@mutmutco/cli 3.85.0 → 3.87.0

package/dist/main.cjs

@@ -6371,6 +6371,14 @@ var LOCAL_ONLY_FILES = [".claude/settings.local.json"];
 var PKG = "package.json";
 var LOCKFILE = "package-lock.json";
 var NODE_MODULES = "node_modules";
+var LOCKFILE_INSTALLS = [
+  { lockfile: "bun.lock", command: "bun install --frozen-lockfile" },
+  { lockfile: "bun.lockb", command: "bun install --frozen-lockfile" },
+  { lockfile: "pnpm-lock.yaml", command: "pnpm install --frozen-lockfile" },
+  { lockfile: "yarn.lock", command: "yarn install --immutable" },
+  { lockfile: LOCKFILE, command: "npm ci" }
+];
+var NO_LOCKFILE_INSTALL = "npm install --no-package-lock";
 var realFsProbe = {
   isDir: (p) => {
     try {
@@ -6397,18 +6405,19 @@ var realFsProbe = {
 function scanInstallDirs(root, fs2 = realFsProbe) {
   const factsFor = (dir) => {
     const abs = dir ? (0, import_node_path10.join)(root, dir) : root;
+    const match = LOCKFILE_INSTALLS.find((c) => fs2.isFile((0, import_node_path10.join)(abs, c.lockfile)));
     return {
       dir,
       hasPackageJson: fs2.isFile((0, import_node_path10.join)(abs, PKG)),
-      hasLockfile: fs2.isFile((0, import_node_path10.join)(abs, LOCKFILE)),
-      hasNodeModules: fs2.isDir((0, import_node_path10.join)(abs, NODE_MODULES))
+      hasNodeModules: fs2.isDir((0, import_node_path10.join)(abs, NODE_MODULES)),
+      install: match?.command
     };
   };
   const children = fs2.listDirs(root).filter((name) => name !== NODE_MODULES && name !== ".git");
   return [factsFor(""), ...children.map(factsFor).filter((f) => f.hasPackageJson)];
 }
 function npmInstallTargets(dirs) {
-  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.hasLockfile ? "npm ci" : "npm install --no-package-lock" }));
+  return dirs.filter((d) => d.hasPackageJson && !d.hasNodeModules).map((d) => ({ dir: d.dir, command: d.install ?? NO_LOCKFILE_INSTALL }));
 }
 function isLinkedWorktree(root, fs2 = realFsProbe) {
   return fs2.isFile((0, import_node_path10.join)(root, ".git"));
@@ -6432,9 +6441,9 @@ async function provisionWorktree(worktreeRoot, deps) {
   const allDirs = scanInstallDirs(worktreeRoot, fs2);
   const targets = npmInstallTargets(allDirs);
   if (deps.validateInstall) {
-    for (const dir of allDirs.filter((d) => d.hasPackageJson && d.hasLockfile && d.hasNodeModules)) {
+    for (const dir of allDirs.filter((d) => d.hasPackageJson && d.install && d.hasNodeModules)) {
       const cwd = dir.dir ? (0, import_node_path10.join)(worktreeRoot, dir.dir) : worktreeRoot;
-      if (!await deps.validateInstall(cwd)) targets.push({ dir: dir.dir, command: "npm ci" });
+      if (!await deps.validateInstall(cwd)) targets.push({ dir: dir.dir, command: dir.install });
     }
   }
   const targetDirs = new Set(targets.map((target) => target.dir));
@@ -8485,20 +8494,30 @@ async function rollDevelopmentForward(deps, ctx, tag) {
   const number = parsePrNumber(url);
   return enqueueAlignmentAutoMerge(deps, ctx, number, url || void 0, `development requires checks (${required.join(", ")}); opened alignment PR ${url || "(url unavailable)"}`);
 }
+var ALIGNMENT_ARM_ATTEMPTS = 3;
+var ALIGNMENT_ARM_BACKOFF_MS = 2e3;
 async function enqueueAlignmentAutoMerge(deps, ctx, prNumber, prUrl, openedNote) {
   const base = { status: "pr-pending", prNumber, prUrl };
   const retryCommand = `mmi-cli pr merge ${prNumber ?? "<number>"} --auto --merge`;
   const manual = `${openedNote} \u2014 land it with \`${retryCommand}\``;
   if (deps.mergeAuto && prNumber !== void 0) {
-    try {
-      const res = await deps.mergeAuto(String(prNumber), ctx.repo);
-      if (res.mergeStatus !== "failed") {
-        return { ...base, autoMergeEnqueued: true, note: `${openedNote} \u2014 auto-merge enqueued (merges when checks pass)` };
+    const sleep3 = resolveSleep(deps);
+    let lastError;
+    for (let attempt = 1; attempt <= ALIGNMENT_ARM_ATTEMPTS; attempt += 1) {
+      try {
+        const res = await deps.mergeAuto(String(prNumber), ctx.repo);
+        if (res.mergeStatus !== "failed") {
+          return { ...base, autoMergeEnqueued: true, note: `${openedNote} \u2014 auto-merge enqueued (merges when checks pass)` };
+        }
+        lastError = res.error ?? "unknown error";
+      } catch (e) {
+        lastError = `enqueue threw (${e instanceof Error ? e.message : String(e)})`;
       }
-      deps.warn?.(`alignment PR #${prNumber} auto-merge not armed (${res.error ?? "unknown error"}) \u2014 re-run: ${retryCommand}`);
-    } catch (e) {
-      deps.warn?.(`alignment PR #${prNumber} auto-merge enqueue threw (${e instanceof Error ? e.message : String(e)}) \u2014 re-run: ${retryCommand}`);
+      if (attempt < ALIGNMENT_ARM_ATTEMPTS) await sleep3(ALIGNMENT_ARM_BACKOFF_MS * attempt);
     }
+    deps.warn?.(
+      `alignment PR #${prNumber} auto-merge not armed after ${ALIGNMENT_ARM_ATTEMPTS} attempts (${lastError ?? "unknown error"}) \u2014 re-run: ${retryCommand}`
+    );
   }
   return { ...base, note: manual };
 }
@@ -8836,6 +8855,10 @@ async function enumerateOwnWorkflowRuns(deps, repo, headSha) {
   const runs = await discoverShaWorkflowRuns(deps, repo, headSha, /* @__PURE__ */ new Set());
   return runs.length ? runs : [{ workflow: `sha-enumeration(${headSha.slice(0, 7)}) no runs yet`, conclusion: "pending" }];
 }
+function withReleaseRunObligation(runs) {
+  if (runs.some((r) => r.event === "release")) return runs;
+  return [...runs, { workflow: "release-event deploy run not created yet", conclusion: "pending" }];
+}
 var NON_DEPLOY_EVENTS = /* @__PURE__ */ new Set([
   "pull_request",
   "pull_request_target",
@@ -8885,6 +8908,7 @@ async function discoverShaWorkflowRuns(deps, repo, headSha, seenRunIds) {
       workflow: row.workflowName ?? `run:${row.databaseId}`,
       runId: row.databaseId,
       runUrl: row.url,
+      event: row.event,
       // An in-flight run is reported UNVERIFIED, never watched. Blocking on an arbitrary discovered run
       // would let one long push workflow hang the release command and mask the failed rows behind it, and
       // `gh run watch` has no timeout. The NAMED targets are the ones worth blocking on (also #3382 review).
@@ -8914,7 +8938,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
     const note = ref === "rc" ? "no dispatch on rc: registry-publish repos have no rc-stage Release to publish from" : "no central dispatch: this repo's own publish.yml auto-fires on the published Release (#2428)";
     if (ref === "rc" || !autoRunHeadSha) return { note, deployStatus: "pending" };
     if (!watch) {
-      const listed = await enumerateOwnWorkflowRuns(deps, ctx.repo, autoRunHeadSha);
+      const listed = withReleaseRunObligation(await enumerateOwnWorkflowRuns(deps, ctx.repo, autoRunHeadSha));
       return { note, workflowRuns: listed, deployStatus: aggregateWorkflowRuns(listed) };
     }
     const since = autoRunSince ?? (deps.now ?? Date.now)();
@@ -8934,7 +8958,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
     if (!autoRunHeadSha) return { note, deployStatus: "pending" };
     if (!watch) {
       if (ref === "rc") return { note, deployStatus: "pending" };
-      const listed = await enumerateOwnWorkflowRuns(deps, HUB_REPO, autoRunHeadSha);
+      const listed = withReleaseRunObligation(await enumerateOwnWorkflowRuns(deps, HUB_REPO, autoRunHeadSha));
       return { note, workflowRuns: listed, deployStatus: aggregateWorkflowRuns(listed) };
     }
     const since = autoRunSince ?? (deps.now ?? Date.now)();
@@ -23492,6 +23516,11 @@ function registerBootstrapCommands(program3) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
       if (!seedMatchesProjectType(seed, applyProjectType)) continue;
+      const waiver = seed.waivers?.[slug];
+      if (waiver) {
+        actions.push({ action: "skip", target: seed.target, ownership: seed.ownership, reason: `waived: ${waiver}` });
+        continue;
+      }
       const resolved = { ...seed, target: seed.target.replace("{{REPO_SLUG}}", slug) };
       let exists = false;
       let sha;
@@ -27444,9 +27473,17 @@ function findNegatedClosings(text, closingNumbers) {
     return forIssue.length > 0 && forIssue.every((m) => m.negated);
   });
 }
+function commitMessagesText(commits) {
+  if (!Array.isArray(commits)) return "";
+  return commits.map((commit) => {
+    const { messageHeadline, messageBody } = commit ?? {};
+    return `${typeof messageHeadline === "string" ? messageHeadline : ""}
+${typeof messageBody === "string" ? messageBody : ""}`;
+  }).join("\n");
+}
 function parseClosingGuardInput(raw) {
   if (!raw || typeof raw !== "object") return void 0;
-  const { title, body, state, closingIssuesReferences } = raw;
+  const { title, body, state, closingIssuesReferences, commits } = raw;
   if (typeof state !== "string" || !Array.isArray(closingIssuesReferences)) return void 0;
   const closing = [];
   for (const ref of closingIssuesReferences) {
@@ -27454,15 +27491,20 @@ function parseClosingGuardInput(raw) {
     if (typeof n !== "number" || !Number.isInteger(n) || n <= 0) return void 0;
     closing.push(n);
   }
+  const commitClosing = [...new Set(findClosingMentions(commitMessagesText(commits)).map((m) => m.issue))];
   const text = `${typeof title === "string" ? title : ""}
 ${typeof body === "string" ? body : ""}`;
-  return { state, text, closing };
+  return { state, text, closing, commitClosing };
 }
 function negatedClosingRefusalMessage(negated, context = "pr merge") {
   const named = negated.map((n) => `#${n}`).join(", ");
   const first = `#${negated[0] ?? "N"}`;
   return `${context}: REFUSED \u2014 GitHub will close ${named} on merge, but the PR body says it does not (GitHub's closing-keyword parser is negation-blind: "does not close ${first}" still closes it). Reword the body so the keyword is gone (e.g. "leaves ${first} open"), or re-run with --force to merge anyway and let ${named} close.`;
 }
+function commitClosingRefusalMessage(closing, context = "pr merge") {
+  const named = closing.map((n) => `#${n}`).join(", ");
+  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. Remove the closing keyword from the commit message, or re-run with --force to merge anyway and let ${named} close.`;
+}
 function evaluateClosingGuard(input, opts) {
   if (!input) {
     return {
@@ -27470,7 +27512,16 @@ function evaluateClosingGuard(input, opts) {
       message: `${opts.context}: could not read the PR's closing references \u2014 proceeding WITHOUT the negated-closing check (#3718).`
     };
   }
-  if (input.state !== "OPEN" || input.closing.length === 0) return { blocked: false };
+  if (input.state !== "OPEN") return { blocked: false };
+  const commitClosing = (input.commitClosing ?? []).filter((n) => !input.closing.includes(n));
+  if (commitClosing.length) {
+    if (!opts.force) return { blocked: true, message: commitClosingRefusalMessage(commitClosing, opts.context) };
+    return {
+      blocked: false,
+      message: `${opts.context}: --force past the commit-message closing guard \u2014 the squash body will close ${commitClosing.map((n) => `#${n}`).join(", ")}.`
+    };
+  }
+  if (input.closing.length === 0) return { blocked: false };
   const negated = findNegatedClosings(input.text, input.closing);
   if (!negated.length) return { blocked: false };
   if (!opts.force) return { blocked: true, message: negatedClosingRefusalMessage(negated, opts.context) };
@@ -31262,7 +31313,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
-  const landClosingGuardRaw = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "title,body,state,closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => JSON.parse(r.stdout)).catch(() => void 0);
+  const landClosingGuardRaw = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "title,body,state,closingIssuesReferences,commits"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => JSON.parse(r.stdout)).catch(() => void 0);
   const landClosingGuardVerdict = evaluateClosingGuard(parseClosingGuardInput(landClosingGuardRaw), { force: o.force, context: "pr land" });
   if (landClosingGuardVerdict.blocked) {
     console.error(landClosingGuardVerdict.message);
@@ -31380,7 +31431,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
   const [headRef, baseRef, headRefOid] = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid", "--jq", '.headRefName + " " + .baseRefName + " " + (.headRefOid // "")'], { timeout: GC_GH_TIMEOUT_MS2 })).stdout.trim().split(/\s+/);
   const headIsProtected = isProtectedBranch(headRef);
-  const closingGuardRaw = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "title,body,state,closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => JSON.parse(r.stdout)).catch(() => void 0);
+  const closingGuardRaw = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "title,body,state,closingIssuesReferences,commits"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => JSON.parse(r.stdout)).catch(() => void 0);
   const closingGuardVerdict = evaluateClosingGuard(parseClosingGuardInput(closingGuardRaw), { force: o.force, context: "pr merge" });
   if (closingGuardVerdict.blocked) {
     console.error(closingGuardVerdict.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.85.0",
+  "version": "3.87.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",