@mutmutco/cli 4.1.16 → 4.1.18

package/dist/main.cjs

@@ -13181,10 +13181,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.1.16",
-    tag: "v4.1.16",
-    commit: "3d2a1772d4b6",
-    npm: "@mutmutco/cli@4.1.16"
+    version: "4.1.18",
+    tag: "v4.1.18",
+    commit: "6a8f41433f0f",
+    npm: "@mutmutco/cli@4.1.18"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -13201,14 +13201,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.1.16"
+          v3Target: "v4.1.18"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.1.16 and redeploy the Hub Lambda from tag v4.1.16 (3d2a1772d4b6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.1.16 (@mutmutco/cli@4.1.16, tag commit 3d2a1772d4b6 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.1.18 and redeploy the Hub Lambda from tag v4.1.18 (6a8f41433f0f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.1.18 (@mutmutco/cli@4.1.18, tag commit 6a8f41433f0f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -14193,7 +14193,8 @@ async function runPrForIssue(deps, issueRef, opts) {
   return extractPrForIssueResponse(resp);
 }
 async function runIssueViewContext(deps, opts) {
-  const fields = opts.comments || opts.context ? ensureField(opts.jsonFields, "comments") : opts.jsonFields;
+  const baseFields = opts.context ? opts.jsonFields.split(",").map((field) => field.trim()).filter((field) => field !== "linkedPrs" && field !== "children").join(",") : opts.jsonFields;
+  const fields = opts.comments || opts.context ? ensureField(baseFields, "comments") : baseFields;
   const base = await deps.ghJson(["issue", "view", String(opts.number), "--repo", opts.repo, "--json", fields], GH_LIST_TIMEOUT_MS);
   if (!opts.context) return base;
   const result = { ...base };
@@ -25266,9 +25267,35 @@ function repoIndexPathTieBreak(path2) {
   if (/\.(test|spec)\.[^.]+$/i.test(p)) return 1;
   return 0;
 }
+var LOCAL_REPO_INDEX_REFRESH_BUDGET_MS = 2e3;
+var LOCAL_REPO_INDEX_DELTA_FILE_LIMIT = 50;
 function repoIndexStorePath(cwd) {
   return repoRuntimeStatePath(cwd, "repo-index", "index.json");
 }
+function localRepoIndexUsagePath(cwd) {
+  return repoRuntimeStatePath(cwd, "repo-index", "local-usage.json");
+}
+function recordLocalRepoIndexQueryUsage(cwd, now = /* @__PURE__ */ new Date()) {
+  const store = localRepoIndexUsagePath(cwd);
+  let previous = 0;
+  try {
+    const raw = JSON.parse((0, import_node_fs24.readFileSync)(store, "utf8"));
+    if (typeof raw.count === "number" && Number.isFinite(raw.count)) previous = raw.count;
+  } catch {
+  }
+  (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(store), { recursive: true });
+  (0, import_node_fs24.writeFileSync)(store, `${JSON.stringify({ count: previous + 1, updatedAt: now.toISOString() }, null, 2)}
+`, "utf8");
+}
+function readLocalRepoIndexQueryUsage(cwd) {
+  try {
+    const raw = JSON.parse((0, import_node_fs24.readFileSync)(localRepoIndexUsagePath(cwd), "utf8"));
+    if (typeof raw.count !== "number" || !Number.isFinite(raw.count)) return null;
+    return { count: raw.count, updatedAt: raw.updatedAt ?? "" };
+  } catch {
+    return null;
+  }
+}
 function isHardDeniedPath(relPosix) {
   return isHardDeniedRepoIndexPath(relPosix);
 }
@@ -25379,14 +25406,41 @@ function listCandidatePaths(cwd, exec = import_node_child_process12.execFileSync
     return [];
   }
 }
-function rebuildRepoIndex(cwd, repoSlug3) {
-  const candidates = listCandidatePaths(cwd).filter(isIndexablePath);
-  const ignored = defaultIsIgnored(cwd, candidates);
-  const readmeHints = loadReadmeHints(cwd, candidates.filter((p) => !ignored.has(p)));
-  const entries = [];
+var RepoIndexRefreshBudgetError = class extends Error {
+  constructor() {
+    super(`local index refresh exceeded ${LOCAL_REPO_INDEX_REFRESH_BUDGET_MS}ms`);
+  }
+};
+function assertRefreshBudget(deadline) {
+  if (deadline !== void 0 && Date.now() >= deadline) throw new RepoIndexRefreshBudgetError();
+}
+function deadlineExec(deadline) {
+  return ((file, args, options) => {
+    assertRefreshBudget(deadline);
+    return (0, import_node_child_process12.execFileSync)(file, args, {
+      ...options,
+      timeout: Math.max(1, deadline - Date.now()),
+      windowsHide: true
+    });
+  });
+}
+function gitHead(cwd, exec = import_node_child_process12.execFileSync) {
+  try {
+    return String(exec("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", windowsHide: true })).trim() || void 0;
+  } catch (error) {
+    if (error instanceof RepoIndexRefreshBudgetError) throw error;
+    return void 0;
+  }
+}
+function sourceFilesForIndex(cwd, deadline) {
+  const exec = deadline === void 0 ? import_node_child_process12.execFileSync : deadlineExec(deadline);
+  const candidates = listCandidatePaths(cwd, exec).filter(isIndexablePath);
+  assertRefreshBudget(deadline);
+  const ignored = defaultIsIgnored(cwd, candidates, exec);
+  const files = [];
   for (const rel of candidates) {
-    if (ignored.has(rel)) continue;
-    if (isHardDeniedPath(rel)) continue;
+    assertRefreshBudget(deadline);
+    if (ignored.has(rel) || isHardDeniedPath(rel)) continue;
     const abs = (0, import_node_path21.join)(cwd, ...rel.split("/"));
     if (!(0, import_node_fs24.existsSync)(abs)) continue;
     let text;
@@ -25396,31 +25450,118 @@ function rebuildRepoIndex(cwd, repoSlug3) {
       continue;
     }
     if (text.length > 15e5) continue;
-    const hash = (0, import_node_crypto6.createHash)("sha256").update(text).digest("hex").slice(0, 16);
-    const symbols = extractSymbols(text);
-    const docBlurb = extractModuleBlurb(text);
-    const top = rel.includes("/") ? rel.split("/")[0] : "";
-    const hint = docBlurb ?? (top ? readmeHints.get(top) : void 0) ?? readmeHints.get("");
-    entries.push({
+    files.push({
       path: rel,
-      hash,
-      symbols,
-      ...hint ? { blurb: hint.slice(0, BLURB_CAP) } : {}
+      hash: (0, import_node_crypto6.createHash)("sha256").update(text).digest("hex").slice(0, 16),
+      text
     });
   }
+  return files;
+}
+function entryForSource(file, readmeHints) {
+  const docBlurb = extractModuleBlurb(file.text);
+  const top = file.path.includes("/") ? file.path.split("/")[0] : "";
+  const hint = docBlurb ?? (top ? readmeHints.get(top) : void 0) ?? readmeHints.get("");
+  return {
+    path: file.path,
+    hash: file.hash,
+    symbols: extractSymbols(file.text),
+    ...hint ? { blurb: hint.slice(0, BLURB_CAP) } : {}
+  };
+}
+function buildRepoIndexProjection(cwd, repoSlug3, deadline) {
+  const files = sourceFilesForIndex(cwd, deadline);
+  assertRefreshBudget(deadline);
+  const readmeHints = loadReadmeHints(cwd, files.map((file) => file.path));
+  const entries = files.map((file) => {
+    assertRefreshBudget(deadline);
+    return entryForSource(file, readmeHints);
+  });
   entries.sort((a, b) => a.path.localeCompare(b.path));
-  const projection = {
+  const exec = deadline === void 0 ? import_node_child_process12.execFileSync : deadlineExec(deadline);
+  const indexHead = gitHead(cwd, exec);
+  return {
     schema: REPO_INDEX_SCHEMA,
     repo: repoSlug3,
     builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...indexHead ? { indexHead } : {},
     entries
   };
+}
+function writeRepoIndex(cwd, projection) {
   const store = repoIndexStorePath(cwd);
   (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(store), { recursive: true });
   (0, import_node_fs24.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
 `, "utf8");
+}
+function rebuildRepoIndex(cwd, repoSlug3) {
+  const projection = buildRepoIndexProjection(cwd, repoSlug3);
+  writeRepoIndex(cwd, projection);
   return projection;
 }
+function refreshRepoIndex(cwd, repoSlug3, options = {}) {
+  const budgetMs = options.budgetMs ?? LOCAL_REPO_INDEX_REFRESH_BUDGET_MS;
+  const deadline = Date.now() + Math.max(0, budgetMs);
+  try {
+    const exec = deadlineExec(deadline);
+    const existing = loadRepoIndex(cwd);
+    if (!existing) {
+      const projection2 = buildRepoIndexProjection(cwd, repoSlug3, deadline);
+      writeRepoIndex(cwd, projection2);
+      return { status: "rebuilt", projection: projection2 };
+    }
+    const head = gitHead(cwd, exec);
+    if (!head) return { status: "stale", reason: "checkout HEAD is unavailable" };
+    const worktreeDirty = String(exec("git", ["status", "--porcelain", "--untracked-files=normal"], {
+      cwd,
+      encoding: "utf8",
+      windowsHide: true
+    })).length > 0;
+    if (existing.indexHead === head && !worktreeDirty) return { status: "refreshed", projection: existing };
+    if (!existing.indexHead) {
+      const projection2 = buildRepoIndexProjection(cwd, repoSlug3, deadline);
+      writeRepoIndex(cwd, projection2);
+      return { status: "rebuilt", projection: projection2 };
+    }
+    const files = sourceFilesForIndex(cwd, deadline);
+    const current = new Map(files.map((file) => [file.path, file]));
+    const previous = new Map(existing.entries.map((entry) => [entry.path, entry]));
+    const changed = /* @__PURE__ */ new Set();
+    for (const [path2, file] of current) {
+      if (previous.get(path2)?.hash !== file.hash) changed.add(path2);
+    }
+    for (const path2 of previous.keys()) {
+      if (!current.has(path2)) changed.add(path2);
+    }
+    const readmeChanged = [...changed].some((path2) => path2 === "README.md" || /^[^/]+\/README\.md$/.test(path2));
+    if (changed.size > LOCAL_REPO_INDEX_DELTA_FILE_LIMIT || readmeChanged) {
+      const projection2 = buildRepoIndexProjection(cwd, repoSlug3, deadline);
+      writeRepoIndex(cwd, projection2);
+      return { status: "rebuilt", projection: projection2 };
+    }
+    const changedSources = [...changed].map((path2) => current.get(path2)).filter((file) => file !== void 0);
+    const needsHint = changedSources.some((file) => !extractModuleBlurb(file.text));
+    const readmeHints = needsHint ? loadReadmeHints(cwd, files.map((file) => file.path)) : /* @__PURE__ */ new Map();
+    const entries = files.map((file) => {
+      assertRefreshBudget(deadline);
+      const old = previous.get(file.path);
+      return old?.hash === file.hash ? old : entryForSource(file, readmeHints);
+    });
+    entries.sort((a, b) => a.path.localeCompare(b.path));
+    const projection = {
+      ...existing,
+      repo: repoSlug3,
+      builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+      indexHead: head,
+      entries
+    };
+    writeRepoIndex(cwd, projection);
+    return { status: "refreshed", projection };
+  } catch (error) {
+    const reason = error instanceof RepoIndexRefreshBudgetError ? error.message : `local index refresh failed: ${error.message}`;
+    return { status: "stale", reason };
+  }
+}
 function loadRepoIndex(cwd) {
   const store = repoIndexStorePath(cwd);
   if (!(0, import_node_fs24.existsSync)(store)) return null;
@@ -25437,6 +25578,7 @@ function repoIndexStatus(cwd) {
   const idx = loadRepoIndex(cwd);
   if (!idx) return { present: false, path: path2 };
   const symbolCount = idx.entries.reduce((n, e) => n + e.symbols.length, 0);
+  const localUsage = readLocalRepoIndexQueryUsage(cwd);
   return {
     present: true,
     path: path2,
@@ -25444,7 +25586,8 @@ function repoIndexStatus(cwd) {
     repo: idx.repo,
     builtAt: idx.builtAt,
     fileCount: idx.entries.length,
-    symbolCount
+    symbolCount,
+    ...localUsage ? { localQueryCount: localUsage.count } : {}
   };
 }
 function searchRepoIndex(idx, query, limit = 20) {
@@ -26238,9 +26381,9 @@ async function probeRepoIndexV4ReadinessCloud(queries, deps) {
   if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
   const baseUrl = deps.baseUrl.replace(/\/$/, "");
   const headers = { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" "), "content-type": "application/json" };
-  const shadowPass = async (readinessProbe) => {
+  const shadowPass = async (readinessProbe, passQueries = queries) => {
     const ms = {};
-    for (const query of queries) {
+    for (const query of passQueries) {
       const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/v4/shadow`, {
         method: "POST",
         headers,
@@ -26262,6 +26405,11 @@ async function probeRepoIndexV4ReadinessCloud(queries, deps) {
     }
     const verdict = await shadowPass(true);
     if (!verdict.ok) return verdict;
+    const latencyRetries = queries.filter((query) => query.latencyMs !== void 0 && verdict.ms[query.id] !== void 0 && verdict.ms[query.id] > query.latencyMs);
+    if (latencyRetries.length) {
+      const retry = await shadowPass(true, latencyRetries);
+      if (!retry.ok) return retry;
+    }
     const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/status`, {
       method: "GET",
       headers: { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" ") }
@@ -26791,9 +26939,9 @@ function buildGraphEdges(cwd, repo, commit, rosterRepos2) {
 }
 
 // src/repo-index-sync.ts
-function execFileUtf8(file, args) {
+function execFileUtf8(file, args, env, cwd) {
   return new Promise((resolve6, reject) => {
-    (0, import_node_child_process15.execFile)(file, args, { encoding: "utf8", windowsHide: true }, (error, stdout) => {
+    (0, import_node_child_process15.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...env ? { env } : {}, ...cwd ? { cwd } : {} }, (error, stdout) => {
       if (error) reject(error);
       else resolve6(String(stdout ?? ""));
     });
@@ -26801,6 +26949,9 @@ function execFileUtf8(file, args) {
 }
 var ESTATE_CLASSIFY_CONCURRENCY = 8;
 var ESTATE_HEALTHY_CLASSIFY_BUDGET_MS = 5 * 601e3;
+function formatEstateRunFailureSummary(failed) {
+  return failed.map((f) => `${f.repo} (${f.probe?.failureClass ?? "failed"})`).join(", ");
+}
 var COMMIT3 = /^[a-f0-9]{40}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
 var UTC_MILLIS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
@@ -26836,14 +26987,75 @@ function checkoutExactCommit(repo, dest, token, commit) {
   const head = git3(["rev-parse", "HEAD"]).trim().toLowerCase();
   if (head !== commit) throw new Error(`checkout of ${repo} resolved ${head}, not the requested commit ${commit}`);
 }
+var HeadProbeError = class extends Error {
+  constructor(message, exitCode, failureClass) {
+    super(message);
+    this.exitCode = exitCode;
+    this.failureClass = failureClass;
+  }
+  exitCode;
+  failureClass;
+};
+function classifyProbeStderr(stderr) {
+  const text = stderr.toLowerCase();
+  if (/(could not read username|could not read password|authentication failed|invalid credentials|permission denied|terminal prompts disabled|returned error: 401|returned error: 403)/.test(text)) return "auth-denied";
+  if (/(repository .* not found|couldn't find remote ref|not found)/.test(text)) return "not-found";
+  if (/(timed out|timeout|operation timed out|connection timed out)/.test(text)) return "timeout";
+  if (/(could not resolve host|network is unreachable|connection (refused|reset)|temporary failure|failed to connect|could not connect)/.test(text)) return "network";
+  return "unreadable";
+}
+function headProbeEnv() {
+  const env = { ...process.env };
+  delete env.GIT_ASKPASS;
+  delete env.SSH_ASKPASS;
+  for (const key of Object.keys(env)) {
+    if (key.startsWith("GIT_CONFIG_")) delete env[key];
+  }
+  env.GIT_TERMINAL_PROMPT = "0";
+  return env;
+}
+function toHeadProbeError(error, repo) {
+  const e = error;
+  const exitCode = typeof e.code === "number" ? e.code : null;
+  const stderr = typeof e.stderr === "string" ? e.stderr : "";
+  return new HeadProbeError(
+    `remote HEAD probe of ${repo} failed (exit ${exitCode ?? "unknown"}, ${classifyProbeStderr(stderr)})`,
+    exitCode,
+    classifyProbeStderr(stderr)
+  );
+}
 async function remoteHead(repo, token) {
   const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  const stdout = await execFileUtf8(
-    "git",
-    ["-c", `http.extraHeader=Authorization: Basic ${basic}`, "ls-remote", "--exit-code", `https://github.com/${repo}.git`, "HEAD"]
-  );
+  let stdout;
+  try {
+    stdout = await execFileUtf8(
+      "git",
+      [
+        "-c",
+        "credential.helper=",
+        // #5750: actions/checkout persists its token as a URL-scoped extraheader in the checked-out
+        // repo's .git/config — repo-local config that env sanitization cannot reach. Run from a
+        // neutral cwd so no repo config applies, and blank both extraheader scopes so the ONLY
+        // credential is the app token below. Credential values are never copied or logged.
+        "-c",
+        "http.extraheader=",
+        "-c",
+        "http.https://github.com/.extraheader=",
+        "-c",
+        `http.extraHeader=Authorization: Basic ${basic}`,
+        "ls-remote",
+        "--exit-code",
+        `https://github.com/${repo}.git`,
+        "HEAD"
+      ],
+      headProbeEnv(),
+      (0, import_node_os14.tmpdir)()
+    );
+  } catch (error) {
+    throw toHeadProbeError(error, repo);
+  }
   const match = stdout.match(/^([a-f0-9]{40})\s+HEAD$/m);
-  if (!match) throw new Error(`could not resolve remote HEAD for ${repo}`);
+  if (!match) throw new HeadProbeError(`could not resolve remote HEAD for ${repo}`, null, "unreadable");
   return match[1];
 }
 async function mapLimit(items, limit, fn) {
@@ -26912,6 +27124,7 @@ async function syncEstateRepoIndex(opts) {
   const skipped = [];
   const drift = [];
   const needsFullRebuild = [];
+  let rosterSize = 0;
   const answer = (ok) => ({
     ok: ok ?? failed.length === 0,
     published,
@@ -26919,7 +27132,12 @@ async function syncEstateRepoIndex(opts) {
     skipped,
     provenanceToken: CURRENT_REPO_INDEX_PROVENANCE_TOKEN,
     drift,
-    needsFullRebuild
+    needsFullRebuild,
+    receipt: {
+      changed: published.length,
+      skipped: Math.max(0, rosterSize - published.length - failed.length),
+      failed: failed.length
+    }
   });
   const fullRebuildToken = (opts.fullRebuild ?? "").trim();
   const forceFull = fullRebuildToken !== "";
@@ -26959,6 +27177,7 @@ async function syncEstateRepoIndex(opts) {
   const busy = new Set(
     (opts.skipRepos ?? []).map((repo) => normalizeRepoIndexRepo(repo)).filter((repo) => repo !== null)
   );
+  rosterSize = repos.length;
   const emit = (progress) => {
     try {
       opts.onClassify?.(progress);
@@ -26991,12 +27210,12 @@ async function syncEstateRepoIndex(opts) {
     }
     let targetCommit = requestedCommit || void 0;
     if (base && !forceFull) {
-      let headUnreadable = false;
+      let headProbe = null;
       if (!targetCommit) {
         try {
           targetCommit = await remoteHead(repo, opts.githubToken);
-        } catch {
-          headUnreadable = true;
+        } catch (error) {
+          headProbe = error instanceof HeadProbeError ? error : new HeadProbeError(error.message, null, "unreadable");
         }
       }
       const provenance = await fetchRepoIndexV4ProvenanceCloud(repo, opts.deps).catch(
@@ -27020,11 +27239,10 @@ async function syncEstateRepoIndex(opts) {
         emit({ row: row2, warning });
         return { repo, row: row2, warning, base, expectedActiveDigest };
       }
-      if (headUnreadable) {
-        const row2 = { repo, reason: "head-unreadable", action: "skip", activeCommit: base.commit };
-        const warning = `${repo}: remote HEAD unreadable; leaving verified-ready authority at ${base.commit}`;
-        emit({ row: row2, warning });
-        return { repo, row: row2, warning, base, expectedActiveDigest };
+      if (headProbe) {
+        const row2 = { repo, reason: "head-unreadable", action: "failed", activeCommit: base.commit };
+        emit({ row: row2 });
+        return { repo, row: row2, headProbe, base, expectedActiveDigest };
       }
     }
     const row = {
@@ -27041,6 +27259,14 @@ async function syncEstateRepoIndex(opts) {
     drift.push(entry.row);
     if (entry.warning) skipped.push(entry.warning);
     if (entry.row.action === "needs-full-rebuild") needsFullRebuild.push(entry.repo);
+    if (entry.headProbe) {
+      const exit = entry.headProbe.exitCode === null ? "unknown" : String(entry.headProbe.exitCode);
+      failed.push({
+        repo: entry.repo,
+        error: `remote HEAD unreadable (exit ${exit}, ${entry.headProbe.failureClass}) \u2014 verified-ready authority at ${entry.row.activeCommit ?? "unknown"} was not re-probed; reconcile FAILED`,
+        probe: { exitCode: entry.headProbe.exitCode, failureClass: entry.headProbe.failureClass }
+      });
+    }
   }
   if (opts.plan) return answer();
   for (const entry of classified) {
@@ -33890,34 +34116,60 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
       return formatGitCommandError(e);
     }
   };
-  const firstError = await attemptRemove();
-  if (!firstError) {
-    await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed" };
-  }
-  let worktrees = await listWorktrees().catch(() => []);
-  if (!isWorktreePathRegistered(worktrees, wtPath)) {
+  const pruneAndVerify = async (reason) => {
     await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed", reason: "reconciled-unregistered" };
+    let worktrees2;
+    try {
+      worktrees2 = await listWorktrees();
+    } catch (e) {
+      return {
+        status: "failed",
+        error: `could not verify worktree removal after prune: ${formatGitCommandError(e)}; path=${wtPath}`
+      };
+    }
+    if (isWorktreePathRegistered(worktrees2, wtPath)) {
+      return {
+        status: "failed",
+        error: `worktree remains registered after prune; path=${wtPath}`
+      };
+    }
+    return { status: "removed", ...reason ? { reason } : {} };
+  };
+  const firstError = await attemptRemove();
+  if (!firstError) return pruneAndVerify();
+  let worktrees;
+  try {
+    worktrees = await listWorktrees();
+  } catch (e) {
+    return {
+      status: "failed",
+      error: `could not verify worktree registration after remove failure: ${formatGitCommandError(e)}; path=${wtPath}`
+    };
   }
+  if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-unregistered");
   const retryError = await attemptRemove();
-  if (!retryError) {
-    await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed", reason: "reconciled-after-retry" };
-  }
+  if (!retryError) return pruneAndVerify("reconciled-after-retry");
   if (isNotAWorkingTreeMessage(retryError) || isNotAWorkingTreeMessage(firstError)) {
-    worktrees = await listWorktrees().catch(() => worktrees);
-    if (!isWorktreePathRegistered(worktrees, wtPath)) {
-      await git3(["worktree", "prune"]).catch(() => "");
-      return { status: "removed", reason: "reconciled-not-a-working-tree" };
+    try {
+      worktrees = await listWorktrees();
+    } catch (e) {
+      return {
+        status: "failed",
+        error: `could not verify worktree registration after remove failure: ${formatGitCommandError(e)}; path=${wtPath}`
+      };
     }
+    if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-not-a-working-tree");
   }
-  worktrees = await listWorktrees().catch(() => worktrees);
-  const registered = isWorktreePathRegistered(worktrees, wtPath);
-  if (!registered) {
-    await git3(["worktree", "prune"]).catch(() => "");
-    return { status: "removed", reason: "reconciled-unregistered" };
+  try {
+    worktrees = await listWorktrees();
+  } catch (e) {
+    return {
+      status: "failed",
+      error: `could not verify worktree registration after remove failure: ${formatGitCommandError(e)}; path=${wtPath}`
+    };
   }
+  const registered = isWorktreePathRegistered(worktrees, wtPath);
+  if (!registered) return pruneAndVerify("reconciled-unregistered");
   return {
     status: "failed",
     error: formatWorktreeRemovalFailureDetail({
@@ -33928,6 +34180,9 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
     })
   };
 }
+function prMergeLocalCleanupExitCode(cleanup) {
+  return cleanup?.worktree?.status === "failed" || cleanup?.localBranch?.status === "failed" ? 1 : void 0;
+}
 async function cleanupPrMergeLocalBranch(branch, options) {
   const report = { branch };
   if (!branch) {
@@ -34034,7 +34289,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const removal = await removeWorktreeWithReconcile(
     wtPath,
     git3,
-    async () => parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"])),
+    async () => parseGitWorktreePorcelain(await git3(["worktree", "list", "--porcelain"])),
     pathExists
   );
   if (removal.status === "failed") {
@@ -41393,11 +41648,29 @@ async function runRepoIndexSearchCommand(query, o, defaultMode) {
     const useLocal = o.local === true && o.cloud !== true;
     if (useLocal) {
       const root = await repoRoot();
-      let idx = loadRepoIndex(root);
-      if (!idx) idx = rebuildRepoIndex(root, inferRepoSlug(root));
+      const refreshed = refreshRepoIndex(root, inferRepoSlug(root));
+      if (!refreshed.projection) {
+        const receipt = {
+          ok: false,
+          source: "local",
+          repo: inferRepoSlug(root),
+          query,
+          hits: [],
+          status: refreshed.status,
+          reason: refreshed.reason ?? "local index refresh failed"
+        };
+        if (o.json) consoleIo.log(JSON.stringify(receipt, null, 2));
+        else console.error(`repo-index: local index stale \u2014 ${receipt.reason}`);
+        return await cleanExit(1);
+      }
+      const idx = refreshed.projection;
       const hits = searchRepoIndex(idx, query, limit);
+      try {
+        recordLocalRepoIndexQueryUsage(root);
+      } catch {
+      }
       if (o.json) {
-        consoleIo.log(JSON.stringify({ ok: true, source: "local", repo: idx.repo, query, hits }, null, 2));
+        consoleIo.log(JSON.stringify({ ok: true, source: "local", repo: idx.repo, query, hits, status: refreshed.status }, null, 2));
         return;
       }
       if (hits.length === 0) {
@@ -41644,7 +41917,10 @@ repoIndex.command("sync-estate").description("Hub indexer: publish a pushed comm
     for (const f of res.failed) {
       console.error(`repo-index: FAILED ${f.repo}: ${f.error}`);
     }
-    if (!res.ok) await failGraceful(`sync-estate incomplete (${res.failed.length} failed)`);
+    console.log(`repo-index: estate reconcile receipt \u2014 ${res.receipt.changed} changed, ${res.receipt.skipped} skipped, ${res.receipt.failed} failed`);
+    if (!res.ok) {
+      await failGraceful(`sync-estate incomplete (${res.failed.length} failed): ${formatEstateRunFailureSummary(res.failed)}`);
+    }
   } catch (e) {
     await failGraceful(e.message);
   }
@@ -43487,7 +43763,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   })) {
     console.error(line);
   }
-  process.exitCode = postMergeReconExitCode({ boardAdvance, crossRepoFilingIssue }) ?? process.exitCode;
+  process.exitCode = prMergeLocalCleanupExitCode(localCleanup) ?? postMergeReconExitCode({ boardAdvance, crossRepoFilingIssue }) ?? process.exitCode;
 });
 registerQueryCommands(program2);
 registerIssueLifecycleCommands(program2, { attach: attachToProject });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.1.16",
+  "version": "4.1.18",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",