@mutmutco/cli 4.2.6 → 4.2.7

package/dist/main.cjs

@@ -11830,10 +11830,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.2.6",
-    tag: "v4.2.6",
-    commit: "608eebe09477",
-    npm: "@mutmutco/cli@4.2.6"
+    version: "4.2.7",
+    tag: "v4.2.7",
+    commit: "bb37250e186c",
+    npm: "@mutmutco/cli@4.2.7"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -11850,14 +11850,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.2.6"
+          v3Target: "v4.2.7"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.2.6 and redeploy the Hub Lambda from tag v4.2.6 (608eebe09477); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.2.6 (@mutmutco/cli@4.2.6, tag commit 608eebe09477 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.2.7 and redeploy the Hub Lambda from tag v4.2.7 (bb37250e186c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.2.7 (@mutmutco/cli@4.2.7, tag commit bb37250e186c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -15880,15 +15880,35 @@ function parseGateNpmVersionPins(workflowBody) {
   if (!/runner-node-toolchain/.test(workflowBody)) return [];
   return [...workflowBody.matchAll(/^\s*npm-version:\s*['"]?(\d+(?:\.\d+\.\d+)?)/gm)].map((m) => m[1]);
 }
+function parseGateNpmInstallPins(workflowBody) {
+  return [...workflowBody.matchAll(/npm\s+install\s+-g\s+npm@(\d+(?:\.\d+\.\d+)?)/g)].map((m) => m[1]);
+}
+function gateDeclaredNpmPins(gateFiles) {
+  const files = gateFiles ?? [];
+  return [
+    ...files.flatMap((file) => parseGateNpmVersionPins(file.body)),
+    ...files.flatMap((file) => parseGateNpmInstallPins(file.body))
+  ];
+}
+function publishWorkflowNpm(files) {
+  const publish = files?.find((f) => /(?:^|\/)publish\.ya?ml$/i.test(f.path));
+  return publish ? parsePublishWorkflowNpmPin(publish.body) : void 0;
+}
 function resolveExpectedCiNpmFromWorkflows(gateFiles, allFiles) {
-  const declared = gateFiles?.flatMap((file) => parseGateNpmVersionPins(file.body)) ?? [];
+  const declared = gateDeclaredNpmPins(gateFiles);
   if (declared.length) return declared[0];
   const fromGate = resolveGreenGateNpmFromGateWorkflows(gateFiles);
   if (fromGate) return fromGate;
-  const files = allFiles ?? gateFiles;
-  if (!files?.length) return void 0;
-  const publish = files.find((f) => /(?:^|\/)publish\.ya?ml$/i.test(f.path));
-  return publish ? parsePublishWorkflowNpmPin(publish.body) : void 0;
+  return publishWorkflowNpm(allFiles ?? gateFiles);
+}
+function detectNpmPinDisagreement(gateFiles, allFiles) {
+  const gateNpm = gateDeclaredNpmPins(gateFiles)[0];
+  const publishNpm = publishWorkflowNpm(allFiles ?? gateFiles);
+  if (!gateNpm || !publishNpm) return null;
+  const gateMajor = npmMajor(gateNpm);
+  const publishMajor = npmMajor(publishNpm);
+  if (gateMajor === void 0 || publishMajor === void 0) return null;
+  return gateMajor === publishMajor ? null : { gateNpm, publishNpm };
 }
 function npmMajor(version) {
   const match = /^(\d+)/.exec(version.trim());
@@ -15903,7 +15923,7 @@ function assertNpmMajorPreflight(opts) {
   if (localMajor === void 0 || expectedMajor === void 0) return;
   if (localMajor === expectedMajor) return;
   throw new Error(
-    `${opts.repo}: Step 0a npm-major preflight failed \u2014 local npm ${localNpm} (major ${localMajor}) \u2260 CI npm ${expectedNpm} (major ${expectedMajor}). Supported repair (preserves Node): \`npm install -g npm@${expectedNpm}\`; then verify with \`node -v && npm -v\` and rerun the same release command. This is an npm-major mismatch (#5666/#5616/#4578), not a lockfile or publish-surface problem. When gate.yml has no bundled npm pin, read the publish workflow npm pin; otherwise compare \`npm -v\` with the green gate log's toolchain-preflight line (#3446).`
+    `${opts.repo}: Step 0a npm-major preflight failed \u2014 local npm ${localNpm} (major ${localMajor}) \u2260 CI npm ${expectedNpm} (major ${expectedMajor}). Supported repair (preserves Node): \`npm install -g npm@${expectedNpm}\`; then verify with \`node -v && npm -v\` and rerun the same release command. This is an npm-major mismatch (#5666/#5616/#4578), not a lockfile or publish-surface problem. The expected npm is the gate's own declared npm \u2014 an \`npm-version:\` input or an explicit \`npm install -g npm@X\` step (#5893) \u2014 and only a gate that declares neither falls back to a bundled-npm mapping or the publish workflow's pin; otherwise compare \`npm -v\` with the green gate log's toolchain-preflight line (#3446).`
   );
 }
 async function assertNpmMajorPreflightFromWorkflows(deps, repo) {
@@ -15915,6 +15935,12 @@ async function assertNpmMajorPreflightFromWorkflows(deps, repo) {
   } catch {
     return;
   }
+  const disagreement = detectNpmPinDisagreement(gateFiles, allFiles);
+  if (disagreement) {
+    (deps.warn ?? ((m) => console.warn(m)))(
+      `${repo}: repo defect \u2014 the gate declares npm ${disagreement.gateNpm} while the publish workflow pins npm ${disagreement.publishNpm}. The gate's declaration wins this preflight, but the publish lane will still run npm ${disagreement.publishNpm}. Align both pins in one PR.`
+    );
+  }
   assertNpmMajorPreflight({
     repo,
     localNpm,
@@ -31344,11 +31370,14 @@ async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile) {
   }
   return confirmEnqueueOutcome();
 }
+function cleanupGitArgs(cwd, args) {
+  return cwd ? ["-C", cwd, ...args] : args;
+}
 async function remoteBranchExists2(branch, options = {}) {
   if (!branch) return void 0;
   try {
-    if (options.prune) await execFileP2("git", ["fetch", "origin", "--prune"], { timeout: GIT_TIMEOUT_MS });
-    return (await execFileP2("git", ["ls-remote", "--heads", "origin", branch], { timeout: GIT_TIMEOUT_MS })).stdout.trim().length > 0;
+    if (options.prune) await execFileP2("git", cleanupGitArgs(options.cwd, ["fetch", "origin", "--prune"]), { timeout: GIT_TIMEOUT_MS });
+    return (await execFileP2("git", cleanupGitArgs(options.cwd, ["ls-remote", "--heads", "origin", branch]), { timeout: GIT_TIMEOUT_MS })).stdout.trim().length > 0;
   } catch {
     return void 0;
   }
@@ -40864,7 +40893,10 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       gcAcknowledged: o.gc,
       expectedHeadOid: headRefOid,
       pathExists: (p) => (0, import_node_fs43.existsSync)(p),
-      execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
+      // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
+      // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
+      // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
+      execGit: async (args) => (await execFileP2("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout
     });
   } catch (e) {
     localCleanup = {
@@ -40879,8 +40911,10 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const remoteBranch = await deleteMergedRemoteBranch({
     branch: headRef,
     existedBefore: remoteBefore,
-    execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
-    branchExists: remoteBranchExists2
+    // #5899: this leg runs after worktree teardown — anchor it to the main checkout so a cwd inside
+    // the removed worktree cannot turn the delete into 'fatal: not a git repository' + manual remediation.
+    execGit: async (args) => (await execFileP2("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout,
+    branchExists: (b) => remoteBranchExists2(b, { cwd: primaryRoot })
   });
   const worktreePartial = localCleanup?.worktree?.path && localCleanup.worktree.status !== "removed" ? {
     kind: "worktree-directory",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.2.6",
+  "version": "4.2.7",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",