().length > 0 : orphanDirt.dirt !== "clean";
       if (landDirty) {
         return fail(`worktree land: refusing to land '${branch}' \u2014 uncommitted changes in ${wtPath}; commit, stash, or remove the worktree manually`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
       const orphanTip = orphan.orphan ? orphanDirt?.tip ?? await readOrphanWorktreeTip(
-        { git: gitInWorktree, readTextFile: (p) => (0, import_promises8.readFile)(p, "utf8") },
+        { git: gitInWorktree, readTextFile: (p) => (0, import_promises9.readFile)(p, "utf8") },
         orphan.kind
       ) : void 0;
       const lastCommit = orphanTip ? {
@@ -25622,10 +25737,13 @@ async function bestEffortGit(args, cwd, step, timeoutMs = GIT_TIMEOUT_MS) {
     await execFileP2("git", fullArgs, { timeout: timeoutMs });
     return { step, status: "done" };
   } catch (e) {
-    const msg = e.message.split("\n")[0];
-    if (/not found|already|no such|does not exist|not a valid|couldn't|unable to resolve/i.test(msg)) {
+    const err = e;
+    const detail = `${err.message}
+${err.stderr ?? ""}`;
+    if (/not found|already|no such|does not exist|not a valid|couldn't|unable to resolve/i.test(detail)) {
       return { step, status: "already gone" };
     }
+    const msg = (err.stderr?.trim() || err.message).split("\n")[0];
     return { step, status: `failed: ${msg}` };
   }
 }
@@ -26861,7 +26979,7 @@ function registerExplainCommand(program3) {
 }
 
 // src/pr-commands.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 var GC_GH_TIMEOUT_MS4 = 2e4;
 var CHECKS_WATCH_POLL_MS = 15e3;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
@@ -27005,10 +27123,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises9.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -27038,7 +27156,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises9.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -30613,7 +30731,7 @@ withExamples(mutating(
     try {
       title = await resolveIssueTitle(
         { title: opts.title, titleFile: opts.titleFile },
-        { readFile: import_promises10.readFile, readStdin }
+        { readFile: import_promises11.readFile, readStdin }
       );
     } catch (e) {
       return fail(
@@ -30655,8 +30773,8 @@ withExamples(mutating(
   let surfaceFlagLabel;
   try {
     issueType = resolveCreateType(o.type, "issue create", o.label);
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
     priority = resolveCreatePriority(o.priority, "issue create");
     extraLabels = [...o.label ?? []];
@@ -30836,7 +30954,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
   }
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
   } catch (e) {
     return fail(`issue comment: ${e.message}`);
   }
@@ -30896,8 +31014,8 @@ program2.command("report").description("file a friction report on the Hub board
   let title;
   const sourceRepo = o.repo ?? await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
       throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -30949,8 +31067,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -31009,8 +31127,8 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
@@ -31507,8 +31625,8 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises10.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises10.unlink)(path2)
+      readFile: (path2) => (0, import_promises11.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises11.unlink)(path2)
     }, args),
     fetchEdgeDomains: async (slug) => {
       const proj = await fetchProjectBySlug(slug, registryClientDeps(await loadConfig()));
@@ -31691,7 +31809,7 @@ for (const commandName of ["rcand", "release"]) {
       }
       let summaryLines;
       try {
-        summaryLines = summaryFileLines(await (0, import_promises10.readFile)(o.announceSummaryFile, "utf8"));
+        summaryLines = summaryFileLines(await (0, import_promises11.readFile)(o.announceSummaryFile, "utf8"));
       } catch (e) {
         return fail(`release: could not read --announce-summary-file ${o.announceSummaryFile}: ${e.message}`);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.83.0",
+  "version": "3.85.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",