@mutmutco/cli 4.1.15 → 4.1.17

package/dist/main.cjs

@@ -13181,10 +13181,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.1.15",
-    tag: "v4.1.15",
-    commit: "ed45d37a071b",
-    npm: "@mutmutco/cli@4.1.15"
+    version: "4.1.17",
+    tag: "v4.1.17",
+    commit: "65f193ccd344",
+    npm: "@mutmutco/cli@4.1.17"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -13201,14 +13201,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.1.15"
+          v3Target: "v4.1.17"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.1.15 and redeploy the Hub Lambda from tag v4.1.15 (ed45d37a071b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.1.15 (@mutmutco/cli@4.1.15, tag commit ed45d37a071b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.1.17 and redeploy the Hub Lambda from tag v4.1.17 (65f193ccd344); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.1.17 (@mutmutco/cli@4.1.17, tag commit 65f193ccd344 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -14193,7 +14193,8 @@ async function runPrForIssue(deps, issueRef, opts) {
   return extractPrForIssueResponse(resp);
 }
 async function runIssueViewContext(deps, opts) {
-  const fields = opts.comments || opts.context ? ensureField(opts.jsonFields, "comments") : opts.jsonFields;
+  const baseFields = opts.context ? opts.jsonFields.split(",").map((field) => field.trim()).filter((field) => field !== "linkedPrs" && field !== "children").join(",") : opts.jsonFields;
+  const fields = opts.comments || opts.context ? ensureField(baseFields, "comments") : baseFields;
   const base = await deps.ghJson(["issue", "view", String(opts.number), "--repo", opts.repo, "--json", fields], GH_LIST_TIMEOUT_MS);
   if (!opts.context) return base;
   const result = { ...base };
@@ -20410,13 +20411,44 @@ function crossRepoAmbiguousRefusalMessage(ambiguous, repo, context = "pr merge")
   const first = `#${ambiguous[0] ?? "N"}`;
   return `${context}: REFUSED \u2014 GitHub will close ${named} on merge (a bare \`#N\` after a closing keyword always means the repo the PR lives in), but this body also mentions ${first} qualified against a DIFFERENT repo elsewhere \u2014 check whether that closing keyword was meant to carry an explicit owner/repo#N qualifier instead. Reword the closing reference with the full owner/repo#N form, or re-run with --force to merge anyway and let ${named} close.`;
 }
-function commitMessagesText(commits) {
-  if (!Array.isArray(commits)) return "";
+function parsedCommits(commits) {
+  if (!Array.isArray(commits)) return [];
   return commits.map((commit) => {
     const { messageHeadline, messageBody } = commit ?? {};
-    return `${typeof messageHeadline === "string" ? messageHeadline : ""}
-${typeof messageBody === "string" ? messageBody : ""}`;
-  }).join("\n");
+    return {
+      headline: typeof messageHeadline === "string" ? messageHeadline : "",
+      body: typeof messageBody === "string" ? messageBody : ""
+    };
+  });
+}
+function commitMessagesText(commits) {
+  return parsedCommits(commits).map((commit) => `${commit.headline}
+${commit.body}`).join("\n");
+}
+function defaultSquashBodyFromCommits(commits) {
+  if (commits.length <= 1) {
+    const only = commits[0];
+    if (!only) return "";
+    const body = only.body.trim();
+    return body || only.headline.trim();
+  }
+  return commits.map((commit) => `${commit.headline}
+
+${commit.body}`.trim()).filter(Boolean).join("\n\n");
+}
+function rewriteUnregisteredClosingKeywords(text, allowedClosing) {
+  if (!text.includes("#")) return text;
+  const allowed = new Set(allowedClosing);
+  CLOSING_MENTION_RE.lastIndex = 0;
+  const segments = text.split(/(```[\s\S]*?```|~~~[\s\S]*?~~~|`[^`\n]*`)/g);
+  return segments.map((seg, i) => {
+    if (i % 2 === 1) return seg;
+    return seg.replace(CLOSING_MENTION_RE, (match, _keyword, plain, linked) => {
+      const n = Number(plain ?? linked);
+      if (!Number.isInteger(n) || n <= 0 || allowed.has(n)) return match;
+      return `part of #${n}`;
+    });
+  }).join("");
 }
 function parseClosingGuardInput(raw, repo) {
   if (!raw || typeof raw !== "object") return void 0;
@@ -20428,17 +20460,25 @@ function parseClosingGuardInput(raw, repo) {
     if (typeof n !== "number" || !Number.isInteger(n) || n <= 0) return void 0;
     closing.push(n);
   }
+  const parsed = Array.isArray(commits) ? parsedCommits(commits) : [];
   const commitClosing = [...new Set(findClosingMentions(commitMessagesText(commits)).map((m) => m.issue))];
   const text = `${typeof title === "string" ? title : ""}
 ${typeof body === "string" ? body : ""}`;
-  return { state, text, closing, commitClosing, repo };
+  return { state, text, closing, commitClosing, commits: parsed, repo };
 }
-function restCommitMessagesText(commits) {
-  if (!Array.isArray(commits)) return "";
+function parsedRestCommits(commits) {
+  if (!Array.isArray(commits)) return [];
   return commits.map((entry) => {
     const message = (entry ?? {}).commit?.message;
-    return typeof message === "string" ? message : "";
-  }).join("\n");
+    if (typeof message !== "string" || !message) return { headline: "", body: "" };
+    const nl = message.indexOf("\n");
+    if (nl === -1) return { headline: message, body: "" };
+    return { headline: message.slice(0, nl), body: message.slice(nl + 1).replace(/^\n/, "") };
+  });
+}
+function restCommitMessagesText(commits) {
+  return parsedRestCommits(commits).map((commit) => `${commit.headline}
+${commit.body}`).join("\n");
 }
 function parseRestClosingGuardInput(prRaw, commitsRaw, repo) {
   if (!prRaw || typeof prRaw !== "object") return void 0;
@@ -20446,10 +20486,11 @@ function parseRestClosingGuardInput(prRaw, commitsRaw, repo) {
   if (typeof state !== "string") return void 0;
   const bodyText = typeof body === "string" ? body : "";
   const closing = [...new Set(findClosingMentions(bodyText).map((m) => m.issue))];
+  const parsed = parsedRestCommits(commitsRaw);
   const commitClosing = [...new Set(findClosingMentions(restCommitMessagesText(commitsRaw)).map((m) => m.issue))];
   const text = `${typeof title === "string" ? title : ""}
 ${bodyText}`;
-  return { state: merged === true ? "MERGED" : state.toUpperCase(), text, closing, commitClosing, repo };
+  return { state: merged === true ? "MERGED" : state.toUpperCase(), text, closing, commitClosing, commits: parsed, repo };
 }
 function negatedClosingRefusalMessage(negated, context = "pr merge") {
   const named = negated.map((n) => `#${n}`).join(", ");
@@ -20459,7 +20500,7 @@ function negatedClosingRefusalMessage(negated, context = "pr merge") {
 function commitClosingRefusalMessage(closing, context = "pr merge") {
   const named = closing.map((n) => `#${n}`).join(", ");
   const first = `#${closing[0] ?? "N"}`;
-  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. Remove close/fix/resolve + ${first} from the commit message (if the issue must stay open, use "Part of ${first}" / "Refs ${first}" / "leaves ${first} open" \u2014 never "does not close ${first}"), or re-run with --force to merge anyway and let ${named} close.`;
+  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. Remove close/fix/resolve + ${first} from the commit message (if the issue must stay open, use "Part of ${first}" / "Refs ${first}" / "leaves ${first} open" \u2014 never "does not close ${first}"), edit the squash body at merge time (--squash-body-file), or re-run with --force to merge anyway and let ${named} close.`;
 }
 function alreadyClosedCommitClosingMessage(closed, context = "pr merge") {
   const named = closed.map((n) => `#${n}`).join(", ");
@@ -20481,8 +20522,9 @@ function evaluateClosingGuard(input, opts) {
     };
   }
   if (input.state !== "OPEN") return { blocked: false };
+  const squashBodyClosing = opts.squashBodyText ? [...new Set(findClosingMentions(opts.squashBodyText).map((m) => m.issue))] : void 0;
   const { open: commitClosing, skippedClosed } = partitionCommitClosings(
-    input.commitClosing ?? [],
+    squashBodyClosing ?? input.commitClosing ?? [],
     input.closing,
     input.alreadyClosed
   );
@@ -25225,9 +25267,35 @@ function repoIndexPathTieBreak(path2) {
   if (/\.(test|spec)\.[^.]+$/i.test(p)) return 1;
   return 0;
 }
+var LOCAL_REPO_INDEX_REFRESH_BUDGET_MS = 2e3;
+var LOCAL_REPO_INDEX_DELTA_FILE_LIMIT = 50;
 function repoIndexStorePath(cwd) {
   return repoRuntimeStatePath(cwd, "repo-index", "index.json");
 }
+function localRepoIndexUsagePath(cwd) {
+  return repoRuntimeStatePath(cwd, "repo-index", "local-usage.json");
+}
+function recordLocalRepoIndexQueryUsage(cwd, now = /* @__PURE__ */ new Date()) {
+  const store = localRepoIndexUsagePath(cwd);
+  let previous = 0;
+  try {
+    const raw = JSON.parse((0, import_node_fs24.readFileSync)(store, "utf8"));
+    if (typeof raw.count === "number" && Number.isFinite(raw.count)) previous = raw.count;
+  } catch {
+  }
+  (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(store), { recursive: true });
+  (0, import_node_fs24.writeFileSync)(store, `${JSON.stringify({ count: previous + 1, updatedAt: now.toISOString() }, null, 2)}
+`, "utf8");
+}
+function readLocalRepoIndexQueryUsage(cwd) {
+  try {
+    const raw = JSON.parse((0, import_node_fs24.readFileSync)(localRepoIndexUsagePath(cwd), "utf8"));
+    if (typeof raw.count !== "number" || !Number.isFinite(raw.count)) return null;
+    return { count: raw.count, updatedAt: raw.updatedAt ?? "" };
+  } catch {
+    return null;
+  }
+}
 function isHardDeniedPath(relPosix) {
   return isHardDeniedRepoIndexPath(relPosix);
 }
@@ -25338,14 +25406,41 @@ function listCandidatePaths(cwd, exec = import_node_child_process12.execFileSync
     return [];
   }
 }
-function rebuildRepoIndex(cwd, repoSlug3) {
-  const candidates = listCandidatePaths(cwd).filter(isIndexablePath);
-  const ignored = defaultIsIgnored(cwd, candidates);
-  const readmeHints = loadReadmeHints(cwd, candidates.filter((p) => !ignored.has(p)));
-  const entries = [];
+var RepoIndexRefreshBudgetError = class extends Error {
+  constructor() {
+    super(`local index refresh exceeded ${LOCAL_REPO_INDEX_REFRESH_BUDGET_MS}ms`);
+  }
+};
+function assertRefreshBudget(deadline) {
+  if (deadline !== void 0 && Date.now() >= deadline) throw new RepoIndexRefreshBudgetError();
+}
+function deadlineExec(deadline) {
+  return ((file, args, options) => {
+    assertRefreshBudget(deadline);
+    return (0, import_node_child_process12.execFileSync)(file, args, {
+      ...options,
+      timeout: Math.max(1, deadline - Date.now()),
+      windowsHide: true
+    });
+  });
+}
+function gitHead(cwd, exec = import_node_child_process12.execFileSync) {
+  try {
+    return String(exec("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", windowsHide: true })).trim() || void 0;
+  } catch (error) {
+    if (error instanceof RepoIndexRefreshBudgetError) throw error;
+    return void 0;
+  }
+}
+function sourceFilesForIndex(cwd, deadline) {
+  const exec = deadline === void 0 ? import_node_child_process12.execFileSync : deadlineExec(deadline);
+  const candidates = listCandidatePaths(cwd, exec).filter(isIndexablePath);
+  assertRefreshBudget(deadline);
+  const ignored = defaultIsIgnored(cwd, candidates, exec);
+  const files = [];
   for (const rel of candidates) {
-    if (ignored.has(rel)) continue;
-    if (isHardDeniedPath(rel)) continue;
+    assertRefreshBudget(deadline);
+    if (ignored.has(rel) || isHardDeniedPath(rel)) continue;
     const abs = (0, import_node_path21.join)(cwd, ...rel.split("/"));
     if (!(0, import_node_fs24.existsSync)(abs)) continue;
     let text;
@@ -25355,31 +25450,118 @@ function rebuildRepoIndex(cwd, repoSlug3) {
       continue;
     }
     if (text.length > 15e5) continue;
-    const hash = (0, import_node_crypto6.createHash)("sha256").update(text).digest("hex").slice(0, 16);
-    const symbols = extractSymbols(text);
-    const docBlurb = extractModuleBlurb(text);
-    const top = rel.includes("/") ? rel.split("/")[0] : "";
-    const hint = docBlurb ?? (top ? readmeHints.get(top) : void 0) ?? readmeHints.get("");
-    entries.push({
+    files.push({
       path: rel,
-      hash,
-      symbols,
-      ...hint ? { blurb: hint.slice(0, BLURB_CAP) } : {}
+      hash: (0, import_node_crypto6.createHash)("sha256").update(text).digest("hex").slice(0, 16),
+      text
     });
   }
+  return files;
+}
+function entryForSource(file, readmeHints) {
+  const docBlurb = extractModuleBlurb(file.text);
+  const top = file.path.includes("/") ? file.path.split("/")[0] : "";
+  const hint = docBlurb ?? (top ? readmeHints.get(top) : void 0) ?? readmeHints.get("");
+  return {
+    path: file.path,
+    hash: file.hash,
+    symbols: extractSymbols(file.text),
+    ...hint ? { blurb: hint.slice(0, BLURB_CAP) } : {}
+  };
+}
+function buildRepoIndexProjection(cwd, repoSlug3, deadline) {
+  const files = sourceFilesForIndex(cwd, deadline);
+  assertRefreshBudget(deadline);
+  const readmeHints = loadReadmeHints(cwd, files.map((file) => file.path));
+  const entries = files.map((file) => {
+    assertRefreshBudget(deadline);
+    return entryForSource(file, readmeHints);
+  });
   entries.sort((a, b) => a.path.localeCompare(b.path));
-  const projection = {
+  const exec = deadline === void 0 ? import_node_child_process12.execFileSync : deadlineExec(deadline);
+  const indexHead = gitHead(cwd, exec);
+  return {
     schema: REPO_INDEX_SCHEMA,
     repo: repoSlug3,
     builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...indexHead ? { indexHead } : {},
     entries
   };
+}
+function writeRepoIndex(cwd, projection) {
   const store = repoIndexStorePath(cwd);
   (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(store), { recursive: true });
   (0, import_node_fs24.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
 `, "utf8");
+}
+function rebuildRepoIndex(cwd, repoSlug3) {
+  const projection = buildRepoIndexProjection(cwd, repoSlug3);
+  writeRepoIndex(cwd, projection);
   return projection;
 }
+function refreshRepoIndex(cwd, repoSlug3, options = {}) {
+  const budgetMs = options.budgetMs ?? LOCAL_REPO_INDEX_REFRESH_BUDGET_MS;
+  const deadline = Date.now() + Math.max(0, budgetMs);
+  try {
+    const exec = deadlineExec(deadline);
+    const existing = loadRepoIndex(cwd);
+    if (!existing) {
+      const projection2 = buildRepoIndexProjection(cwd, repoSlug3, deadline);
+      writeRepoIndex(cwd, projection2);
+      return { status: "rebuilt", projection: projection2 };
+    }
+    const head = gitHead(cwd, exec);
+    if (!head) return { status: "stale", reason: "checkout HEAD is unavailable" };
+    const worktreeDirty = String(exec("git", ["status", "--porcelain", "--untracked-files=normal"], {
+      cwd,
+      encoding: "utf8",
+      windowsHide: true
+    })).length > 0;
+    if (existing.indexHead === head && !worktreeDirty) return { status: "refreshed", projection: existing };
+    if (!existing.indexHead) {
+      const projection2 = buildRepoIndexProjection(cwd, repoSlug3, deadline);
+      writeRepoIndex(cwd, projection2);
+      return { status: "rebuilt", projection: projection2 };
+    }
+    const files = sourceFilesForIndex(cwd, deadline);
+    const current = new Map(files.map((file) => [file.path, file]));
+    const previous = new Map(existing.entries.map((entry) => [entry.path, entry]));
+    const changed = /* @__PURE__ */ new Set();
+    for (const [path2, file] of current) {
+      if (previous.get(path2)?.hash !== file.hash) changed.add(path2);
+    }
+    for (const path2 of previous.keys()) {
+      if (!current.has(path2)) changed.add(path2);
+    }
+    const readmeChanged = [...changed].some((path2) => path2 === "README.md" || /^[^/]+\/README\.md$/.test(path2));
+    if (changed.size > LOCAL_REPO_INDEX_DELTA_FILE_LIMIT || readmeChanged) {
+      const projection2 = buildRepoIndexProjection(cwd, repoSlug3, deadline);
+      writeRepoIndex(cwd, projection2);
+      return { status: "rebuilt", projection: projection2 };
+    }
+    const changedSources = [...changed].map((path2) => current.get(path2)).filter((file) => file !== void 0);
+    const needsHint = changedSources.some((file) => !extractModuleBlurb(file.text));
+    const readmeHints = needsHint ? loadReadmeHints(cwd, files.map((file) => file.path)) : /* @__PURE__ */ new Map();
+    const entries = files.map((file) => {
+      assertRefreshBudget(deadline);
+      const old = previous.get(file.path);
+      return old?.hash === file.hash ? old : entryForSource(file, readmeHints);
+    });
+    entries.sort((a, b) => a.path.localeCompare(b.path));
+    const projection = {
+      ...existing,
+      repo: repoSlug3,
+      builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+      indexHead: head,
+      entries
+    };
+    writeRepoIndex(cwd, projection);
+    return { status: "refreshed", projection };
+  } catch (error) {
+    const reason = error instanceof RepoIndexRefreshBudgetError ? error.message : `local index refresh failed: ${error.message}`;
+    return { status: "stale", reason };
+  }
+}
 function loadRepoIndex(cwd) {
   const store = repoIndexStorePath(cwd);
   if (!(0, import_node_fs24.existsSync)(store)) return null;
@@ -25396,6 +25578,7 @@ function repoIndexStatus(cwd) {
   const idx = loadRepoIndex(cwd);
   if (!idx) return { present: false, path: path2 };
   const symbolCount = idx.entries.reduce((n, e) => n + e.symbols.length, 0);
+  const localUsage = readLocalRepoIndexQueryUsage(cwd);
   return {
     present: true,
     path: path2,
@@ -25403,7 +25586,8 @@ function repoIndexStatus(cwd) {
     repo: idx.repo,
     builtAt: idx.builtAt,
     fileCount: idx.entries.length,
-    symbolCount
+    symbolCount,
+    ...localUsage ? { localQueryCount: localUsage.count } : {}
   };
 }
 function searchRepoIndex(idx, query, limit = 20) {
@@ -26197,9 +26381,9 @@ async function probeRepoIndexV4ReadinessCloud(queries, deps) {
   if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
   const baseUrl = deps.baseUrl.replace(/\/$/, "");
   const headers = { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" "), "content-type": "application/json" };
-  const shadowPass = async (readinessProbe) => {
+  const shadowPass = async (readinessProbe, passQueries = queries) => {
     const ms = {};
-    for (const query of queries) {
+    for (const query of passQueries) {
       const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/v4/shadow`, {
         method: "POST",
         headers,
@@ -26221,6 +26405,11 @@ async function probeRepoIndexV4ReadinessCloud(queries, deps) {
     }
     const verdict = await shadowPass(true);
     if (!verdict.ok) return verdict;
+    const latencyRetries = queries.filter((query) => query.latencyMs !== void 0 && verdict.ms[query.id] !== void 0 && verdict.ms[query.id] > query.latencyMs);
+    if (latencyRetries.length) {
+      const retry = await shadowPass(true, latencyRetries);
+      if (!retry.ok) return retry;
+    }
     const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/status`, {
       method: "GET",
       headers: { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" ") }
@@ -26750,9 +26939,9 @@ function buildGraphEdges(cwd, repo, commit, rosterRepos2) {
 }
 
 // src/repo-index-sync.ts
-function execFileUtf8(file, args) {
+function execFileUtf8(file, args, env) {
   return new Promise((resolve6, reject) => {
-    (0, import_node_child_process15.execFile)(file, args, { encoding: "utf8", windowsHide: true }, (error, stdout) => {
+    (0, import_node_child_process15.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...env ? { env } : {} }, (error, stdout) => {
       if (error) reject(error);
       else resolve6(String(stdout ?? ""));
     });
@@ -26760,6 +26949,9 @@ function execFileUtf8(file, args) {
 }
 var ESTATE_CLASSIFY_CONCURRENCY = 8;
 var ESTATE_HEALTHY_CLASSIFY_BUDGET_MS = 5 * 601e3;
+function formatEstateRunFailureSummary(failed) {
+  return failed.map((f) => `${f.repo} (${f.probe?.failureClass ?? "failed"})`).join(", ");
+}
 var COMMIT3 = /^[a-f0-9]{40}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
 var UTC_MILLIS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
@@ -26795,14 +26987,57 @@ function checkoutExactCommit(repo, dest, token, commit) {
   const head = git3(["rev-parse", "HEAD"]).trim().toLowerCase();
   if (head !== commit) throw new Error(`checkout of ${repo} resolved ${head}, not the requested commit ${commit}`);
 }
+var HeadProbeError = class extends Error {
+  constructor(message, exitCode, failureClass) {
+    super(message);
+    this.exitCode = exitCode;
+    this.failureClass = failureClass;
+  }
+  exitCode;
+  failureClass;
+};
+function classifyProbeStderr(stderr) {
+  const text = stderr.toLowerCase();
+  if (/(could not read username|could not read password|authentication failed|invalid credentials|permission denied|terminal prompts disabled|returned error: 401|returned error: 403)/.test(text)) return "auth-denied";
+  if (/(repository .* not found|couldn't find remote ref|not found)/.test(text)) return "not-found";
+  if (/(timed out|timeout|operation timed out|connection timed out)/.test(text)) return "timeout";
+  if (/(could not resolve host|network is unreachable|connection (refused|reset)|temporary failure|failed to connect|could not connect)/.test(text)) return "network";
+  return "unreadable";
+}
+function headProbeEnv() {
+  const env = { ...process.env };
+  delete env.GIT_ASKPASS;
+  delete env.SSH_ASKPASS;
+  for (const key of Object.keys(env)) {
+    if (key.startsWith("GIT_CONFIG_")) delete env[key];
+  }
+  env.GIT_TERMINAL_PROMPT = "0";
+  return env;
+}
+function toHeadProbeError(error, repo) {
+  const e = error;
+  const exitCode = typeof e.code === "number" ? e.code : null;
+  const stderr = typeof e.stderr === "string" ? e.stderr : "";
+  return new HeadProbeError(
+    `remote HEAD probe of ${repo} failed (exit ${exitCode ?? "unknown"}, ${classifyProbeStderr(stderr)})`,
+    exitCode,
+    classifyProbeStderr(stderr)
+  );
+}
 async function remoteHead(repo, token) {
   const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  const stdout = await execFileUtf8(
-    "git",
-    ["-c", `http.extraHeader=Authorization: Basic ${basic}`, "ls-remote", "--exit-code", `https://github.com/${repo}.git`, "HEAD"]
-  );
+  let stdout;
+  try {
+    stdout = await execFileUtf8(
+      "git",
+      ["-c", "credential.helper=", "-c", `http.extraHeader=Authorization: Basic ${basic}`, "ls-remote", "--exit-code", `https://github.com/${repo}.git`, "HEAD"],
+      headProbeEnv()
+    );
+  } catch (error) {
+    throw toHeadProbeError(error, repo);
+  }
   const match = stdout.match(/^([a-f0-9]{40})\s+HEAD$/m);
-  if (!match) throw new Error(`could not resolve remote HEAD for ${repo}`);
+  if (!match) throw new HeadProbeError(`could not resolve remote HEAD for ${repo}`, null, "unreadable");
   return match[1];
 }
 async function mapLimit(items, limit, fn) {
@@ -26871,6 +27106,7 @@ async function syncEstateRepoIndex(opts) {
   const skipped = [];
   const drift = [];
   const needsFullRebuild = [];
+  let rosterSize = 0;
   const answer = (ok) => ({
     ok: ok ?? failed.length === 0,
     published,
@@ -26878,7 +27114,12 @@ async function syncEstateRepoIndex(opts) {
     skipped,
     provenanceToken: CURRENT_REPO_INDEX_PROVENANCE_TOKEN,
     drift,
-    needsFullRebuild
+    needsFullRebuild,
+    receipt: {
+      changed: published.length,
+      skipped: Math.max(0, rosterSize - published.length - failed.length),
+      failed: failed.length
+    }
   });
   const fullRebuildToken = (opts.fullRebuild ?? "").trim();
   const forceFull = fullRebuildToken !== "";
@@ -26918,6 +27159,7 @@ async function syncEstateRepoIndex(opts) {
   const busy = new Set(
     (opts.skipRepos ?? []).map((repo) => normalizeRepoIndexRepo(repo)).filter((repo) => repo !== null)
   );
+  rosterSize = repos.length;
   const emit = (progress) => {
     try {
       opts.onClassify?.(progress);
@@ -26950,12 +27192,12 @@ async function syncEstateRepoIndex(opts) {
     }
     let targetCommit = requestedCommit || void 0;
     if (base && !forceFull) {
-      let headUnreadable = false;
+      let headProbe = null;
       if (!targetCommit) {
         try {
           targetCommit = await remoteHead(repo, opts.githubToken);
-        } catch {
-          headUnreadable = true;
+        } catch (error) {
+          headProbe = error instanceof HeadProbeError ? error : new HeadProbeError(error.message, null, "unreadable");
         }
       }
       const provenance = await fetchRepoIndexV4ProvenanceCloud(repo, opts.deps).catch(
@@ -26979,11 +27221,10 @@ async function syncEstateRepoIndex(opts) {
         emit({ row: row2, warning });
         return { repo, row: row2, warning, base, expectedActiveDigest };
       }
-      if (headUnreadable) {
-        const row2 = { repo, reason: "head-unreadable", action: "skip", activeCommit: base.commit };
-        const warning = `${repo}: remote HEAD unreadable; leaving verified-ready authority at ${base.commit}`;
-        emit({ row: row2, warning });
-        return { repo, row: row2, warning, base, expectedActiveDigest };
+      if (headProbe) {
+        const row2 = { repo, reason: "head-unreadable", action: "failed", activeCommit: base.commit };
+        emit({ row: row2 });
+        return { repo, row: row2, headProbe, base, expectedActiveDigest };
       }
     }
     const row = {
@@ -27000,6 +27241,14 @@ async function syncEstateRepoIndex(opts) {
     drift.push(entry.row);
     if (entry.warning) skipped.push(entry.warning);
     if (entry.row.action === "needs-full-rebuild") needsFullRebuild.push(entry.repo);
+    if (entry.headProbe) {
+      const exit = entry.headProbe.exitCode === null ? "unknown" : String(entry.headProbe.exitCode);
+      failed.push({
+        repo: entry.repo,
+        error: `remote HEAD unreadable (exit ${exit}, ${entry.headProbe.failureClass}) \u2014 verified-ready authority at ${entry.row.activeCommit ?? "unknown"} was not re-probed; reconcile FAILED`,
+        probe: { exitCode: entry.headProbe.exitCode, failureClass: entry.headProbe.failureClass }
+      });
+    }
   }
   if (opts.plan) return answer();
   for (const entry of classified) {
@@ -33451,29 +33700,47 @@ ${err?.stdout ?? ""}`.split("\n").map((line) => line.trim()).find((line) => line
 var defaultGhMergeAutoIo = {
   gh: async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout
 };
-async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
+function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
+  const policy = squashBodyWithOverride(commits, cwd);
+  const base = policy ?? defaultSquashBodyFromCommits(commits);
+  if (!base) return null;
+  const rewritten = rewriteUnregisteredClosingKeywords(base, allowedClosing);
+  if (policy) return rewritten;
+  return rewritten === base ? null : rewritten;
+}
+function writeSquashBodyFile(body) {
+  const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path37.join)(dir, "body.txt");
+  (0, import_node_fs40.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+`, "utf8");
+  return { path: path2, cleanup: () => {
+    try {
+      (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
+    } catch {
+    }
+  } };
+}
+async function composeOverrideBodyFile(prNumber, repoArgs, gh, opts) {
+  if (opts?.bodyText != null && opts.bodyText !== "") {
+    return { ...writeSquashBodyFile(opts.bodyText), text: opts.bodyText };
+  }
   try {
     const raw = await gh(["pr", "view", prNumber, ...repoArgs, "--json", "commits"], GC_GH_TIMEOUT_MS);
-    const commits = JSON.parse(raw).commits ?? [];
-    const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
+    const commits = (JSON.parse(raw).commits ?? []).map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" }));
+    const body = resolveSquashMergeBodyText(commits, opts?.allowedClosing ?? [], process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path37.join)(dir, "body.txt");
-    (0, import_node_fs40.writeFileSync)(path2, `${body}
-`, "utf8");
-    return { path: path2, cleanup: () => {
-      try {
-        (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
-      } catch {
-      }
-    } };
+    return { ...writeSquashBodyFile(body), text: body };
   } catch {
     return void 0;
   }
 }
-async function ghMergeAutoEnqueue(prNumber, repo, method, io = defaultGhMergeAutoIo) {
+async function ghMergeAutoEnqueue(prNumber, repo, method, extra) {
+  const io = extra?.io ?? defaultGhMergeAutoIo;
   const args = repo ? ["--repo", repo] : [];
-  const overrideBody = await composeOverrideBodyFile(prNumber, args, io.gh);
+  const overrideBody = await composeOverrideBodyFile(prNumber, args, io.gh, {
+    allowedClosing: method === "--squash" ? extra?.allowedClosing : void 0,
+    bodyText: method === "--squash" ? extra?.bodyText : void 0
+  });
   try {
     return await mergeAutoEnqueueWithBody(prNumber, args, method, io, overrideBody?.path);
   } finally {
@@ -33831,34 +34098,60 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
       return formatGitCommandError(e);
     }
   };
-  const firstError = await attemptRemove();
-  if (!firstError) {
-    await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed" };
-  }
-  let worktrees = await listWorktrees().catch(() => []);
-  if (!isWorktreePathRegistered(worktrees, wtPath)) {
+  const pruneAndVerify = async (reason) => {
     await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed", reason: "reconciled-unregistered" };
+    let worktrees2;
+    try {
+      worktrees2 = await listWorktrees();
+    } catch (e) {
+      return {
+        status: "failed",
+        error: `could not verify worktree removal after prune: ${formatGitCommandError(e)}; path=${wtPath}`
+      };
+    }
+    if (isWorktreePathRegistered(worktrees2, wtPath)) {
+      return {
+        status: "failed",
+        error: `worktree remains registered after prune; path=${wtPath}`
+      };
+    }
+    return { status: "removed", ...reason ? { reason } : {} };
+  };
+  const firstError = await attemptRemove();
+  if (!firstError) return pruneAndVerify();
+  let worktrees;
+  try {
+    worktrees = await listWorktrees();
+  } catch (e) {
+    return {
+      status: "failed",
+      error: `could not verify worktree registration after remove failure: ${formatGitCommandError(e)}; path=${wtPath}`
+    };
   }
+  if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-unregistered");
   const retryError = await attemptRemove();
-  if (!retryError) {
-    await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed", reason: "reconciled-after-retry" };
-  }
+  if (!retryError) return pruneAndVerify("reconciled-after-retry");
   if (isNotAWorkingTreeMessage(retryError) || isNotAWorkingTreeMessage(firstError)) {
-    worktrees = await listWorktrees().catch(() => worktrees);
-    if (!isWorktreePathRegistered(worktrees, wtPath)) {
-      await git3(["worktree", "prune"]).catch(() => "");
-      return { status: "removed", reason: "reconciled-not-a-working-tree" };
+    try {
+      worktrees = await listWorktrees();
+    } catch (e) {
+      return {
+        status: "failed",
+        error: `could not verify worktree registration after remove failure: ${formatGitCommandError(e)}; path=${wtPath}`
+      };
     }
+    if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-not-a-working-tree");
   }
-  worktrees = await listWorktrees().catch(() => worktrees);
-  const registered = isWorktreePathRegistered(worktrees, wtPath);
-  if (!registered) {
-    await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed", reason: "reconciled-unregistered" };
+  try {
+    worktrees = await listWorktrees();
+  } catch (e) {
+    return {
+      status: "failed",
+      error: `could not verify worktree registration after remove failure: ${formatGitCommandError(e)}; path=${wtPath}`
+    };
   }
+  const registered = isWorktreePathRegistered(worktrees, wtPath);
+  if (!registered) return pruneAndVerify("reconciled-unregistered");
   return {
     status: "failed",
     error: formatWorktreeRemovalFailureDetail({
@@ -33869,6 +34162,9 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
     })
   };
 }
+function prMergeLocalCleanupExitCode(cleanup) {
+  return cleanup?.worktree?.status === "failed" || cleanup?.localBranch?.status === "failed" ? 1 : void 0;
+}
 async function cleanupPrMergeLocalBranch(branch, options) {
   const report = { branch };
   if (!branch) {
@@ -33975,7 +34271,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const removal = await removeWorktreeWithReconcile(
     wtPath,
     git3,
-    async () => parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"])),
+    async () => parseGitWorktreePorcelain(await git3(["worktree", "list", "--porcelain"])),
     pathExists
   );
   if (removal.status === "failed") {
@@ -41334,11 +41630,29 @@ async function runRepoIndexSearchCommand(query, o, defaultMode) {
     const useLocal = o.local === true && o.cloud !== true;
     if (useLocal) {
       const root = await repoRoot();
-      let idx = loadRepoIndex(root);
-      if (!idx) idx = rebuildRepoIndex(root, inferRepoSlug(root));
+      const refreshed = refreshRepoIndex(root, inferRepoSlug(root));
+      if (!refreshed.projection) {
+        const receipt = {
+          ok: false,
+          source: "local",
+          repo: inferRepoSlug(root),
+          query,
+          hits: [],
+          status: refreshed.status,
+          reason: refreshed.reason ?? "local index refresh failed"
+        };
+        if (o.json) consoleIo.log(JSON.stringify(receipt, null, 2));
+        else console.error(`repo-index: local index stale \u2014 ${receipt.reason}`);
+        return await cleanExit(1);
+      }
+      const idx = refreshed.projection;
       const hits = searchRepoIndex(idx, query, limit);
+      try {
+        recordLocalRepoIndexQueryUsage(root);
+      } catch {
+      }
       if (o.json) {
-        consoleIo.log(JSON.stringify({ ok: true, source: "local", repo: idx.repo, query, hits }, null, 2));
+        consoleIo.log(JSON.stringify({ ok: true, source: "local", repo: idx.repo, query, hits, status: refreshed.status }, null, 2));
         return;
       }
       if (hits.length === 0) {
@@ -41585,7 +41899,10 @@ repoIndex.command("sync-estate").description("Hub indexer: publish a pushed comm
     for (const f of res.failed) {
       console.error(`repo-index: FAILED ${f.repo}: ${f.error}`);
     }
-    if (!res.ok) await failGraceful(`sync-estate incomplete (${res.failed.length} failed)`);
+    console.log(`repo-index: estate reconcile receipt \u2014 ${res.receipt.changed} changed, ${res.receipt.skipped} skipped, ${res.receipt.failed} failed`);
+    if (!res.ok) {
+      await failGraceful(`sync-estate incomplete (${res.failed.length} failed): ${formatEstateRunFailureSummary(res.failed)}`);
+    }
   } catch (e) {
     await failGraceful(e.message);
   }
@@ -42839,6 +43156,20 @@ async function readClosingGuardInput(number, repoArgs, repo, context) {
     return input;
   }
 }
+function squashBodyTextForMerge(input, methodIsSquash, explicitBody) {
+  if (!methodIsSquash) return void 0;
+  if (explicitBody != null && explicitBody !== "") return explicitBody;
+  if (!input) return void 0;
+  return resolveSquashMergeBodyText(input.commits ?? [], input.closing, process.cwd()) ?? void 0;
+}
+function warnSquashBodyClosingStrip(context, input, squashBodyText) {
+  if (!input || squashBodyText == null) return;
+  const { open: open2 } = partitionCommitClosings(input.commitClosing ?? [], input.closing, input.alreadyClosed);
+  if (!open2.length) return;
+  console.warn(
+    `${context}: composing a squash body that leaves unregistered ${open2.map((n) => `#${n}`).join(", ")} open \u2014 GitHub's default COMMIT_MESSAGES composition would close them (#5723).`
+  );
+}
 function ciAuditDeps() {
   const cfgPromise = loadConfig();
   const root = hubRoot();
@@ -42988,7 +43319,13 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       return typeof viewed.state === "string" ? viewed.state : void 0;
     }
   );
-  const landClosingGuardVerdict = evaluateClosingGuard(landClosingGuardInput, { force: o.force, context: "pr land" });
+  const landSquashBody = squashBodyTextForMerge(landClosingGuardInput, true);
+  warnSquashBodyClosingStrip("pr land", landClosingGuardInput, landSquashBody);
+  const landClosingGuardVerdict = evaluateClosingGuard(landClosingGuardInput, {
+    force: o.force,
+    context: "pr land",
+    squashBodyText: landSquashBody
+  });
   if (landClosingGuardVerdict.blocked) {
     console.error(landClosingGuardVerdict.message);
     process.exitCode = 1;
@@ -43063,7 +43400,10 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       if (!result2.ok) throw new Error(`could not read PR state: ${result2.error}`);
       return JSON.parse(result2.state);
     },
-    mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--squash"),
+    mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--squash", {
+      allowedClosing: landClosingGuardInput?.closing,
+      bodyText: landSquashBody
+    }),
     pollMerged: async (prNumber, repo, deadlineMs) => {
       let lastFailure;
       while (Date.now() < deadlineMs) {
@@ -43124,7 +43464,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
   if (result.status === "failed") process.exitCode = 1;
 });
-jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
@@ -43147,7 +43487,20 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       return typeof viewed.state === "string" ? viewed.state : void 0;
     }
   );
-  const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, { force: o.force, context: "pr merge" });
+  if (o.squashBodyFile && method !== "--squash") {
+    throw new Error("pr merge: --squash-body-file applies only to squash merges");
+  }
+  const mergeSquashBody = squashBodyTextForMerge(
+    closingGuardInput,
+    method === "--squash",
+    o.squashBodyFile ? (0, import_node_fs48.readFileSync)(o.squashBodyFile, "utf8") : void 0
+  );
+  if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
+  const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
+    force: o.force,
+    context: "pr merge",
+    squashBodyText: mergeSquashBody
+  });
   if (closingGuardVerdict.blocked) {
     console.error(closingGuardVerdict.message);
     process.exitCode = 1;
@@ -43202,7 +43555,12 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const remoteBefore = await remoteBranchExists2(headRef);
   let upgradedToAuto = false;
   let remoteNotAttemptedReason = "host-owned-lifecycle";
-  const overrideBody = await composeOverrideBodyFile(number, repoArgs, async (a, t) => (await execFileP2("gh", a, { timeout: t })).stdout);
+  const overrideBody = mergeSquashBody ? { ...writeSquashBodyFile(mergeSquashBody), text: mergeSquashBody } : await composeOverrideBodyFile(
+    number,
+    repoArgs,
+    async (a, t) => (await execFileP2("gh", a, { timeout: t })).stdout,
+    { allowedClosing: method === "--squash" ? closingGuardInput?.closing : void 0 }
+  );
   const bodyFile = overrideBody?.path;
   try {
     await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch(async (e) => {
@@ -43387,7 +43745,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   })) {
     console.error(line);
   }
-  process.exitCode = postMergeReconExitCode({ boardAdvance, crossRepoFilingIssue }) ?? process.exitCode;
+  process.exitCode = prMergeLocalCleanupExitCode(localCleanup) ?? postMergeReconExitCode({ boardAdvance, crossRepoFilingIssue }) ?? process.exitCode;
 });
 registerQueryCommands(program2);
 registerIssueLifecycleCommands(program2, { attach: attachToProject });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.1.15",
+  "version": "4.1.17",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",