@mutmutco/cli 4.0.15 → 4.0.17

package/dist/main.cjs

@@ -5035,16 +5035,26 @@ function isAgentScratchPath(path2) {
   return /^tmp_[^/]+$/.test(normalized);
 }
 var PUSH_WALL_AGENT_CONFIG_DIRS = [".claude/", ".cursor/rules/", ".codex/", ".agents/"];
+var LIVE_SESSION_DIRS = [".jerv/", ".pi/"];
+function pathUnderDirPrefix(path2, dir) {
+  return path2 === dir || path2 === dir.slice(0, -1) || path2.startsWith(dir) || path2.includes(`/${dir}`);
+}
 function isUncommittableAgentConfigPath(path2) {
   const normalized = path2.replace(/\\/g, "/").trim();
-  return PUSH_WALL_AGENT_CONFIG_DIRS.some((dir) => normalized === dir || normalized === dir.slice(0, -1) || normalized.startsWith(dir) || normalized.includes(`/${dir}`));
+  return PUSH_WALL_AGENT_CONFIG_DIRS.some((dir) => pathUnderDirPrefix(normalized, dir));
+}
+function isLiveSessionPath(path2) {
+  const normalized = path2.replace(/\\/g, "/").trim();
+  return LIVE_SESSION_DIRS.some((dir) => pathUnderDirPrefix(normalized, dir));
 }
 function splitPorcelainLine(line) {
   return { status: line.slice(0, 2), path: line.slice(3).split(" -> ")[0]?.trim() ?? "" };
 }
 function isExemptPorcelainLine(status, path2) {
   if (isAgentScratchPath(path2)) return true;
-  return status === "??" && isUncommittableAgentConfigPath(path2);
+  if (status !== "??") return false;
+  if (isUncommittableAgentConfigPath(path2)) return true;
+  return isLiveSessionPath(path2);
 }
 function porcelainBlockingPaths(porcelain) {
   const blocking = [];
@@ -5059,12 +5069,21 @@ function porcelainHasBlockingChanges(porcelain) {
   return porcelainBlockingPaths(porcelain).length > 0;
 }
 var BLOCKING_PATH_PREVIEW_LIMIT = 10;
+function porcelainHasBlockingUntracked(porcelain) {
+  for (const line of porcelain.split("\n")) {
+    if (!line.trim()) continue;
+    const { status, path: path2 } = splitPorcelainLine(line);
+    if (path2 !== "" && status === "??" && !isExemptPorcelainLine(status, path2)) return true;
+  }
+  return false;
+}
 function describeBlockingPaths(porcelain) {
   const paths = porcelainBlockingPaths(porcelain);
   if (paths.length === 0) return "";
   const shown = paths.slice(0, BLOCKING_PATH_PREVIEW_LIMIT);
   const rest = paths.length - shown.length;
-  return ` \u2014 blocking: ${shown.join(", ")}${rest > 0 ? `, \u2026 and ${rest} more` : ""}`;
+  const hint = porcelainHasBlockingUntracked(porcelain) ? " (untracked: gitignore it, or add it to .git/info/exclude)" : "";
+  return ` \u2014 blocking: ${shown.join(", ")}${rest > 0 ? `, \u2026 and ${rest} more` : ""}${hint}`;
 }
 
 // src/local-train-sync.ts
@@ -5614,6 +5633,12 @@ var PR_CHECKS_FAILURE_CONFIRMATIONS = 2;
 var PR_CHECKS_RATELIMIT_FLOOR = 50;
 var PR_CHECKS_RATELIMIT_JITTER_MAX_MS = 5e3;
 var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
+var PR_CHECKS_ZERO_RUNS_GRACE_MS = 2 * 6e4;
+var PR_CHECKS_ZERO_RUNS_CONFIRMATIONS = 2;
+function zeroRunsDeliveryMessage(headSha) {
+  const tip = headSha ? ` (${headSha.slice(0, 7)})` : "";
+  return `GitHub delivered ZERO workflow runs for this PR head${tip} \u2014 not "checks still pending". Sibling PRs on the same repo can still be healthy while this head is silent. Close/reopen is insufficient. Recourse: push an empty commit on the same branch (\`git commit --allow-empty -m "ci: re-trigger gates" && git push\`) or re-branch onto a new head and open a fresh PR. See docs/Guides/gh-runner-runbook.md \xA7 Zero workflow runs on a PR head.`;
+}
 function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none") {
   if (checks === "no-checks-reported") return { action: "proceed" };
   const staleNote = `merge CI policy says no-ci (${policyReason}), but live PR checks exist`;
@@ -5661,6 +5686,7 @@ async function waitForPrChecks(deps) {
   let lastDetail = "pending";
   let successStreak = 0;
   let failureStreak = 0;
+  let zeroRunsStreak = 0;
   report("starting");
   while (now() < deadline) {
     if (deps.pollRateLimit) {
@@ -5694,6 +5720,7 @@ async function waitForPrChecks(deps) {
     report(state);
     if (state !== "success") successStreak = 0;
     if (state !== "failure") failureStreak = 0;
+    if (state !== "no-checks-reported") zeroRunsStreak = 0;
     if (state === "failure") {
       failureStreak += 1;
       if (failureStreak >= PR_CHECKS_FAILURE_CONFIRMATIONS) {
@@ -5726,6 +5753,30 @@ async function waitForPrChecks(deps) {
     }
     if (state === "no-checks-reported") {
       lastDetail = "no-checks-reported (waiting for workflow to queue)";
+      const elapsed = now() - started;
+      if (deps.pollHeadWorkflowRunCount && elapsed >= PR_CHECKS_ZERO_RUNS_GRACE_MS) {
+        const count = await deps.pollHeadWorkflowRunCount().catch(() => null);
+        if (count === 0) {
+          zeroRunsStreak += 1;
+          if (zeroRunsStreak >= PR_CHECKS_ZERO_RUNS_CONFIRMATIONS) {
+            return {
+              policy,
+              status: "failure",
+              reason: zeroRunsDeliveryMessage(),
+              detail: "zero-runs",
+              waitedMs: elapsed
+            };
+          }
+          lastDetail = "no-checks-reported (confirming zero workflow runs on head)";
+        } else {
+          zeroRunsStreak = 0;
+          if (count !== null && count > 0) {
+            lastDetail = `no-checks-reported (${count} workflow run(s) on head; waiting for check-runs)`;
+          }
+        }
+      } else {
+        zeroRunsStreak = 0;
+      }
       await deps.sleep(PR_CHECKS_POLL_MS);
       continue;
     }
@@ -10832,10 +10883,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.0.15",
-    tag: "v4.0.15",
-    commit: "86f45af99b96",
-    npm: "@mutmutco/cli@4.0.15"
+    version: "4.0.17",
+    tag: "v4.0.17",
+    commit: "df1e866df4f8",
+    npm: "@mutmutco/cli@4.0.17"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10852,14 +10903,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.0.15"
+          v3Target: "v4.0.17"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.0.15 and redeploy the Hub Lambda from tag v4.0.15 (86f45af99b96); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.0.15 (@mutmutco/cli@4.0.15, tag commit 86f45af99b96 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.0.17 and redeploy the Hub Lambda from tag v4.0.17 (df1e866df4f8); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.0.17 (@mutmutco/cli@4.0.17, tag commit df1e866df4f8 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -13926,8 +13977,39 @@ async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
   }
   return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
 }
+function cmpReleaseTag(a, b) {
+  const parse = (t) => {
+    const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(t.trim());
+    return m ? { major: +m[1], minor: +m[2], patch: +m[3] } : null;
+  };
+  const left = parse(a);
+  const right = parse(b);
+  if (!left || !right) throw new Error(`cmpReleaseTag expects vX.Y.Z tags, got ${a} vs ${b}`);
+  return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
+}
+async function listRemoteReleaseTags(deps) {
+  const out = await runGitRemoteRead(deps, ["ls-remote", "--tags", "origin", "refs/tags/v*"]);
+  const tags = /* @__PURE__ */ new Set();
+  for (const line of clean2(out).split("\n")) {
+    const ref = line.trim().split(/\s+/)[1] ?? "";
+    const tag = ref.replace(/^refs\/tags\//, "").replace(/\^\{\}$/, "");
+    if (/^v\d+\.\d+\.\d+$/.test(tag)) tags.add(tag);
+  }
+  return [...tags].sort(cmpReleaseTag);
+}
+async function assertComputedReleaseTagStillNext(deps, tag) {
+  if (!/^v\d+\.\d+\.\d+$/.test(tag)) return;
+  const remote = await listRemoteReleaseTags(deps);
+  const newer = remote.filter((t) => cmpReleaseTag(t, tag) > 0);
+  if (newer.length === 0) return;
+  const latest = newer[newer.length - 1];
+  throw new Error(
+    `origin already has release tag ${latest} ahead of this run's computed ${tag} \u2014 another /release landed mid-flight. Refusing to mint a skip-version or hole-fill tag. Stop; let the other train finish (or abort its stray tag/Release with the authorized human's go if verify failed), then rerun mmi-cli devops release --apply so next-version re-derives from the settled tags. Do not run two /release trains on the same repo concurrently.`
+  );
+}
 async function ensureTagPushed(deps, tag, sha, probed, releaseRepo) {
-  const remoteSha = probed ? probed.remoteSha : await probeRemoteTag(deps, tag);
+  const remoteSha = await probeRemoteTag(deps, tag);
+  const planRemoteSha = probed?.remoteSha ?? "";
   let localSha = "";
   try {
     localSha = clean2(await deps.run("git", ["rev-parse", "--verify", `refs/tags/${tag}^{commit}`]));
@@ -13936,6 +14018,11 @@ async function ensureTagPushed(deps, tag, sha, probed, releaseRepo) {
   if (remoteSha) {
     if (remoteSha !== sha) {
       const mismatch = `tag ${tag} already exists on origin at ${remoteSha}, but this run intends ${sha}`;
+      if (!planRemoteSha && releaseRepo) {
+        throw new Error(
+          `${mismatch}. The tag appeared on origin while this train was promoting \u2014 another /release claimed this version mid-flight. Refusing to mint a competing or skip-version tag. Stop; let the other train finish, or if its tag/Release is a stray (publish verify failed, tagged SHA lacks the fold commit), delete that stray tag and its GitHub Release with the authorized human's go, then rerun mmi-cli devops release --apply. Do not start a second /release while one is still folding or tagging.`
+        );
+      }
       if (releaseRepo && await isStrayUnreleasedTag(deps, tag, remoteSha, releaseRepo)) {
         throw new Error(
           `${mismatch}. The existing tag is not reachable from origin/main and has no GitHub Release \u2014 it was pushed outside the train, not by a completed release. Sanctioned recovery: delete the stray tag (git push origin --delete ${tag}; git tag -d ${tag} if it exists locally), check the repo's Actions for any workflow the stray tag already triggered, then rerun mmi-cli devops release --apply (if a publish already ran off the stray tag, mint the next version instead of reusing this one). Never complete the release by hand \u2014 a manual GitHub Release or branch push bypasses the train and leaves main behind.`
@@ -14610,6 +14697,7 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   }
   let tagPush;
   try {
+    await assertComputedReleaseTagStillNext(deps, tag);
     tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe, ctx.repo);
   } catch (e) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
@@ -14622,7 +14710,11 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
     throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main", deployModel });
   }
   if (trueMergeGateNote) checks = `${trueMergeGateNote}; ${checks}`;
-  await runGitPush(deps, ["push", "origin", "main"]);
+  try {
+    await runGitPush(deps, ["push", "origin", "main"]);
+  } catch (e) {
+    throw partialTrainRecoveryError(e, { repo: ctx.repo, tag, stage: "main", deployModel });
+  }
   const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
@@ -15008,7 +15100,11 @@ async function runTrainApplyPipeline(mode, input) {
       throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc", deployModel: deployModel2 });
     }
     const autoRunSince = (deps.now ?? Date.now)();
-    await runGitPush(deps, ["push", "origin", "rc"]);
+    try {
+      await runGitPush(deps, ["push", "origin", "rc"]);
+    } catch (e) {
+      throw partialTrainRecoveryError(e, { repo: ctx.repo, tag: tag2, stage: "rc", deployModel: deployModel2 });
+    }
     const d2 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
     return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus };
   }
@@ -17194,7 +17290,12 @@ async function runStage(config = {}, opts = {}) {
   const ranBuild = Boolean(build);
   try {
     await ensureStageRuntimeEnv(config, opts, cwd);
-    if (build) await shell(sub(build), cwd, timeoutMs, stageProcessEnv(stagePort, extraEnv));
+    if (build) {
+      await shell(sub(build), cwd, timeoutMs, {
+        ...stageProcessEnv(stagePort, extraEnv),
+        ...opts.buildEnvMerge ?? {}
+      });
+    }
   } catch (e) {
     (0, import_node_fs16.rmSync)(statePath2, { force: true });
     if (globalStatePath && globalStatePath !== statePath2) (0, import_node_fs16.rmSync)(globalStatePath, { force: true });
@@ -29221,6 +29322,85 @@ async function runStageLiveDown(deps, t) {
   };
 }
 
+// src/stage-build-secrets.ts
+var GITHUB_PACKAGES_TOKEN_REF = "@github-packages-token";
+var ENV_ID_RE = /^[A-Z_][A-Z0-9_]*$/;
+var BARE_VAULT_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+var CROSS_SLUG_REF_RE = /^(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*$/;
+function parseStageBuildSecretEntry(entry) {
+  const trimmed = entry.trim();
+  if (!trimmed) return null;
+  const eq = trimmed.indexOf("=");
+  if (eq === -1) {
+    if (!BARE_VAULT_KEY_RE.test(trimmed) && !CROSS_SLUG_REF_RE.test(trimmed)) return null;
+    const envKey2 = trimmed.includes(":") ? trimmed.slice(trimmed.lastIndexOf(":") + 1) : trimmed;
+    return { envKey: envKey2, ref: trimmed };
+  }
+  const envKey = trimmed.slice(0, eq);
+  const ref = trimmed.slice(eq + 1);
+  if (!ENV_ID_RE.test(envKey) || !ref) return null;
+  if (ref === GITHUB_PACKAGES_TOKEN_REF) return { envKey, ref };
+  if (!BARE_VAULT_KEY_RE.test(ref) && !CROSS_SLUG_REF_RE.test(ref)) return null;
+  return { envKey, ref };
+}
+async function resolveStageBuildSecrets(input) {
+  const entries = input.requiredBuildSecrets;
+  if (!entries?.length) return {};
+  const env = input.env ?? process.env;
+  const out = {};
+  const missing = [];
+  for (const raw of entries) {
+    const parsed = parseStageBuildSecretEntry(raw);
+    if (!parsed) {
+      missing.push(`${raw} (malformed requiredBuildSecrets entry)`);
+      continue;
+    }
+    const { envKey, ref } = parsed;
+    const fromEnv = env[envKey];
+    if (typeof fromEnv === "string" && fromEnv.length > 0) {
+      out[envKey] = fromEnv;
+      continue;
+    }
+    if (ref === GITHUB_PACKAGES_TOKEN_REF) {
+      const fromVault = await input.fetchVault(envKey);
+      if (fromVault) {
+        out[envKey] = fromVault;
+        continue;
+      }
+      missing.push(
+        `${envKey}=${GITHUB_PACKAGES_TOKEN_REF} (central deploy mints this; local /stage needs process env ${envKey} or a stageless project vault secret ${envKey} \u2014 a GitHub PAT with read:packages for npm.pkg.github.com; declare+set via vault secrets, never commit the value)`
+      );
+      continue;
+    }
+    const vault = await fetchVaultRef(input.fetchVault, ref);
+    if (vault) {
+      out[envKey] = vault;
+      continue;
+    }
+    missing.push(
+      `${envKey}=${ref} (not in process env and vault read returned nothing \u2014 declare+set the stageless secret, or export ${envKey} before mmi-cli stage run --apply)`
+    );
+  }
+  if (missing.length) {
+    throw new Error(
+      `stage build secrets unresolved: ${missing.join("; ")}. Compose BuildKit mounts (e.g. NODE_AUTH_TOKEN) read the build process env only.`
+    );
+  }
+  return out;
+}
+async function fetchVaultRef(fetchVault, ref) {
+  const colon = ref.indexOf(":");
+  if (colon === -1) return fetchVault(ref);
+  const prefix = ref.slice(0, colon);
+  const key = ref.slice(colon + 1);
+  if (prefix === "mm-fofu") return fetchVault(key, { slug: "mm-fofu" });
+  if (prefix.startsWith("_org/")) {
+    const provider = prefix.slice("_org/".length);
+    return fetchVault(`${provider}/${key}`, { slug: "_org" });
+  }
+  return null;
+}
+
 // src/stage-commands.ts
 function registerStageCommands(program3) {
   function stagePortFromArgv() {
@@ -29270,6 +29450,30 @@ function registerStageCommands(program3) {
     }
     return Object.keys(merge).length ? merge : void 0;
   }
+  async function fetchStageBuildEnvMerge() {
+    const cfg = await loadConfig();
+    if (!cfg.sagaApiUrl) return void 0;
+    const read = await fetchProjectBySlugChecked(await repoSlug(), registryClientDeps(cfg)).catch(() => null);
+    if (!read?.ok || !read.project) return void 0;
+    const required = read.project.requiredBuildSecrets;
+    if (!required?.length) return void 0;
+    const d = makeSecretsDeps(cfg);
+    const merge = await resolveStageBuildSecrets({
+      requiredBuildSecrets: required,
+      fetchVault: (key, opts) => fetchSecretValue(d, key, opts ?? {})
+    });
+    return Object.keys(merge).length ? merge : void 0;
+  }
+  async function stageVaultOpts() {
+    const [vaultEnvMerge, buildEnvMerge] = await Promise.all([
+      fetchStageVaultEnvMerge(),
+      fetchStageBuildEnvMerge()
+    ]);
+    return {
+      ...vaultEnvMerge ? { vaultEnvMerge } : {},
+      ...buildEnvMerge ? { buildEnvMerge } : {}
+    };
+  }
   function stageStepsFor(res, stops = true) {
     if (res.source === "derived" && res.derived) return derivedStagePlan(res.derived, shellFor(), stops);
     return [{ label: `no local stage to run \u2014 ${res.gap ?? "stage config gap"}` }];
@@ -29367,7 +29571,8 @@ function registerStageCommands(program3) {
       const cfg = res.derived.config;
       const hold = stageKeepAlive();
       try {
-        const result = await runStage(cfg, stageScopedRunOpts({ timeoutMs: o.timeoutMs }));
+        const vaultOpts = await stageVaultOpts();
+        const result = await runStage(cfg, { ...stageScopedRunOpts({ timeoutMs: o.timeoutMs }), ...vaultOpts });
         const reportUrl = reportedStageUrl(res, result);
         const url = reportUrl ? ` \u2014 ${reportUrl}` : "";
         return printLine(o.json ? JSON.stringify({ ...result, source: res.source, url: reportUrl }) : `mmi-cli stage: ${result.message}${url}`);
@@ -29437,14 +29642,14 @@ function registerStageCommands(program3) {
     }
     if (res.source === "none") return failGraceful(`stage run: ${res.gap}`);
     const cfg = res.derived.config;
-    const vaultEnvMerge = await fetchStageVaultEnvMerge();
+    const vaultOpts = await stageVaultOpts();
     try {
       const hold = stageKeepAlive();
       let printed = false;
       try {
         const result = await runStage(cfg, {
           ...stageScopedRunOpts({ timeoutMs: o.timeoutMs, allowStaleEnv: o.allowStaleEnv }),
-          vaultEnvMerge,
+          ...vaultOpts,
           onReady: (ready) => {
             const reportUrl = reportedStageUrl(res, ready);
             const url = reportUrl ? ` \u2014 ${reportUrl}` : "";
@@ -29626,6 +29831,14 @@ function ghPrMergeLocalBranchDeleteWarning(message) {
 function mergeAutoRejectedPrAlreadyClean(message) {
   return /clean status \(enablePullRequestAutoMerge\)|is in clean status/i.test(message);
 }
+function mergeMethodFromParentCount(parentCount) {
+  if (parentCount >= 2) return "merge";
+  return void 0;
+}
+function reportedMergeMethod(input) {
+  if (!input.alreadyMerged) return input.requestedMethod;
+  return input.observedMethod;
+}
 
 // src/merge-cleanup.ts
 var GC_GH_TIMEOUT_MS = 2e4;
@@ -30264,6 +30477,25 @@ async function pollRestPrMergeable(prNumber, repo, gh = defaultGhApi) {
     return "UNKNOWN";
   }
 }
+async function countHeadWorkflowRuns(headSha, repo, gh = defaultGhApi) {
+  if (!headSha) return { state: "failed", error: "no head SHA" };
+  let raw;
+  try {
+    raw = await gh([`repos/${repo}/actions/runs?head_sha=${encodeURIComponent(headSha)}&per_page=1`]);
+  } catch (e) {
+    return { state: "failed", error: `actions/runs read failed for ${headSha.slice(0, 7)} on ${repo}: ${readErrorText(e)}` };
+  }
+  let count;
+  try {
+    count = JSON.parse(raw).total_count;
+  } catch (e) {
+    return { state: "failed", error: `actions/runs payload for ${headSha.slice(0, 7)} was not JSON: ${readErrorText(e)}` };
+  }
+  if (typeof count !== "number" || !Number.isFinite(count) || count < 0) {
+    return { state: "failed", error: `actions/runs payload for ${headSha.slice(0, 7)} carried no usable total_count` };
+  }
+  return { state: "ok", count };
+}
 async function pollRestPrMerged(prNumber, repo, gh = defaultGhApi) {
   try {
     return (await fetchRestPrSnapshot(prNumber, repo, gh)).merged ? { state: "merged" } : { state: "open" };
@@ -33854,7 +34086,27 @@ var surfaces_default = {
         kind: "npm-pack",
         packagePath: "updater"
       },
-      publishVisibility: "public"
+      publishVisibility: "public",
+      prepare: [
+        {
+          command: "npm",
+          args: [
+            "--prefix",
+            "updater",
+            "run",
+            "build"
+          ],
+          inputs: [
+            "updater/src",
+            "updater/build.mjs",
+            "updater/package.json",
+            "updater/tsconfig.json"
+          ],
+          outputs: [
+            "updater/dist/index.cjs"
+          ]
+        }
+      ]
     },
     {
       id: "mmi-cli-lock",
@@ -37891,12 +38143,29 @@ async function waitLoopDiagnosis(label, prNumber, repo) {
   }
   return null;
 }
+async function waitLoopHeadWorkflowRunCount(label, prNumber, repo) {
+  let snapshot;
+  try {
+    snapshot = await fetchRestPrSnapshot(prNumber, repo);
+  } catch (e) {
+    console.warn(
+      `${label}: zero-runs probe FAILED (pulls read: ${e?.message ?? e}) \u2014 not treating as delivery failure this cycle`
+    );
+    return null;
+  }
+  const read = await countHeadWorkflowRuns(snapshot.headSha, repo);
+  if (read.state === "ok") return read.count;
+  console.warn(
+    `${label}: zero-runs probe FAILED (${read.error}) \u2014 not treating as delivery failure this cycle`
+  );
+  return null;
+}
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
   const result = await resolveMergeCiPolicyForCheckout(o.repo);
   if (o.json) return printLine(JSON.stringify(result));
   printLine(`merge CI policy: ${result.policy} (${result.reason})`);
 });
-pr.command("checks-wait <number>").description(`bounded wait for ALL checks on the PR head, required or not (#5336); skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR \u2014 GitHub never queues checks for one (#2970). REST-only polling with a pool floor (#3024). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED or the PR is CONFLICTING, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired or the API pool ran dry (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
+pr.command("checks-wait <number>").description(`bounded wait for ALL checks on the PR head, required or not (#5336); skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR \u2014 GitHub never queues checks for one (#2970), and fails early on a confirmed zero-workflow-runs head instead of burning the full budget as pending (#5400). REST-only polling with a pool floor (#3024). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED, the PR is CONFLICTING, or GitHub delivered zero runs; exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired or the API pool ran dry (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
   let timeoutMs;
   if (o.timeout !== void 0) {
     const minutes = Number(o.timeout);
@@ -37922,6 +38191,8 @@ pr.command("checks-wait <number>").description(`bounded wait for ALL checks on t
     // #3388: on a confirmed red, read the failing runs' annotations so a wall-clock budget kill stops
     // reading as "your tests failed". One call per failing run, only at the verdict.
     diagnoseFailure: () => waitLoopDiagnosis("pr checks-wait", number, repo),
+    // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
+    pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
     baseBranch,
     sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
     log: (message) => console.warn(message),
@@ -37936,7 +38207,7 @@ pr.command("checks-wait <number>").description(`bounded wait for ALL checks on t
   } else if (result.status === "timeout") {
     const stuckQueuing = /no-checks-reported/i.test(result.detail ?? "");
     printLine(
-      `pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.` + (stuckQueuing ? " Tip: jobs never appeared \u2014 mmi-live may be saturated or Actions may be failing before checkout; check runner health (docs/Guides/gh-runner-runbook.md) and re-run the workflow." : "")
+      `pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.` + (stuckQueuing ? " Tip: check-runs never appeared \u2014 if `gh api repos/<owner>/<repo>/actions/runs?head_sha=<sha>` shows total_count=0, see docs/Guides/gh-runner-runbook.md \xA7 Zero workflow runs; otherwise mmi-live may be saturated or Actions may be failing before checkout (docs/Guides/gh-runner-runbook.md)." : "")
     );
   } else if (result.status === "rate-limited") {
     printLine(`pr checks-wait: rate-limited \u2014 ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
@@ -37944,6 +38215,8 @@ pr.command("checks-wait <number>").description(`bounded wait for ALL checks on t
     printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) \u2014 ${result.reason}`);
   } else if (result.detail === "stale-head") {
     printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) \u2014 ${result.reason}`);
+  } else if (result.detail === "zero-runs") {
+    printLine(`pr checks-wait: failure (zero workflow runs delivered, NOT pending checks) \u2014 ${result.reason}`);
   } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
@@ -38014,6 +38287,8 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         // #3388: `pr land` is the batch path — the one most likely to self-DOS the shared runner and
         // then read its own wall-clock kill as a broken diff.
         diagnoseFailure: () => waitLoopDiagnosis("pr land", prNumber, repo),
+        // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
+        pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
         baseBranch: "development",
         sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
         log: (message) => console.warn(message),
@@ -38136,6 +38411,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       pollMergeable: () => pollRestPrMergeable(number, repo),
       pollRateLimit: () => waitLoopCorePool("pr merge --wait"),
       diagnoseFailure: () => waitLoopDiagnosis("pr merge --wait", number, repo),
+      pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
       baseBranch,
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
@@ -38255,11 +38531,27 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   invalidateStatuslineBoardCache();
   const devDeploy = devDeployPlan.applicable && devDeployDeps && remoteNotAttemptedReason !== "pr-already-merged" ? await dispatchDevDeploy(repoForPostCleanup, devDeployDeps) : void 0;
   const devDeployManual = devDeployPlan.applicable ? devDeployPlan.manualPointer : void 0;
+  let observedMethod;
+  if (remoteNotAttemptedReason === "pr-already-merged" && repoForPostCleanup) {
+    try {
+      const mergeSha = (await defaultGitHubClient().rest("GET", `repos/${repoForPostCleanup}/pulls/${number}`)).merge_commit_sha;
+      if (mergeSha) {
+        const commit = await defaultGitHubClient().rest("GET", `repos/${repoForPostCleanup}/commits/${mergeSha}`);
+        observedMethod = mergeMethodFromParentCount(Array.isArray(commit.parents) ? commit.parents.length : 0);
+      }
+    } catch {
+    }
+  }
+  const methodField = reportedMergeMethod({
+    requestedMethod: method.slice(2),
+    alreadyMerged: remoteNotAttemptedReason === "pr-already-merged",
+    observedMethod
+  });
   console.log(JSON.stringify({
     mergeStatus: "merged",
     merged: number,
     branch: headRef,
-    method: method.slice(2),
+    ...methodField ? { method: methodField } : {},
     remoteBranch,
     housekeeping,
     // `boardAdvance` keeps its published array shape; `boardAdvanceStatus` is the field a caller reads to
@@ -38297,11 +38589,12 @@ registerStageCommands(program2);
 var GH_TRAIN_TIMEOUT_MS = 3e4;
 var GH_RUN_WATCH_TIMEOUT_MS = 20 * 6e4;
 var NODE_PREPARE_TIMEOUT_MS = 10 * 6e4;
+var NODE_VERIFY_TIMEOUT_MS = 5 * 6e4;
 var NPM_TRAIN_TIMEOUT_MS = 6e4;
 function trainApplyDeps() {
   return {
     run: async (file, args) => {
-      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       try {
         return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
       } catch (e) {
@@ -38640,7 +38933,8 @@ for (const commandName of ["rcand", "release"]) {
         applyTrainFollowUpExit(followUpStatus);
         return;
       } catch (e) {
-        return failGraceful(`${commandName}: ${e.message}`);
+        process.exitCode = 1;
+        return await failGraceful(`${commandName}: ${e.message}`);
       }
     }
     const repo = o.repo ?? await resolveRepo();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",