@mutmutco/cli 4.2.0 → 4.2.1

package/dist/main.cjs

@@ -3415,8 +3415,8 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs42 = require("node:fs");
-var import_node_child_process18 = require("node:child_process");
+var import_node_fs43 = require("node:fs");
+var import_node_child_process19 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -5538,7 +5538,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path39 = require("node:path");
+var import_node_path40 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -11762,10 +11762,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.2.0",
-    tag: "v4.2.0",
-    commit: "d4802646ffca",
-    npm: "@mutmutco/cli@4.2.0"
+    version: "4.2.1",
+    tag: "v4.2.1",
+    commit: "66e67b6905a1",
+    npm: "@mutmutco/cli@4.2.1"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -11782,14 +11782,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.2.0"
+          v3Target: "v4.2.1"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.2.0 and redeploy the Hub Lambda from tag v4.2.0 (d4802646ffca); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.2.0 (@mutmutco/cli@4.2.0, tag commit d4802646ffca \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.2.1 and redeploy the Hub Lambda from tag v4.2.1 (66e67b6905a1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.2.1 (@mutmutco/cli@4.2.1, tag commit 66e67b6905a1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -14739,10 +14739,16 @@ async function correlateWorkflowRun(deps, args) {
 async function watchTenantRun(deps, runId, repo = HUB_REPO3) {
   if (runId == null) return "pending";
   let watchSaidSuccess = true;
+  const startedAt = Date.now();
+  deps.warn?.(`watching workflow run ${runId} (${repo})`);
+  const heartbeat = deps.warn ? setInterval(() => deps.warn?.(`workflow run ${runId} (${repo}) still running \u2014 ${Math.floor((Date.now() - startedAt) / 6e4)}m elapsed`), 6e4) : void 0;
+  heartbeat?.unref();
   try {
     await deps.run("gh", ["run", "watch", String(runId), "--repo", repo, "--exit-status"]);
   } catch {
     watchSaidSuccess = false;
+  } finally {
+    if (heartbeat) clearInterval(heartbeat);
   }
   const sleep2 = resolveSleep(deps);
   let confirmError;
@@ -16338,8 +16344,9 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     }
   };
   const run = await readRun();
-  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || run.conclusion !== "failure") {
-    throw new Error(`run ${runId} is not a completed failed Hub publish release run; nothing was written`);
+  const retryableConclusion = run.conclusion === "failure" || run.conclusion === "cancelled";
+  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || !retryableConclusion) {
+    throw new Error(`run ${runId} is not a completed failed or cancelled Hub publish release run; nothing was written`);
   }
   const tag = run.headBranch ?? "";
   const tagSha = run.headSha ?? "";
@@ -16350,13 +16357,16 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     throw new Error(`run ${runId} does not match origin ${tag}; nothing was written`);
   }
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
-  await deps.run("gh", ["run", "rerun", String(runId), "--repo", ctx.repo, "--failed"]);
-  if (options.watch) {
-    await deps.run("gh", ["run", "watch", String(runId), "--repo", ctx.repo, "--exit-status"]);
-    const completed = await readRun();
-    if (completed.status !== "completed" || completed.conclusion !== "success") {
-      throw new Error(`publish run ${runId} did not finish successfully after retry`);
-    }
+  await deps.run("gh", [
+    "run",
+    "rerun",
+    String(runId),
+    "--repo",
+    ctx.repo,
+    ...run.conclusion === "failure" ? ["--failed"] : []
+  ]);
+  if (options.watch && await watchTenantRun(deps, runId, ctx.repo) !== "success") {
+    throw new Error(`publish run ${runId} did not finish successfully after retry`);
   }
   return {
     command: "release-retry-publish",
@@ -16366,7 +16376,7 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     runId,
     runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
     status: options.watch ? "success" : "pending",
-    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} failed jobs queued for retry`
+    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} queued for retry`
   };
 }
 async function runTrainApplyPipeline(mode, input) {
@@ -17707,6 +17717,12 @@ async function finalizeCiReconcile(repo, deps, result, before, pendingReason) {
     return result;
   }
 }
+function ciReconcileExitFailed(input) {
+  if (!input.apply || input.applyResults.length === 0) {
+    return !input.audit.ok || input.applyResults.some((result) => result.errors.length > 0 || result.postApply?.state === "failed");
+  }
+  return input.applyResults.some((result) => result.errors.length > 0 || result.postApply == null || result.postApply.state !== "clean" && result.postApply.state !== "repaired");
+}
 async function authoritativeSafetyHold(authority, deps, repo, baseBranch) {
   if (authority.coversReleaseBranches) {
     const prOnly = authority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context));
@@ -20933,11 +20949,11 @@ function findBoardItem(items, selector, board) {
 }
 async function resolveCurrentRepo(options, deps) {
   if (options.repo) return options.repo;
-  const git2 = deps.git ?? defaultGit;
+  const git3 = deps.git ?? defaultGit;
   let gitFailure;
   let originUrl = "";
   try {
-    originUrl = await git2(["remote", "get-url", "origin"]);
+    originUrl = await git3(["remote", "get-url", "origin"]);
   } catch (e) {
     const read = gitReadState(e);
     if (read.state === "failed") gitFailure = read.detail;
@@ -23804,31 +23820,31 @@ var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
-    const out = git2(["rev-list", "--no-merges", range]).trim();
+    const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
   };
   const isAncestor = (sha, ref) => {
     try {
-      git2(["merge-base", "--is-ancestor", sha, ref]);
+      git3(["merge-base", "--is-ancestor", sha, ref]);
       return true;
     } catch {
       return false;
     }
   };
   const patchId = (sha) => {
-    const diff = git2(["show", "--no-color", "--pretty=format:", sha]);
+    const diff = git3(["show", "--no-color", "--pretty=format:", sha]);
     if (!diff.trim()) return null;
-    const out = git2(["patch-id", "--stable"], { input: diff }).trim();
+    const out = git3(["patch-id", "--stable"], { input: diff }).trim();
     return out ? out.split(" ")[0] : null;
   };
   const changedPaths = (sha) => {
-    const out = git2(["show", "--no-color", "--name-only", "--pretty=format:", sha]).trim();
+    const out = git3(["show", "--no-color", "--name-only", "--pretty=format:", sha]).trim();
     return out ? out.split("\n") : [];
   };
   const cherrySources = (sha) => {
-    const message = git2(["log", "-1", "--format=%B", sha]);
+    const message = git3(["log", "-1", "--format=%B", sha]);
     return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
   };
   const mainOnly = revList(`${rcRef}..${mainRef}`);
@@ -23843,7 +23859,7 @@ function checkHotfixCoverage(options = {}) {
     }
   };
   const commits = mainOnly.map((sha) => {
-    const subject = git2(["log", "-1", "--format=%s", sha]).trim();
+    const subject = git3(["log", "-1", "--format=%s", sha]).trim();
     const paths = changedPaths(sha);
     if (paths.length > 0 && paths.every((p) => manifestPaths.includes(p))) {
       return { sha, subject, coverage: "exempt-distribution" };
@@ -23872,21 +23888,21 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const isAncestor = (sha, ref) => {
     try {
-      git2(["merge-base", "--is-ancestor", sha, ref]);
+      git3(["merge-base", "--is-ancestor", sha, ref]);
       return true;
     } catch {
       return false;
     }
   };
   const revList = (range) => {
-    const out = git2(["rev-list", "--no-merges", range]).trim();
+    const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
   };
   const cherrySources = (sha) => {
-    const message = git2(["log", "-1", "--format=%B", sha]);
+    const message = git3(["log", "-1", "--format=%B", sha]);
     return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
   };
   const carried = /* @__PURE__ */ new Set();
@@ -25074,12 +25090,25 @@ function runSpawnPolicy(root) {
 }
 
 // src/test-policy-core.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
 var import_node_path22 = require("node:path");
 
 // ../scripts/test-command-policy-core.mjs
+var import_node_child_process14 = require("node:child_process");
 var TEST_COMMAND_CLASS = "test";
+var TRAILER_KEY = "Test-Policy-Override";
+var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
+var REC = "";
+var FLD = "";
+var WAIVABLE_KINDS = [
+  "mandatory-zone-untested",
+  "unrequested-test-file",
+  "protected-removed",
+  "stale-protected-entry",
+  "stale-satisfied-by"
+];
+var TEST_WORK_KIND = "unrequested-test-file";
 function translateGlob(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i += 1) {
@@ -25122,7 +25151,7 @@ function matchedMandatoryGlobs(paths, mandatory) {
     return list.some((path2) => re.test(path2));
   });
 }
-function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {}) {
+function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null } = {}) {
   const configuredMandatoryCount = mandatoryGlobList(mandatory).length;
   if (!regulated) {
     return {
@@ -25135,7 +25164,8 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {})
     };
   }
   const matched = matchedMandatoryGlobs(paths, mandatory);
-  const testCommandsAllowed = matched.length > 0;
+  const overrideAuthorizes = Array.isArray(override?.kinds) && override.kinds.includes(TEST_WORK_KIND);
+  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes;
   return {
     configuredMandatoryCount,
     matchedMandatoryGlobs: matched,
@@ -25148,22 +25178,78 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {})
     }
   };
 }
+function git(args, cwd) {
+  return (0, import_node_child_process14.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function parseScope(value) {
+  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
+  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
+  const named = scoped[1].split(",").map((k) => k.trim()).filter(Boolean);
+  return {
+    kinds: named,
+    reason: scoped[2].trim(),
+    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k))
+  };
+}
+function invisibleTrailer(sha, line) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
+    ${line}
+  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
+  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
+  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
+  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
+  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
+  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.
+  This is fixable forward: push a LATER commit on this branch carrying a well-formed trailer.
+  The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.`
+  };
+}
+function unknownScope(sha, unknown) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `UNKNOWN OVERRIDE SCOPE \u2014 commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(", ")}, which this
+  gate cannot report.
+  Waivable kinds: ${WAIVABLE_KINDS.join(", ")}.
+  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns
+  into a blanket exemption without anyone deciding it should.`
+  };
+}
+function isShallowRepository(cwd) {
+  try {
+    return git(["rev-parse", "--is-shallow-repository"], cwd).trim() !== "false";
+  } catch {
+    return true;
+  }
+}
+function readOverride(base, cwd) {
+  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
+  const refusals = [];
+  let override = null;
+  for (const record of git(["log", `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
+    const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
+    if (!sha) continue;
+    if (override) break;
+    const value = (trailer ?? "").trim();
+    if (!value) {
+      const shaped = OVERRIDE_RE.exec(body ?? "");
+      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
+      continue;
+    }
+    const { kinds, reason, unknown } = parseScope(value);
+    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
+    else override = { sha, reason, kinds };
+  }
+  return { override, refusals };
+}
 
 // src/test-policy-core.ts
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
-var TRAILER_KEY = "Test-Policy-Override";
-var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
-var REC = "";
-var FLD = "";
-var WAIVABLE_KINDS = [
-  "mandatory-zone-untested",
-  "unrequested-test-file",
-  "protected-removed",
-  "stale-protected-entry",
-  "stale-satisfied-by"
-];
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -25521,15 +25607,15 @@ function evaluate(changed, policy, present = () => false) {
   }
   return findings;
 }
-function git(args, cwd) {
-  return (0, import_node_child_process14.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+function git2(args, cwd) {
+  return (0, import_node_child_process15.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message, cwd) {
   try {
-    return (0, import_node_child_process14.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process15.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
       windowsHide: true,
       cwd,
       input: message,
@@ -25566,19 +25652,12 @@ function resolveBase(cwd, explicit) {
   const candidates = [explicit, process.env.TEST_POLICY_BASE, "origin/development", "origin/main"].filter(Boolean);
   for (const ref of candidates) {
     try {
-      return git(["merge-base", "HEAD", ref], cwd).trim();
+      return git2(["merge-base", "HEAD", ref], cwd).trim();
     } catch {
     }
   }
   return null;
 }
-function isShallowRepository(cwd) {
-  try {
-    return git(["rev-parse", "--is-shallow-repository"], cwd).trim() !== "false";
-  } catch {
-    return true;
-  }
-}
 function untrustworthyRange(cwd, base) {
   if (!base) {
     return {
@@ -25600,65 +25679,11 @@ function untrustworthyRange(cwd, base) {
   Fetch full history \u2014 actions/checkout with \`fetch-depth: 0\`, or \`git fetch --unshallow\`.`
   };
 }
-function parseScope(value) {
-  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
-  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
-  const named = scoped[1].split(",").map((k) => k.trim()).filter(Boolean);
-  return {
-    kinds: named,
-    reason: scoped[2].trim(),
-    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k))
-  };
-}
-function invisibleTrailer(sha, line) {
-  return {
-    kind: "malformed-override-trailer",
-    paths: [],
-    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
-    ${line}
-  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
-  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
-  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
-  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
-  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
-  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.
-  This is fixable forward: push a LATER commit on this branch carrying a well-formed trailer.
-  The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.`
-  };
-}
-function unknownScope(sha, unknown) {
-  return {
-    kind: "malformed-override-trailer",
-    paths: [],
-    detail: `UNKNOWN OVERRIDE SCOPE \u2014 commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(", ")}, which this
-  gate cannot report.
-  Waivable kinds: ${WAIVABLE_KINDS.join(", ")}.
-  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns
-  into a blanket exemption without anyone deciding it should.`
-  };
-}
-function readOverride(base, cwd) {
-  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
-  const refusals = [];
-  let override = null;
-  for (const record of git(["log", `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
-    const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
-    if (!sha) continue;
-    if (override) break;
-    const value = (trailer ?? "").trim();
-    if (!value) {
-      const shaped = OVERRIDE_RE.exec(body ?? "");
-      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
-      continue;
-    }
-    const { kinds, reason, unknown } = parseScope(value);
-    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
-    else override = { sha, reason, kinds };
-  }
-  return { override, refusals };
+function readOverride2(base, cwd) {
+  return readOverride(base, cwd);
 }
 function changedFilesSince(base, cwd) {
-  const raw = git(["diff", "--name-status", "-M", base, "--"], cwd).trim();
+  const raw = git2(["diff", "--name-status", "-M", base, "--"], cwd).trim();
   const changed = raw ? raw.split("\n").map((line) => {
     const parts = line.split("	");
     const norm = (p) => p.replace(/\\/g, "/");
@@ -25666,12 +25691,12 @@ function changedFilesSince(base, cwd) {
     if (parts.length > 2) row.from = norm(parts[1]);
     return row;
   }) : [];
-  const untracked = git(["ls-files", "--others", "--exclude-standard", "-z"], cwd).split("\0").filter(Boolean).map((path2) => ({ status: "A", path: path2.replace(/\\/g, "/") }));
+  const untracked = git2(["ls-files", "--others", "--exclude-standard", "-z"], cwd).split("\0").filter(Boolean).map((path2) => ({ status: "A", path: path2.replace(/\\/g, "/") }));
   return [...changed, ...untracked];
 }
 function blobAt(base, path2, cwd) {
   try {
-    return git(["show", `${base}:${path2}`], cwd);
+    return git2(["show", `${base}:${path2}`], cwd);
   } catch {
     return null;
   }
@@ -25687,7 +25712,7 @@ function runTestPolicy(root, deps = {}) {
     before: blobAt(base, path2, root),
     after: readFileOrNull2((0, import_node_path22.join)(root, path2))
   }));
-  const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
+  const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root) : { override: null, refusals: [] };
   const present = (path2) => exists((0, import_node_path22.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
@@ -25720,7 +25745,8 @@ function runTestPolicy(root, deps = {}) {
   const commandPolicy = evaluateTestCommandPolicy({
     paths: changed.map((f) => f.path),
     mandatory: policy.mandatory,
-    regulated: policy.declared !== false
+    regulated: policy.declared !== false,
+    override: override && lookup.refusals.length === 0 ? { kinds: override.kinds } : null
   });
   const result = {
     ok: findings.length === 0,
@@ -25742,7 +25768,7 @@ function runTestPolicy(root, deps = {}) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_crypto7 = require("node:crypto");
 var import_node_fs27 = require("node:fs");
 var import_node_os13 = require("node:os");
@@ -25887,7 +25913,7 @@ function bomPathFor(root) {
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process15.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process16.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -27604,9 +27630,9 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_node_util7 = require("node:util");
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process16.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process17.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -30932,6 +30958,9 @@ function buildPrMergeArgs(input) {
   if (input.auto) args.push("--auto");
   return args;
 }
+function buildPrDisableAutoArgs(input) {
+  return ["pr", "merge", input.number, ...input.repoArgs, "--disable-auto"];
+}
 function basePolicyBlocksImmediateMerge(message) {
   return /base branch policy prohibits|protected branch|required status check|merge queue/i.test(message);
 }
@@ -31428,19 +31457,19 @@ function formatWorktreeRemovalFailureDetail(options) {
   const detail = options.removeError.trim() || "git worktree remove exited nonzero";
   return `${detail}; registered=${options.registered ? "yes" : "no"}; pathExists=${options.pathExists ? "yes" : "no"}; path=${options.wtPath}`;
 }
-async function resolveMergeBaseTimestampMs(git2, baseRef, branch) {
+async function resolveMergeBaseTimestampMs(git3, baseRef, branch) {
   try {
-    const mergeBase = (await git2(["merge-base", baseRef, branch])).trim();
+    const mergeBase = (await git3(["merge-base", baseRef, branch])).trim();
     if (!mergeBase) return 0;
-    const sec = parseCommitTimestampSec(await git2(["show", "-s", "--format=%ct", mergeBase]));
+    const sec = parseCommitTimestampSec(await git3(["show", "-s", "--format=%ct", mergeBase]));
     return sec ? sec * 1e3 : 0;
   } catch {
     return 0;
   }
 }
-async function verifyBranchHead(git2, branch, expectedHeadOid) {
+async function verifyBranchHead(git3, branch, expectedHeadOid) {
   if (!expectedHeadOid) return { ok: false, reason: "branch-head-unverified" };
-  const currentHead = (await git2(["rev-parse", `refs/heads/${branch}`]).catch(() => "") || "").trim();
+  const currentHead = (await git3(["rev-parse", `refs/heads/${branch}`]).catch(() => "") || "").trim();
   if (!currentHead) return { ok: false, reason: "branch-head-unverified" };
   if (currentHead !== expectedHeadOid) {
     return { ok: false, reason: "unpushed-branch", error: `${currentHead} != ${expectedHeadOid}` };
@@ -31455,17 +31484,17 @@ async function teardownWorktreeStage(worktreePath) {
     return { status: "failed", error: e instanceof Error ? e.message : String(e) };
   }
 }
-async function removeWorktreeWithReconcile(wtPath, git2, listWorktrees, pathExists) {
+async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExists) {
   const attemptRemove = async () => {
     try {
-      await git2(["worktree", "remove", "--force", wtPath]);
+      await git3(["worktree", "remove", "--force", wtPath]);
       return void 0;
     } catch (e) {
       return formatGitCommandError(e);
     }
   };
   const pruneAndVerify = async (reason) => {
-    await git2(["worktree", "prune"]).catch(() => "");
+    await git3(["worktree", "prune"]).catch(() => "");
     let worktrees2;
     try {
       worktrees2 = await listWorktrees();
@@ -31495,7 +31524,7 @@ async function removeWorktreeWithReconcile(wtPath, git2, listWorktrees, pathExis
     };
   }
   if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-unregistered");
-  await git2(["worktree", "prune"]).catch(() => "");
+  await git3(["worktree", "prune"]).catch(() => "");
   try {
     worktrees = await listWorktrees();
   } catch (e) {
@@ -31582,8 +31611,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const safeCwd = selectSafeWorktreeCwd([...afterWorktrees, ...beforeWorktrees], wtPath, { pathExists });
-  const git2 = (args) => safeCwd ? execGit(["-C", safeCwd, ...args]) : execGit(args);
-  const headCheck = await verifyBranchHead(git2, branch, options.expectedHeadOid);
+  const git3 = (args) => safeCwd ? execGit(["-C", safeCwd, ...args]) : execGit(args);
+  const headCheck = await verifyBranchHead(git3, branch, options.expectedHeadOid);
   if (!headCheck.ok) {
     report.localBranch = {
       name: branch,
@@ -31646,8 +31675,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   }
   const removal = await removeWorktreeWithReconcile(
     wtPath,
-    git2,
-    async () => parseGitWorktreePorcelain(await git2(["worktree", "list", "--porcelain"])),
+    git3,
+    async () => parseGitWorktreePorcelain(await git3(["worktree", "list", "--porcelain"])),
     pathExists
   );
   if (removal.status === "failed") {
@@ -31680,10 +31709,10 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     }
   }
   try {
-    await git2(["branch", "-D", branch]);
+    await git3(["branch", "-D", branch]);
     report.localBranch = { name: branch, status: "deleted" };
   } catch (e) {
-    const remaining = await git2(["branch", "--list", branch]).catch(() => "");
+    const remaining = await git3(["branch", "--list", branch]).catch(() => "");
     report.localBranch = remaining.trim() ? { name: branch, status: "failed", error: e instanceof Error ? e.message : String(e) } : { name: branch, status: "already-gone" };
   }
   return report;
@@ -31717,6 +31746,17 @@ function renderPrMergeCleanupLines(cleanup) {
   return lines;
 }
 
+// src/utf8-receipt.ts
+var import_node_fs37 = require("node:fs");
+var import_node_path35 = require("node:path");
+function writeUtf8Receipt(path2, text) {
+  (0, import_node_fs37.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
+  const body = text.endsWith("\n") ? text : `${text}
+`;
+  (0, import_node_fs37.writeFileSync)(path2, body, "utf8");
+  return Buffer.byteLength(body, "utf8");
+}
+
 // src/board-commands.ts
 function refuseRateLimited(e, json) {
   if (!isRateLimitedError(e)) return false;
@@ -31744,7 +31784,9 @@ function registerBoardCommands(program3) {
         includeAllBodies: o.bodies,
         allowPartial: o.allowPartial
       }, o.direct ? {} : { snapshot: registryClientDeps(config) });
-      console.log(o.json ? JSON.stringify(report) : renderBoardReport(report));
+      const output = o.json ? JSON.stringify(report) : renderBoardReport(report);
+      if (!o.out) console.log(output);
+      else console.log(`Wrote board read to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
     } catch (e) {
       return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
     }
@@ -31753,7 +31795,7 @@ function registerBoardCommands(program3) {
     return alreadyClaimed ? `Check ${ref}: claimed and In Progress, no live contest - claim would renew the lease (nothing written)` : `Check ${ref}: free - claim would proceed (nothing written)`;
   }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
-  board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n").action((o) => runBoardRead(o));
+  board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nNever capture the JSON with a shell redirect on Windows: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   withExamples(mutating(
     board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").addHelpText("after", "\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
@@ -32416,7 +32458,7 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/issue-commands.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 
 // src/learning-closure-rate.ts
@@ -32603,7 +32645,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs37.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs38.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -33220,7 +33262,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs37.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs38.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -33295,8 +33337,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
   const intent = typeof raw === "string" ? raw.trim() : "";
@@ -33307,7 +33349,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs38.readFileSync)((0, import_node_path35.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs39.readFileSync)((0, import_node_path36.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -33464,9 +33506,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_os17 = require("node:os");
-var import_node_path36 = require("node:path");
+var import_node_path37 = require("node:path");
 var GC_GH_TIMEOUT_MS2 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -33656,8 +33698,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os17.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path36.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs39.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path36.join)(home, ".claude", "settings.json"), import_node_fs39.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path37.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs40.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path37.join)(home, ".claude", "settings.json"), import_node_fs40.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, doors: opts.doors ?? [], nextCommand };
 }
@@ -34420,8 +34462,8 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path38 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 function crossRepoFilingRetryCommand(prRepo, prNumber) {
@@ -34587,16 +34629,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs40.mkdirSync)((0, import_node_path37.dirname)(path2), { recursive: true });
-  (0, import_node_fs40.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
+  (0, import_node_fs41.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr2) {
   const path2 = postMergeReconStatePath(cwd, repo, pr2);
-  if (!(0, import_node_fs40.existsSync)(path2)) return;
+  if (!(0, import_node_fs41.existsSync)(path2)) return;
   try {
-    (0, import_node_fs40.unlinkSync)(path2);
+    (0, import_node_fs41.unlinkSync)(path2);
   } catch {
   }
 }
@@ -37713,10 +37755,10 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_os18 = require("node:os");
-var import_node_path38 = require("node:path");
-var import_node_child_process17 = require("node:child_process");
+var import_node_path39 = require("node:path");
+var import_node_child_process18 = require("node:child_process");
 var import_node_util8 = require("node:util");
 
 // src/discard-sink.ts
@@ -37725,27 +37767,27 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 }
 
 // src/doctor-io.ts
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process17.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process18.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
-  const inFd = (0, import_node_fs41.openSync)(sink, "r");
-  const errFd = (0, import_node_fs41.openSync)(sink, "w");
+  const inFd = (0, import_node_fs42.openSync)(sink, "r");
+  const errFd = (0, import_node_fs42.openSync)(sink, "w");
   try {
-    return (0, import_node_child_process17.execFileSync)(file, args, {
+    return (0, import_node_child_process18.execFileSync)(file, args, {
       ...opts,
       encoding: "utf8",
       stdio: [inFd, "pipe", errFd]
     });
   } finally {
-    (0, import_node_fs41.closeSync)(inFd);
-    (0, import_node_fs41.closeSync)(errFd);
+    (0, import_node_fs42.closeSync)(inFd);
+    (0, import_node_fs42.closeSync)(errFd);
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs41.readFileSync)((0, import_node_path38.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs42.readFileSync)((0, import_node_path39.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -37756,7 +37798,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs41.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs42.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -37765,12 +37807,12 @@ function manifestVersion(path2) {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs41.existsSync)(root);
-  const manifestPath = (0, import_node_path38.join)(root, "plugin.yaml");
+  const installRecordPresent = (0, import_node_fs42.existsSync)(root);
+  const manifestPath = (0, import_node_path39.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs41.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs42.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -37784,20 +37826,20 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs41.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs42.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs41.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs42.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs41.existsSync)((0, import_node_path38.join)(root, "skills")) && (0, import_node_fs41.statSync)((0, import_node_path38.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, "skills")) && (0, import_node_fs42.statSync)((0, import_node_path39.join)(root, "skills")).isDirectory();
   } catch {
   }
   return {
-    hostPresent: (0, import_node_fs41.existsSync)(host),
+    hostPresent: (0, import_node_fs42.existsSync)(host),
     installRecordPresent,
     manifest,
-    payloadPresent: (0, import_node_fs41.existsSync)((0, import_node_path38.join)(root, "__init__.py")) && skills && manifest === "valid",
+    payloadPresent: (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, "__init__.py")) && skills && manifest === "valid",
     ...installedVersion ? { installedVersion } : {}
   };
 }
@@ -37805,7 +37847,7 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs41.readFileSync)((0, import_node_path38.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs42.readFileSync)((0, import_node_path39.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
@@ -37813,13 +37855,13 @@ function installedSurfacePluginVersion(surface) {
   }
   if (token === "hermes") return readHermesPluginEvidence().installedVersion;
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path38.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path39.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     return installedJervCodePackageVersion();
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path38.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path39.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
@@ -37853,13 +37895,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path38.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path39.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs41.readFileSync)(path2, "utf8");
+    return (0, import_node_fs42.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -37868,14 +37910,14 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs41.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs42.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs41.existsSync)((0, import_node_path38.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, ".gitattributes"));
   try {
     const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
       windowsHide: true
@@ -37942,8 +37984,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs42.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs42.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs43.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs43.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -37951,7 +37993,7 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path39.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path40.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -38088,7 +38130,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs42.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs43.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -38126,7 +38168,7 @@ function mmiDoctorDeps(opts = {}) {
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs43.existsSync)((0, import_node_path40.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38135,7 +38177,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs43.existsSync)((0, import_node_path40.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38456,19 +38498,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path39.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs42.existsSync)(path2) ? (0, import_node_fs42.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path40.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs43.existsSync)(path2) ? (0, import_node_fs43.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs42.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs43.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs42.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs43.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli devops org rules gitignore: up to date");
@@ -38654,7 +38696,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process18.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -39044,7 +39086,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs42.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs43.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -39869,11 +39911,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path39.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
-  return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path40.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
+  return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path39.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -39939,16 +39981,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path39.join)(root, path2);
-      return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path40.join)(root, path2);
+      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path39.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path40.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path39.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path39.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 async function waitLoopCorePool(label) {
@@ -40220,9 +40262,18 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
   if (result.status === "failed") process.exitCode = 1;
 });
-jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
+  if (o.disableAuto) {
+    await execFileP2("gh", buildPrDisableAutoArgs({ number, repoArgs }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e) => {
+      const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+      if (note) throw new Error(`gh pr merge ${number} --disable-auto: ${note}`);
+      throw e;
+    });
+    console.log(JSON.stringify({ mergeStatus: "auto-merge-disabled", pr: number, ...o.repo ? { repo: o.repo } : {} }));
+    return;
+  }
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
   const prMeta = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid,state", "--jq", "{head: .headRefName, base: .baseRefName, oid: .headRefOid, state: .state}"], { timeout: GC_GH_TIMEOUT_MS }).then((r) => JSON.parse(r.stdout)).catch(async (e) => {
     if (!isGitHubRateLimitError(e) || !repoForPostCleanup) throw e;
@@ -40249,7 +40300,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const mergeSquashBody = squashBodyTextForMerge(
     closingGuardInput,
     method === "--squash",
-    o.squashBodyFile ? (0, import_node_fs42.readFileSync)(o.squashBodyFile, "utf8") : void 0
+    o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
   );
   if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
   const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -40263,7 +40314,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     return;
   }
   if (closingGuardVerdict.message) console.warn(closingGuardVerdict.message);
-  if (prMeta.state !== "MERGED") {
+  if (prMeta.state !== "MERGED" && !o.preserveWorktree) {
     if (!repoForPostCleanup) throw new Error("pr merge: repository is unreadable; cannot prove remote branch preservation");
     const repoSettings = await defaultGitHubClient().rest("GET", `repos/${repoForPostCleanup}`);
     assertRemoteBranchPreservedOnMerge(repoForPostCleanup, repoSettings.delete_branch_on_merge);
@@ -40338,7 +40389,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs42.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -40427,7 +40478,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       preserveWorktree: o.preserveWorktree,
       gcAcknowledged: o.gc,
       expectedHeadOid: headRefOid,
-      pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs43.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
     });
   } catch (e) {
@@ -40715,7 +40766,7 @@ for (const commandName of ["rcand", "release"]) {
     { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
     { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
     { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
-    { flags: "--retry-publish <run-id>", description: "with --apply, retry failed jobs of one proven Hub publish release run (#3949)" }
+    { flags: "--retry-publish <run-id>", description: "with --apply, retry one proven failed or cancelled Hub publish release run (#3949/#5797)" }
   ];
   for (const f of RELEASE_ONLY_FLAGS) {
     if (commandName === "release") {
@@ -41014,8 +41065,7 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
       console.log("\nDry-run \u2014 re-run with --apply to patch merge settings and activate product rulesets (master-admin).");
     }
   }
-  const applyFailed = applyResults.some((result) => result.errors.length > 0 || result.postApply?.state === "failed");
-  if (!audit.ok || applyFailed) process.exitCode = 1;
+  if (ciReconcileExitFailed({ apply: o.apply === true, audit, applyResults })) process.exitCode = 1;
 });
 registerBootstrapCommands(program2);
 var access = program2.command("access").description("org access audit (read-only)");
@@ -41064,12 +41114,12 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs42.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs42.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs43.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs43.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs42.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs42.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs43.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs43.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs42.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs42.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs43.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs43.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -41101,16 +41151,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs42.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs43.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path39.join)(path2, entry.name);
+    const child2 = (0, import_node_path40.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs42.statSync)(child2).size;
+        total += (0, import_node_fs43.statSync)(child2).size;
       } catch {
       }
     }
@@ -41118,25 +41168,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs43.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs42.existsSync)(p)) return [];
+  if (!(0, import_node_fs43.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs42.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs43.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs42.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs42.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs43.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs42.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path39.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs42.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path40.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs43.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -41150,10 +41200,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path39.join)(stagingRoot, name);
-      if (!(0, import_node_fs42.existsSync)(p)) return null;
+      const p = (0, import_node_path40.join)(stagingRoot, name);
+      if (!(0, import_node_fs43.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs42.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs43.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -41179,7 +41229,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs42.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs43.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",