@mutmutco/cli 3.93.0 → 3.94.0

package/dist/main.cjs

@@ -11706,6 +11706,29 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
 function sameContexts(left, right) {
   return left.length === right.length && left.every((context, index) => context === right[index]);
 }
+function resolveProductRulesetReconcilePlan(input) {
+  const liveNeedsContextConvergence = !sameContexts(input.liveContexts, input.authorityContexts);
+  const liveIsActive = input.liveEnforcement === "active";
+  if (liveIsActive && !liveNeedsContextConvergence) {
+    return { shouldActivate: false, targetEnforcement: "active" };
+  }
+  if (input.unsafeContexts.length > 0) {
+    const unsafe = [...input.unsafeContexts];
+    return {
+      shouldActivate: false,
+      targetEnforcement: "disabled",
+      holdReason: `product ruleset left non-enforcing \u2014 [${unsafe.join(", ")}] ${unsafe.length === 1 ? "is" : "are"} emitted ONLY by path-filtered workflow(s), so the context is not reported on a PR outside those paths and requiring it would block that PR forever (#3836). Give the gate a companion job that runs unconditionally, then re-run this command`
+    };
+  }
+  if (!input.gateProvenGreen) {
+    return {
+      shouldActivate: false,
+      targetEnforcement: "disabled",
+      holdReason: "product ruleset left non-enforcing \u2014 the gate is not green on development; activating it would block every PR (#3694)"
+    };
+  }
+  return { shouldActivate: true, targetEnforcement: "active" };
+}
 async function contentExists(deps, repo, branch, path2) {
   try {
     const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
@@ -12409,46 +12432,39 @@ async function applyCiReconcileRepo(repo, deps) {
     return finalizeCiReconcile(repo, deps, result, report);
   }
   const liveContexts = live == null ? [] : sortedUnique(rulesetRequiredContexts(live));
-  const liveNeedsConvergence = live == null || !sameContexts(liveContexts, authority.contexts);
-  const enforcement = live?.enforcement === "disabled" || live == null && authority.apiPayload.enforcement === "disabled" ? "disabled" : "active";
-  if (liveNeedsConvergence && enforcement === "active") {
-    const prWorkflows = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable") ?? [];
-    const gateFiles = gateWorkflowFiles(prWorkflows);
-    const allPrWorkflows = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
-    const bodies = [];
-    for (const path2 of allPrWorkflows) {
-      const body = await fetchFileContent(deps, repo, baseBranch, path2);
-      if (body) bodies.push({ path: path2, body });
-    }
-    const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
-    const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
-    const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => authority.contexts.includes(c) && !safeContexts.has(c));
-    if (unsafe.length) {
-      const reason = `product ruleset left non-enforcing \u2014 [${unsafe.join(", ")}] ${unsafe.length === 1 ? "is" : "are"} emitted ONLY by path-filtered workflow(s) (${[...filteredPaths].join(", ")}), so the context is not reported on a PR outside those paths and requiring it would block that PR forever (#3836). Give the gate a companion job that runs unconditionally, then re-run this command`;
-      result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
-    }
-    if (!await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles)) {
-      const reason = "product ruleset left non-enforcing \u2014 the gate is not green on development; activating it would block every PR (#3694)";
-      result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
-    }
-  }
-  if (liveNeedsConvergence) {
-    try {
-      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, enforcement);
-      if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
-    } catch (e) {
-      result.errors.push(e.message);
-      return finalizeCiReconcile(repo, deps, result, report);
+  const prWorkflows = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable") ?? [];
+  const gateFiles = gateWorkflowFiles(prWorkflows);
+  const allPrWorkflows = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
+  const bodies = [];
+  for (const path2 of allPrWorkflows) {
+    const body = await fetchFileContent(deps, repo, baseBranch, path2);
+    if (body) bodies.push({ path: path2, body });
+  }
+  const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
+  const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
+  const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => authority.contexts.includes(c) && !safeContexts.has(c));
+  const plan = resolveProductRulesetReconcilePlan({
+    liveEnforcement: live?.enforcement,
+    liveContexts,
+    authorityContexts: authority.contexts,
+    gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
+    unsafeContexts: unsafe
+  });
+  if (!plan.shouldActivate) {
+    if (plan.holdReason) {
+      result.skipped.push(plan.holdReason);
+      return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
     }
-  } else {
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts already match ${authority.source}`);
+    return finalizeCiReconcile(repo, deps, result, report);
   }
-  if (enforcement === "disabled") {
-    const reason = `${PRODUCT_RULESET_NAME} remains parked (disabled); authoritative contexts were preserved without changing enforcement`;
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+  try {
+    const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+    if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
+    else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+  } catch (e) {
+    result.errors.push(e.message);
+    return finalizeCiReconcile(repo, deps, result, report);
   }
   return finalizeCiReconcile(repo, deps, result, report);
 }
@@ -23445,6 +23461,12 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: optionDetail(missing)
     });
   } else if (repoClass === "deployable") {
+    const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
+    checks.push({
+      ok: productRuleset?.enforcement === "active",
+      label: "product required-check ruleset enforcement active",
+      detail: productRuleset?.enforcement !== "active" ? `${PRODUCT_RULESET_NAME} is ${productRuleset?.enforcement ?? "missing"} \u2014 run mmi-cli ci reconcile --apply --repo ${repo} once the gate is green` : void 0
+    });
     const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
     const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
     checks.push({
@@ -28858,7 +28880,8 @@ function diagnoseSurface(evidence) {
     return { ...base, state: "repair-failed", repairDetail: evidence.repair.detail };
   }
   if (evidence.repair?.attempted && evidence.repair.ok) {
-    return { ...base, state: "clean", repairDetail: evidence.repair.detail };
+    const behindReleased = evidence.installedVersion && evidence.releasedVersion && compareVersions(evidence.installedVersion, evidence.releasedVersion) < 0;
+    return { ...base, state: behindReleased ? "pending-reload" : "clean", repairDetail: evidence.repair.detail };
   }
   if (!evidence.installRecordPresent) return { ...base, state: "missing" };
   if (!evidence.deliveryPresent || !evidence.payloadPresent || evidence.manifest === "missing") {
@@ -28876,7 +28899,7 @@ function reloadInstruction(descriptor) {
   return `${verb} ${descriptor.displayName}`;
 }
 function planSurfaceRepair(diagnosis) {
-  if (diagnosis.state === "clean" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
+  if (diagnosis.state === "clean" || diagnosis.state === "pending-reload" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
   const descriptor = diagnosis.descriptor;
   if (descriptor.repairOwner !== "mmi-cli") {
     return {
@@ -28901,6 +28924,7 @@ function buildSurfaceDoctorCheck(diagnosis) {
   const detailByState = {
     skipped: "skipped \u2014 host not active",
     clean: diagnosis.repairDetail ? `clean \u2014 repaired and verified (${diagnosis.repairDetail})` : `clean${versions ? ` \u2014 ${versions}` : ""}`,
+    "pending-reload": `pending ${descriptor.reload === "workspace" ? "reload" : "restart"} \u2014 repaired to ${diagnosis.releasedVersion}, but ${diagnosis.installedVersion} is still the version this host has loaded${diagnosis.repairDetail ? ` (${diagnosis.repairDetail})` : ""}`,
     "freshness-unknown": `${diagnosis.installedVersion ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
     stale: `stale${versions ? ` \u2014 ${versions}` : ""}`,
     missing: "missing \u2014 no install record",
@@ -28912,11 +28936,14 @@ function buildSurfaceDoctorCheck(diagnosis) {
     id: `${descriptor.token}-plugin`,
     surface: descriptor.token,
     state,
-    ok: state === "clean" || state === "skipped",
+    ok: state === "clean" || state === "skipped" || state === "pending-reload",
     ...state === "freshness-unknown" ? { reportOnly: true } : {},
+    // Nothing is broken, so this is not a ✗ — but it is the one OK row an operator must act on, and the
+    // short default lane and the SessionStart banner both filter to failures unless a row says otherwise.
+    ...state === "pending-reload" ? { warn: true } : {},
     label: `${descriptor.displayName} plugin`,
     detail: detailByState[state],
-    ...plan ? { fix: plan.instruction } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
+    ...plan ? { fix: plan.instruction } : state === "pending-reload" ? { fix: reloadInstruction(descriptor) } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
     verbose: [
       // The three numbers the legacy builder used to print. They belong here now that this is the only
       // plugin row, and a report that names a state without naming the versions behind it is not evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.93.0",
+  "version": "3.94.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",