@mutmutco/cli 4.2.2 → 4.2.4

package/dist/main.cjs

@@ -3416,7 +3416,7 @@ var program = new Command();
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
 var import_node_fs43 = require("node:fs");
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -11802,10 +11802,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.2.2",
-    tag: "v4.2.2",
-    commit: "c347a86b94cc",
-    npm: "@mutmutco/cli@4.2.2"
+    version: "4.2.4",
+    tag: "v4.2.4",
+    commit: "91aa25abb871",
+    npm: "@mutmutco/cli@4.2.4"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -11822,14 +11822,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.2.2"
+          v3Target: "v4.2.4"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.2.2 and redeploy the Hub Lambda from tag v4.2.2 (c347a86b94cc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.2.2 (@mutmutco/cli@4.2.2, tag commit c347a86b94cc \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.2.4 and redeploy the Hub Lambda from tag v4.2.4 (91aa25abb871); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.2.4 (@mutmutco/cli@4.2.4, tag commit 91aa25abb871 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -24031,6 +24031,11 @@ function renderSweep(r) {
 
 // src/hotfix-apply.ts
 var HOTFIX_RELEASE_WORKFLOWS = ["deploy.yml", "publish.yml"];
+function hotfixStatusWorkflows(deployModel) {
+  if (deployModel === "registry-publish") return ["publish.yml"];
+  if (deployModel === void 0 || deployModel === "hub-serverless" || deployModel === "tenant-container" || deployModel === "solo-container") return HOTFIX_RELEASE_WORKFLOWS;
+  return [];
+}
 var HOTFIX_RUN_FIND_ATTEMPTS = 10;
 var HOTFIX_RUN_FIND_DELAY_MS = 15e3;
 var HOTFIX_VERIFY_ATTEMPTS = 5;
@@ -24666,29 +24671,35 @@ async function runHotfixStatus(deps, versionInput) {
   const work = (async () => {
     const ctx = await buildTrainApplyContext(deps);
     await deps.run("git", ["fetch", "origin", "--tags"]);
+    let workflows = HOTFIX_RELEASE_WORKFLOWS;
+    let warnings = [];
+    try {
+      workflows = hotfixStatusWorkflows(await resolveHotfixDeployModel(deps, ctx));
+    } catch (e) {
+      warnings = [`deploy model unverified (${e.message ?? e}) \u2014 probed the default deploy.yml+publish.yml run list, so an unproven run may hold the verdict at unverified`];
+    }
     let tag;
     let version;
-    let warnings = [];
     if (versionInput) {
       ({ tag, version } = normalizeHotfixVersion(versionInput));
     } else {
       const latest = await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--merged", "origin/main", "--sort=-v:refname"]).then((out) => out.split("\n").map((s) => s.trim()).find((t) => /^v\d+\.\d+\.\d+$/.test(t)));
       if (latest) {
-        const latestFacts = await gatherHotfixFacts(deps, ctx, latest, latest.slice(1));
+        const latestFacts = await gatherHotfixFacts(deps, ctx, latest, latest.slice(1), workflows);
         const latestDerived = deriveHotfixState(latestFacts);
         if (latestDerived.state !== "complete") {
           return { ...ctx, command: "hotfix-status", ...latestFacts, ...latestDerived, warnings };
         }
       }
-      const found = await findInFlightHotfixVersion(deps, ctx, latest);
-      warnings = supersededHotfixWarnings(found.superseded, latest);
+      const found = await findInFlightHotfixVersion(deps, ctx, latest, workflows);
+      warnings = [...warnings, ...supersededHotfixWarnings(found.superseded, latest)];
       if (found.inFlight) {
         ({ tag, version } = found.inFlight);
       } else {
         ({ tag, version } = await deriveHotfixVersion(deps));
       }
     }
-    const facts = await gatherHotfixFacts(deps, ctx, tag, version);
+    const facts = await gatherHotfixFacts(deps, ctx, tag, version, workflows);
     return { ...ctx, command: "hotfix-status", ...facts, ...deriveHotfixState(facts), warnings };
   })();
   let timer;
@@ -24707,7 +24718,7 @@ async function runHotfixStatus(deps, versionInput) {
     if (timer) clearTimeout(timer);
   }
 }
-async function gatherHotfixFacts(deps, ctx, tag, version) {
+async function gatherHotfixFacts(deps, ctx, tag, version, workflows = HOTFIX_RELEASE_WORKFLOWS) {
   const branchExists = Boolean(clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${hotfixBranch(tag)}`])));
   const pr2 = await findHotfixPr(deps, ctx, tag);
   const remoteTag = clean3(await deps.run("git", ["ls-remote", "origin", `refs/tags/${tag}`]));
@@ -24716,7 +24727,7 @@ async function gatherHotfixFacts(deps, ctx, tag, version) {
   const releaseExists = await hotfixReleaseExists(deps, ctx, tag);
   const runs = [];
   if (releaseExists && tagSha) {
-    for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
+    for (const workflow of workflows) {
       try {
         const out = await deps.run("gh", [
           "run",
@@ -24772,7 +24783,7 @@ function supersededHotfixWarnings(superseded, latestMainTag) {
   if (superseded.length === 0) return [];
   return [`skipped superseded hotfix marker(s) ${superseded.join(", ")} \u2014 merged to main but never released and at/below the latest released tag ${latestMainTag ?? "(none)"}; later releases already absorbed them (#976). Not actionable \u2014 run mmi-cli devops hotfix start for a new fix.`];
 }
-async function findInFlightHotfixVersion(deps, ctx, latestMainTag) {
+async function findInFlightHotfixVersion(deps, ctx, latestMainTag, workflows = HOTFIX_RELEASE_WORKFLOWS) {
   const tags = /* @__PURE__ */ new Set();
   const out = await deps.run("gh", [
     "pr",
@@ -24802,13 +24813,13 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag) {
   const fresh = latestMainTag ? sorted.filter((t) => compareHotfixVersions(t, latestMainTag) > 0) : sorted;
   for (const tag of fresh) {
     const version = tag.slice(1);
-    const facts = await gatherHotfixFacts(deps, ctx, tag, version);
+    const facts = await gatherHotfixFacts(deps, ctx, tag, version, workflows);
     if (deriveHotfixState(facts).state !== "complete") return { inFlight: { tag, version }, superseded: [] };
   }
   const stale = latestMainTag ? sorted.filter((t) => compareHotfixVersions(t, latestMainTag) <= 0) : [];
   const superseded = [];
   for (const tag of stale) {
-    const facts = await gatherHotfixFacts(deps, ctx, tag, tag.slice(1));
+    const facts = await gatherHotfixFacts(deps, ctx, tag, tag.slice(1), workflows);
     if (deriveHotfixState(facts).state !== "complete") superseded.push(tag);
   }
   return { inFlight: null, superseded };
@@ -25152,6 +25163,16 @@ var WAIVABLE_KINDS = [
   "stale-satisfied-by"
 ];
 var TEST_WORK_KIND = "unrequested-test-file";
+var TEST_FILE_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+var PY_TEST_FILE_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+function isTestPath(path2) {
+  return typeof path2 === "string" && (TEST_FILE_RE.test(path2) || PY_TEST_FILE_RE.test(path2));
+}
+function editsExistingTest(paths, addedPaths = []) {
+  const added = new Set(Array.isArray(addedPaths) ? addedPaths : []);
+  const list = Array.isArray(paths) ? paths : [];
+  return list.some((path2) => isTestPath(path2) && !added.has(path2));
+}
 function translateGlob(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i += 1) {
@@ -25194,7 +25215,7 @@ function matchedMandatoryGlobs(paths, mandatory) {
     return list.some((path2) => re.test(path2));
   });
 }
-function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null } = {}) {
+function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null, addedPaths = [] } = {}) {
   const configuredMandatoryCount = mandatoryGlobList(mandatory).length;
   if (!regulated) {
     return {
@@ -25202,18 +25223,23 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, overrid
       matchedMandatoryGlobs: [],
       matchedMandatoryCount: 0,
       testCommandsAllowed: true,
+      editsExistingTest: false,
       reasonId: null,
       commandClasses: { allowed: [TEST_COMMAND_CLASS], refused: [] }
     };
   }
   const matched = matchedMandatoryGlobs(paths, mandatory);
   const overrideAuthorizes = Array.isArray(override?.kinds) && override.kinds.includes(TEST_WORK_KIND);
-  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes;
+  const existingTestEdited = editsExistingTest(paths, addedPaths);
+  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes || existingTestEdited;
   return {
     configuredMandatoryCount,
     matchedMandatoryGlobs: matched,
     matchedMandatoryCount: matched.length,
     testCommandsAllowed,
+    /** #5842: true when the diff edits a test file that already existed — one of the facts that can
+     *  authorize the class, named so a refusal can say what was missing. */
+    editsExistingTest: existingTestEdited,
     reasonId: testCommandsAllowed ? null : "test-command-outside-mandatory-zone",
     commandClasses: {
       allowed: testCommandsAllowed ? [TEST_COMMAND_CLASS] : [],
@@ -25291,8 +25317,8 @@ function readOverride(base, cwd) {
 
 // src/test-policy-core.ts
 var POLICY_FILE = "test-policy.json";
-var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
-var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+var TEST_RE = TEST_FILE_RE;
+var PY_TEST_RE = PY_TEST_FILE_RE;
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -25327,7 +25353,7 @@ function translate(glob) {
 function globToRegExp2(glob) {
   return new RegExp(`^${translate(glob)}$`);
 }
-function isTestPath(path2) {
+function isTestPath2(path2) {
   return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
 }
 var SUPPORTED_SOURCE = /\.[cm]?[jt]s$/;
@@ -25561,7 +25587,7 @@ function annotateChangeMeaning(changed, policy, read) {
   const matchers = (policy.mandatory ?? []).map((m) => globToRegExp2(m.glob));
   return changed.map((file) => {
     if (file.status !== "M" || !SUPPORTED_SOURCE.test(file.path)) return file;
-    if (!matchers.some((re) => re.test(file.path)) && !isTestPath(file.path)) return file;
+    if (!matchers.some((re) => re.test(file.path)) && !isTestPath2(file.path)) return file;
     let pair;
     try {
       pair = read(file.path);
@@ -25598,7 +25624,7 @@ function removedPaths(changed) {
 function classify(changed, policy, present = () => false) {
   const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp2(m.glob) }));
   const mandatoryHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path)));
-  const testChanges = changed.filter((f) => isTestPath(f.path));
+  const testChanges = changed.filter((f) => isTestPath2(f.path));
   const addedTests = testChanges.filter((f) => f.status === "A");
   const removed = removedPaths(changed);
   const discharged = (m) => (m.satisfiedBy?.length ?? 0) > 0 && m.satisfiedBy.every((p) => present(p) && !removed.has(p));
@@ -25787,6 +25813,9 @@ function runTestPolicy(root, deps = {}) {
   const findings = blocking.length > 0 ? blocking : sift(evaluate(changed, policy, present));
   const commandPolicy = evaluateTestCommandPolicy({
     paths: changed.map((f) => f.path),
+    // #5842: `A` is added, `R` is a rename whose new name did not exist at the base either. Both are
+    // test work this diff CREATED, which only a waiver may authorize (#5804).
+    addedPaths: changed.filter((f) => f.status === "A" || f.status === "R").map((f) => f.path),
     mandatory: policy.mandatory,
     regulated: policy.declared !== false,
     override: override && lookup.refusals.length === 0 ? { kinds: override.kinds } : null
@@ -32419,7 +32448,53 @@ async function fetchRestCorePool(gh = defaultGhApi) {
 }
 
 // src/pr-create-docs-check.ts
+var import_node_child_process18 = require("node:child_process");
 var GIT_TIMEOUT_MS2 = 15e3;
+function catFileBatch(root, ref, paths) {
+  if (paths.length === 0) return Promise.resolve([]);
+  return new Promise((resolve6) => {
+    const chunks = [];
+    let settled = false;
+    const child2 = (0, import_node_child_process18.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve6(parseCatFileBatch(Buffer.concat(chunks), paths.length));
+    };
+    const timer = setTimeout(() => {
+      child2.kill("SIGKILL");
+      finish();
+    }, GIT_TIMEOUT_MS2);
+    timer.unref?.();
+    child2.stdout.on("data", (c) => chunks.push(c));
+    child2.on("error", finish);
+    child2.stdin.on("error", () => {
+    });
+    child2.on("close", finish);
+    child2.stdin.end(paths.map((path2) => `${ref}:${path2}
+`).join(""));
+  });
+}
+function parseCatFileBatch(out, expected) {
+  const results = [];
+  let at = 0;
+  while (results.length < expected) {
+    const eol = out.indexOf(10, at);
+    if (eol === -1) break;
+    const header = out.toString("utf8", at, eol);
+    at = eol + 1;
+    if (header.endsWith(" missing")) {
+      results.push(void 0);
+      continue;
+    }
+    const size = Number(header.slice(header.lastIndexOf(" ") + 1));
+    if (!Number.isInteger(size) || size < 0 || at + size > out.length) break;
+    results.push(out.toString("utf8", at, at + size));
+    at = at + size + 1;
+  }
+  return results;
+}
 function createPrCreateDocsIndexDeps() {
   return {
     worktreeRoot: async () => {
@@ -32448,20 +32523,13 @@ function createPrCreateDocsIndexDeps() {
     },
     listDocsAtRef: async (root, ref) => {
       try {
-        const { stdout } = await execFileP2("git", ["-C", root, "ls-tree", "-r", "--name-only", ref, "--", "docs"], { timeout: GIT_TIMEOUT_MS2 });
-        return stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+        const { stdout } = await execFileP2("git", ["-C", root, "ls-tree", "-r", "-z", "--name-only", ref, "--", "docs"], { timeout: GIT_TIMEOUT_MS2 });
+        return stdout.split("\0").filter(Boolean);
       } catch {
         return [];
       }
     },
-    readAtRef: async (root, ref, path2) => {
-      try {
-        const { stdout } = await execFileP2("git", ["-C", root, "show", `${ref}:${path2}`], { timeout: GIT_TIMEOUT_MS2 });
-        return stdout;
-      } catch {
-        return void 0;
-      }
-    }
+    readManyAtRef: (root, ref, paths) => catFileBatch(root, ref, paths)
   };
 }
 async function checkDocsIndexAtHead(opts, deps) {
@@ -32476,10 +32544,10 @@ async function checkDocsIndexAtHead(opts, deps) {
   const paths = await deps.listDocsAtRef(root, ref);
   if (!paths.includes(DOCS_INDEX_PATH)) return void 0;
   const relDocs = paths.filter((p) => p.startsWith("docs/") && p.endsWith(".md")).map((p) => p.slice("docs/".length)).filter(isRoutableDocsPath);
-  const [indexContent, docContents] = await Promise.all([
-    deps.readAtRef(root, ref, DOCS_INDEX_PATH),
-    Promise.all(relDocs.map((rel) => deps.readAtRef(root, ref, `docs/${rel}`)))
-  ]);
+  const contents = await deps.readManyAtRef(root, ref, [DOCS_INDEX_PATH, ...relDocs.map((rel) => `docs/${rel}`)]);
+  const [indexContent, ...docContents] = contents;
+  if (contents.length !== relDocs.length + 1) return void 0;
+  if (indexContent === void 0 || docContents.some((c) => c === void 0)) return void 0;
   const contentByPath = new Map(relDocs.map((rel, i) => [rel, docContents[i] ?? ""]));
   const atRefDeps = {
     listDocs: () => relDocs,
@@ -32495,7 +32563,7 @@ async function checkDocsIndexAtHead(opts, deps) {
   }
   return {
     ok: false,
-    detail: `${DOCS_INDEX_PATH} is stale at the commit this PR would open from \u2014 it no longer matches the docs/ tree there`,
+    detail: `${DOCS_INDEX_PATH} is stale at the commit this PR would open from \u2014 it no longer matches the docs/ tree there (checked ${ref} over ${relDocs.length} indexed doc${relDocs.length === 1 ? "" : "s"})`,
     fix: "run `mmi-cli oracle docs index --write`, commit docs/index.md, and push again before retrying `pr create`"
   };
 }
@@ -36637,6 +36705,9 @@ function diagnoseSurface(evidence) {
   if (evidence.manifest === "invalid") return { ...base, state: "corrupt" };
   if (!evidence.releasedVersion) return { ...base, state: "freshness-unknown" };
   if (evidence.installedVersion && evidence.releasedVersion && compareVersions(evidence.installedVersion, evidence.releasedVersion) < 0) {
+    if (evidence.stagedVersion && evidence.stagedVersion === evidence.releasedVersion) {
+      return { ...base, state: "staged" };
+    }
     return { ...base, state: "stale" };
   }
   return { ...base, state: "clean" };
@@ -36647,14 +36718,16 @@ function reloadInstruction(descriptor) {
   return `${verb} ${descriptor.displayName}`;
 }
 function planSurfaceRepair(diagnosis) {
-  if (diagnosis.state === "clean" || diagnosis.state === "pending-reload" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
+  if (diagnosis.state === "clean" || diagnosis.state === "pending-reload" || diagnosis.state === "staged" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
   const descriptor = diagnosis.descriptor;
   if (descriptor.repairOwner === "mmi-hub") {
     return {
       supported: false,
       owner: "mmi-hub",
       changes: [],
-      instruction: `run \`mmi-hub update\` to converge the MMI-managed Hermes plugin, then ${reloadInstruction(descriptor)}`
+      // #5833: name the SURFACE this row is about — the literal "Hermes plugin" sent every other
+      // mmi-hub-owned surface (Claude Code included) chasing a different host that was already current.
+      instruction: `run \`mmi-hub update\` to converge the MMI-managed ${descriptor.displayName} plugin, then ${reloadInstruction(descriptor)}`
     };
   }
   if (descriptor.repairOwner !== "mmi-cli") {
@@ -36681,6 +36754,8 @@ function buildSurfaceDoctorCheck(diagnosis) {
     skipped: "skipped \u2014 host not active",
     clean: diagnosis.repairDetail ? `clean \u2014 repaired and verified (${diagnosis.repairDetail})` : `clean${versions ? ` \u2014 ${versions}` : ""}`,
     "pending-reload": `pending ${descriptor.token === "hermes" ? "fresh process" : descriptor.reload === "workspace" ? "reload" : "restart"} \u2014 repaired to ${diagnosis.releasedVersion}, but ${diagnosis.installedVersion} is still the version this host has loaded${diagnosis.repairDetail ? ` (${diagnosis.repairDetail})` : ""}`,
+    // #5833: the update already staged the released tree; the wording mirrors `mmi-hub status`.
+    staged: `loaded ${diagnosis.installedVersion}; staged ${diagnosis.releasedVersion} for next launch \u2014 ${descriptor.token === "hermes" ? "start a fresh process" : descriptor.reload === "workspace" ? "reload" : "restart"} ${descriptor.displayName} to converge`,
     "freshness-unknown": `${diagnosis.installedVersion ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
     stale: `stale${versions ? ` \u2014 ${versions}` : ""}`,
     missing: "missing \u2014 no install record",
@@ -36692,14 +36767,14 @@ function buildSurfaceDoctorCheck(diagnosis) {
     id: `${descriptor.token}-plugin`,
     surface: descriptor.token,
     state,
-    ok: state === "clean" || state === "skipped" || state === "pending-reload",
+    ok: state === "clean" || state === "skipped" || state === "pending-reload" || state === "staged",
     ...state === "freshness-unknown" ? { reportOnly: true } : {},
-    // Nothing is broken, so this is not a ✗ — but it is the one OK row an operator must act on, and the
+    // Nothing is broken, so this is not a ✗ — but these are the OK rows an operator must act on, and the
     // short default lane and the SessionStart banner both filter to failures unless a row says otherwise.
-    ...state === "pending-reload" ? { warn: true } : {},
+    ...state === "pending-reload" || state === "staged" ? { warn: true } : {},
     label: `${descriptor.displayName} plugin`,
     detail: detailByState[state],
-    ...plan ? { fix: plan.instruction } : state === "pending-reload" ? { fix: reloadInstruction(descriptor) } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
+    ...plan ? { fix: plan.instruction } : state === "pending-reload" || state === "staged" ? { fix: reloadInstruction(descriptor) } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
     verbose: [
       // The three numbers the legacy builder used to print. They belong here now that this is the only
       // plugin row, and a report that names a state without naming the versions behind it is not evidence.
@@ -37807,7 +37882,7 @@ function ghAccountCaveat(announcedLogin, accounts) {
 var import_node_fs42 = require("node:fs");
 var import_node_os18 = require("node:os");
 var import_node_path39 = require("node:path");
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_util8 = require("node:util");
 
 // src/discard-sink.ts
@@ -37816,13 +37891,13 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 }
 
 // src/doctor-io.ts
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process18.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process19.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
   const inFd = (0, import_node_fs42.openSync)(sink, "r");
   const errFd = (0, import_node_fs42.openSync)(sink, "w");
   try {
-    return (0, import_node_child_process18.execFileSync)(file, args, {
+    return (0, import_node_child_process19.execFileSync)(file, args, {
       ...opts,
       encoding: "utf8",
       stdio: [inFd, "pipe", errFd]
@@ -37833,6 +37908,18 @@ function execFileCapture(file, args, opts = {}) {
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
+function stagedClaudePluginVersion() {
+  try {
+    const stagingRoot = (0, import_node_path39.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "staging");
+    const record = JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path39.join)(stagingRoot, "launch-target.json"), "utf8"));
+    if (typeof record.target !== "string" || typeof record.incoming !== "string") return void 0;
+    const manifest = JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path39.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
+    if (typeof manifest.version !== "string") return void 0;
+    return manifest.version === record.target ? record.target : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
@@ -38091,6 +38178,7 @@ function mmiDoctorDeps(opts = {}) {
     const hermes = token === "hermes" ? readHermesPluginEvidence(process.env) : void 0;
     const kimi = token === "kimi" ? kimiPluginHostEvidence(surfaceConfigRoot("kimi")) : void 0;
     const installedVersion = hermes?.installedVersion ?? installedSurfacePluginVersion(runtimeSurface);
+    const stagedVersion = token === "claude" ? stagedClaudePluginVersion() : void 0;
     surfaceEvidence = {
       descriptor,
       // Hermes' root is the host evidence: a configured but uninstalled MMI tree is missing, while an
@@ -38102,7 +38190,8 @@ function mmiDoctorDeps(opts = {}) {
       manifest: hermes?.manifest ?? (installedVersion ? "valid" : snapshot.installRecordPresent ? "invalid" : "missing"),
       guardState: buildPluginGuardDecision(snapshot).state,
       ...kimi?.receipt ? { receipt: kimi.receipt } : {},
-      ...installedVersion ? { installedVersion } : {}
+      ...installedVersion ? { installedVersion } : {},
+      ...stagedVersion ? { stagedVersion } : {}
     };
     return surfaceEvidence;
   };
@@ -38751,7 +38840,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process20.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.2.2",
+  "version": "4.2.4",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",