@mutmutco/cli 4.0.2 → 4.0.3

package/dist/main.cjs

@@ -9155,6 +9155,7 @@ var OWNER2 = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
 var ORG_INFRA_SLUG = "_org";
+var JERV_VAULT_POINTER = "Not in the MMI vault? Jerv service, personal API and model-provider credentials live in the separate Jerv AWS Vault \u2014 enumerate: `jerv-cli vault list`; consume keyless: `jerv-cli vault use <KEY> -- <cmd>` (values are never printed).";
 var KEY_MAX_PATH_SEGMENTS = 4;
 var KEY_RE = new RegExp(`^(?:[a-z0-9][a-z0-9-]*/){0,${KEY_MAX_PATH_SEGMENTS}}[A-Za-z][A-Za-z0-9_]*$`);
 function isValidSecretKey(key) {
@@ -9171,7 +9172,7 @@ function secretParamName(slug, key) {
   return `${SSM_ROOT}/${slug}/${key}`;
 }
 function formatSecretList(items) {
-  if (!items.length) return "no secrets";
+  if (!items.length) return `no secrets \u2014 ${JERV_VAULT_POINTER}`;
   const width = Math.max(...items.map((i) => i.key.length));
   return items.map((i) => {
     const head = `${i.canManage ? "*" : " "} ${i.key.padEnd(width)}  ${i.tier}`;
@@ -9362,7 +9363,7 @@ function formatCapabilities(r) {
   const items = [...r.capabilities ?? []].sort((a, b) => a.scope.localeCompare(b.scope));
   if (!items.length) return `${head}
 
-no vault credentials visible`;
+no vault credentials visible \u2014 ${JERV_VAULT_POINTER}`;
   const width = Math.max(...items.map((i) => i.scope.length));
   const lines = items.map(
     (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.grantScope ? `${i.reason} (${i.grantScope})` : i.reason}`
@@ -9485,7 +9486,8 @@ function resolveNotFoundGuidance(input) {
   const lines = [
     `Secret ${key} was not found at ${tried}, and no key named ${leaf} is visible to you.`,
     `Locate it by intent first: \`mmi-cli vault secrets find "<what it is for>"\` \u2014 it returns the exact keyless-use command.`,
-    mnemonic
+    mnemonic,
+    JERV_VAULT_POINTER
   ];
   if (isMaster) {
     lines.push("You are master: if it truly does not exist yet, create it with `mmi-cli vault secrets set` rather than requesting a grant from yourself.");
@@ -9767,6 +9769,7 @@ async function secretsVerify(deps, key, opts) {
     if (!value) {
       deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
       deps.err(`Locate a key across every vault you can reach: mmi-cli oracle org access capabilities${opts.repo ? ` --repo ${opts.repo}` : ""}`);
+      deps.err(JERV_VAULT_POINTER);
       return false;
     }
     deps.log(`${key}: PRESENT (${value.length} chars) \u2014 reachability only; no provider verifier is configured for ${secretLeafName(key)}, so the credential itself was not validated`);
@@ -10422,6 +10425,7 @@ async function fetchSecretForUse(deps, { repo, key, slug }) {
 // src/report.ts
 var HUB_REPO = "mutmutco/MMI-Hub";
 var REPORT_LABEL = "report";
+var LEARNING_LABEL = "learning";
 var REPORT_LOOP_KIND = "friction";
 var REPORT_SURFACE_WAIVER_REASON = "Hub-only friction filing; attribution repo is footer-only; no honest single surface";
 function preflightReportSurface() {
@@ -10819,10 +10823,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.0.2",
-    tag: "v4.0.2",
-    commit: "e703fd090be7",
-    npm: "@mutmutco/cli@4.0.2"
+    version: "4.0.3",
+    tag: "v4.0.3",
+    commit: "3a588e3fa3a3",
+    npm: "@mutmutco/cli@4.0.3"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10839,14 +10843,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.0.2"
+          v3Target: "v4.0.3"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.0.2 and redeploy the Hub Lambda from tag v4.0.2 (e703fd090be7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.0.2 (@mutmutco/cli@4.0.2, tag commit e703fd090be7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.0.3 and redeploy the Hub Lambda from tag v4.0.3 (3a588e3fa3a3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.0.3 (@mutmutco/cli@4.0.3, tag commit 3a588e3fa3a3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -17606,6 +17610,7 @@ async function postIssueComment(client, input) {
 
 // src/skill-lesson.ts
 var SKILL_LESSON_LABEL = "skill-lesson";
+var SKILL_LESSON_FILE_LABELS = [SKILL_LESSON_LABEL, LEARNING_LABEL];
 var SKILL_LESSON_LOOP_KIND = "lesson";
 var SKILL_NAMES = ["bootstrap", "browser-automation", "doctor", "epic", "hotfix", "mmi", "onboard", "rcand", "release", "resume", "secrets", "stage"];
 function assertSkillName(name) {
@@ -17638,6 +17643,7 @@ function findDuplicateLesson(source, openLessons) {
 }
 
 // src/session-identity.ts
+var import_node_crypto4 = require("node:crypto");
 var import_node_os7 = require("node:os");
 
 // src/plugin-guard-io.ts
@@ -18625,12 +18631,19 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
 // src/session-identity.ts
 var SESSION_ID_ENV_VARS = [
   "MMI_SESSION_ID",
+  "MMI_GATE_SESSION_ID",
   "CLAUDE_SESSION_ID",
   "CLAUDE_CODE_SESSION_ID",
   "CODEX_SESSION_ID",
+  "CODEX_THREAD_ID",
   "CURSOR_SESSION_ID",
+  "HERMES_SESSION_ID",
   "PI_SESSION_ID"
 ];
+var SYNTH_SESSION_PREFIX = "synth-";
+function isHostSessionId(session) {
+  return Boolean(session) && !session.startsWith(SYNTH_SESSION_PREFIX);
+}
 function readSessionId(env) {
   for (const key of SESSION_ID_ENV_VARS) {
     const value = env[key]?.trim();
@@ -18638,11 +18651,18 @@ function readSessionId(env) {
   }
   return void 0;
 }
+var synthesizedSessionId;
+function fallbackSessionId(surface) {
+  if (!synthesizedSessionId) {
+    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto4.randomBytes)(3).toString("hex")}`;
+  }
+  return synthesizedSessionId;
+}
 function describeSessionIdentity(env = process.env) {
-  const session = readSessionId(env);
+  const surface = detectSurface(env);
   return {
-    ...session ? { session } : {},
-    surface: detectSurface(env),
+    session: readSessionId(env) ?? fallbackSessionId(surface),
+    surface,
     host: (0, import_node_os7.hostname)()
   };
 }
@@ -19910,7 +19930,7 @@ async function postClaimMarkerComment(client, item) {
     const actor = describeSessionIdentity();
     const marker = {
       v: 1,
-      ...actor.session ? { session: actor.session } : {},
+      session: actor.session,
       surface: actor.surface,
       host: actor.host,
       ts: (/* @__PURE__ */ new Date()).toISOString()
@@ -20051,7 +20071,7 @@ function sameClaimHost(a, b) {
 }
 function laneOwnership(marker, current) {
   if (!marker) return "unknown";
-  if (marker.session && current.session) {
+  if (isHostSessionId(marker.session) && isHostSessionId(current.session)) {
     return marker.session === current.session ? "mine" : "other";
   }
   if (marker.surface && current.surface && marker.surface !== current.surface) return "other";
@@ -21727,14 +21747,14 @@ function renderVerifyBroker(input) {
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_fs22 = require("node:fs");
 var import_promises3 = require("node:fs/promises");
 var import_node_path20 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto4.createHash)("sha256");
+  const hash = (0, import_node_crypto5.createHash)("sha256");
   for await (const chunk of (0, import_node_fs22.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -22874,7 +22894,7 @@ async function announceRelease(deps, args) {
 }
 
 // src/repo-index.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_child_process12 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
@@ -23064,7 +23084,7 @@ function rebuildRepoIndex(cwd, repoSlug3) {
       continue;
     }
     if (text.length > 15e5) continue;
-    const hash = (0, import_node_crypto5.createHash)("sha256").update(text).digest("hex").slice(0, 16);
+    const hash = (0, import_node_crypto6.createHash)("sha256").update(text).digest("hex").slice(0, 16);
     const symbols = extractSymbols(text);
     const docBlurb = extractModuleBlurb(text);
     const top = rel.includes("/") ? rel.split("/")[0] : "";
@@ -23169,16 +23189,16 @@ function inferRepoSlug(cwd, exec = import_node_child_process12.execFileSync) {
 }
 
 // src/repo-index-cloud-client.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 
 // src/repo-index-v4/builder.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var import_node_child_process13 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
 var import_node_path23 = require("node:path");
 
 // src/repo-index-v4/chunks.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_fs24 = require("node:fs");
 var import_node_path22 = require("node:path");
 
@@ -23245,7 +23265,7 @@ async function parserFor(language) {
   return parser;
 }
 function sha256(value) {
-  return (0, import_node_crypto6.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(value).digest("hex");
 }
 function pointerId(path2, kind, contentHash, start, end, symbol) {
   return sha256(["repo-index-v4", path2, kind, contentHash, String(start), String(end), symbol ?? ""].join("\0"));
@@ -23365,7 +23385,7 @@ function canonicalJson(value) {
   return `{${Object.keys(record).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(record[k])}`).join(",")}}`;
 }
 function sha2562(value) {
-  return (0, import_node_crypto7.createHash)("sha256").update(canonicalJson(value)).digest("hex");
+  return (0, import_node_crypto8.createHash)("sha256").update(canonicalJson(value)).digest("hex");
 }
 function quantizeV4Vector(vector) {
   return vector.map((value) => Number(value.toFixed(V4_VECTOR_DECIMAL_PLACES)));
@@ -23692,7 +23712,7 @@ async function searchRepoIndexCloud(query, opts, deps) {
     const body = await res.json().catch(() => ({}));
     if (!res.ok) return { ok: false, error: body.error ?? `search HTTP ${res.status}`, status: res.status };
     const shadowRate = Math.max(0, Math.min(1, Number(process.env.MMI_REPO_INDEX_V4_SHADOW_RATE ?? 0.1) || 0));
-    if ((0, import_node_crypto8.createHash)("sha256").update(query).digest()[0] / 256 < shadowRate) {
+    if ((0, import_node_crypto9.createHash)("sha256").update(query).digest()[0] / 256 < shadowRate) {
       void fetchWithRetry(
         deps.fetch ?? fetch,
         `${deps.baseUrl.replace(/\/$/, "")}/repo-index/v4/shadow`,
@@ -26031,7 +26051,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/app-actor.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -26075,7 +26095,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto9.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto10.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -27003,7 +27023,7 @@ var import_node_os14 = require("node:os");
 var import_node_path32 = require("node:path");
 
 // src/bootstrap-drift.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -27023,7 +27043,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto10.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -27186,7 +27206,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -27199,7 +27219,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto11.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto12.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -29739,7 +29759,7 @@ function registerBoardCommands(program3) {
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
   board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--allow-partial applies to the paginated path and detail reads.\n").action((o) => runBoardRead(o));
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").addHelpText("after", "\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
   ).action(async (issueRefs, o) => {
     if (issueRefs.length === 1) {
@@ -30360,7 +30380,7 @@ async function checkDocsIndexAtHead(opts, deps) {
 
 // src/issue-commands.ts
 var import_node_fs38 = require("node:fs");
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
   constructor(message, payload) {
@@ -30651,7 +30671,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto12.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto13.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -31283,7 +31303,23 @@ async function collectStatus() {
   } catch {
     stage = { running: false };
   }
-  return { repo, branch, worktrees, myOpenPrs, claimedItems, stage };
+  let releaseTrack;
+  let branches;
+  try {
+    const cfg = await loadConfigOrDiscover();
+    if (cfg.sagaApiUrl) {
+      const slug = await repoSlug();
+      const deps = registryClientDeps(cfg);
+      const read = await fetchProjectBySlugChecked(slug, deps);
+      if (read.ok && read.project) {
+        const trackRepo = repo ?? `mutmutco/${slug}`;
+        releaseTrack = resolveReleaseTrack(read.project, void 0, trackRepo);
+        branches = branchesForTrack(releaseTrack);
+      }
+    }
+  } catch {
+  }
+  return { repo, branch, releaseTrack, branches, worktrees, myOpenPrs, claimedItems, stage };
 }
 var PRIORITY_RANK = {
   Urgent: 0,
@@ -31428,6 +31464,9 @@ function registerDiscoveryCommands(program3) {
       } else {
         console.log(`repo: ${report.repo ?? "unknown"}`);
         console.log(`branch: ${report.branch}`);
+        if (report.releaseTrack) {
+          console.log(`release track: ${report.releaseTrack} (${(report.branches ?? []).join(" -> ")})`);
+        }
         console.log(`worktrees: ${report.worktrees.length} linked`);
         console.log(`my open PRs: ${report.myOpenPrs.length}`);
         console.log(`claimed board items: ${report.claimedItems.length}`);
@@ -37568,7 +37607,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
-    args = buildIssueArgs({ type: "task", title, body, priority, repo: targetRepo3, labels: [SKILL_LESSON_LABEL] });
+    args = buildIssueArgs({ type: "task", title, body, priority, repo: targetRepo3, labels: [...SKILL_LESSON_FILE_LABELS] });
   } catch (e) {
     return fail(`skill-lesson: ${e.message}`);
   }
@@ -37610,9 +37649,11 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   });
   if (surfaceWarn) process.stderr.write(`${surfaceWarn}
 `);
-  try {
-    await execFileP2("gh", ["label", "create", SKILL_LESSON_LABEL, "--color", "c2e0c6", "--repo", targetRepo3], { timeout: GH_MUTATION_TIMEOUT_MS });
-  } catch {
+  for (const [label, color] of [[SKILL_LESSON_LABEL, "c2e0c6"], [LEARNING_LABEL, "ededed"]]) {
+    try {
+      await execFileP2("gh", ["label", "create", label, "--color", color, "--repo", targetRepo3], { timeout: GH_MUTATION_TIMEOUT_MS });
+    } catch {
+    }
   }
   const created = await ghCreate(args);
   const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo3, priority);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",