@mutmutco/cli 4.3.23 → 4.3.24

package/dist/main.cjs

@@ -6862,6 +6862,9 @@ async function tenantReconcile(payload, deps) {
 async function tenantDeploy(payload, deps) {
   return postJson("/tenant-deploy", payload, deps, "POST", { noRetry: true, timeoutMs: TENANT_DEPLOY_TIMEOUT_MS });
 }
+async function actionsCanary(payload, deps) {
+  return postJson("/actions-canary", payload, deps, "POST", { noRetry: true });
+}
 
 // src/config-discovery.ts
 function stripMutableBoardConfig(cfg) {
@@ -15519,10 +15522,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.23",
-    tag: "v4.3.23",
-    commit: "64b06ac32d90",
-    npm: "@mutmutco/cli@4.3.23"
+    version: "4.3.24",
+    tag: "v4.3.24",
+    commit: "48a4cf4f0ad0",
+    npm: "@mutmutco/cli@4.3.24"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15539,14 +15542,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.23"
+          v3Target: "v4.3.24"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.23 and redeploy the Hub Lambda from tag v4.3.23 (64b06ac32d90); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.23 (@mutmutco/cli@4.3.23, tag commit 64b06ac32d90 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.24 and redeploy the Hub Lambda from tag v4.3.24 (48a4cf4f0ad0); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.24 (@mutmutco/cli@4.3.24, tag commit 48a4cf4f0ad0 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18914,6 +18917,15 @@ function interpretActionsJobStart(input) {
   }
   return "pending";
 }
+var CANARY_ACCESS_BLOCK_RE = /HTTP 404|HTTP 403|Not Found|Resource not accessible|must have admin rights|not authorized|no identity|401/i;
+function isCanaryAccessBlockText(text) {
+  return !isActionsBillingBlockText(text) && CANARY_ACCESS_BLOCK_RE.test(text);
+}
+function actionsCanaryUndispatchedRefusal(detail) {
+  return new Error(
+    `release refused: the hosted-job canary (#5604) was not dispatched, so a hosted job start is UNPROVEN \u2014 this is NOT a billing verdict. ${detail} The Hub dispatches ${CANARY_WORKFLOW} with its App token for a train-authorized caller (#6319): refresh the Hub session (\`gh auth login\`) and retry, and confirm \`mmi-cli oracle org access role <owner/repo>\` reports train authority. Nothing was tagged or pushed \u2014 see docs/Guides/train-troubleshooting.md#actions-job-start-canary`
+  );
+}
 function actionsBillingRefusal(detail) {
   return new Error(
     `release refused: GitHub Actions cannot start a hosted job (billing/spending). ${detail} Fix Billing & plans / the org spending limit, then rerun. Do not mint a new tag. If a tag is already on origin, use \`mmi-cli devops release --retry-publish <run-id> --apply\` on that exact run \u2014 never recut.`
@@ -19008,14 +19020,16 @@ async function correlateCanaryRun(deps, nonce) {
     `could not correlate ${CANARY_WORKFLOW} on ${CANARY_REPO} (nonce ${nonce}): ${lastError}`
   );
 }
-async function assertActionsJobsCanStart(deps, targetRepo2) {
-  const scanned = await scanRepoForBillingBlock(deps, targetRepo2);
-  if (scanned) throw actionsBillingRefusal(scanned);
-  if (targetRepo2.toLowerCase() !== CANARY_REPO.toLowerCase()) {
-    const hubScan = await scanRepoForBillingBlock(deps, CANARY_REPO);
-    if (hubScan) throw actionsBillingRefusal(hubScan);
+async function dispatchCanary(deps, targetRepo2, nonce) {
+  const attempts = [];
+  if (deps.dispatchActionsCanary) {
+    try {
+      await deps.dispatchActionsCanary({ repo: targetRepo2, nonce });
+      return;
+    } catch (e) {
+      attempts.push(`Hub App dispatch: ${e instanceof Error ? e.message : String(e)}`);
+    }
   }
-  const nonce = `5604-${(deps.now ?? Date.now)().toString(36)}`;
   try {
     await deps.run("gh", [
       "workflow",
@@ -19026,11 +19040,27 @@ async function assertActionsJobsCanStart(deps, targetRepo2) {
       "-f",
       `nonce=${nonce}`
     ]);
+    return;
   } catch (e) {
-    throw actionsBillingRefusal(
-      `could not dispatch ${CANARY_WORKFLOW} on ${CANARY_REPO}: ${e instanceof Error ? e.message : String(e)}. A hosted publish job may not start (the v1.54.2 class).`
-    );
+    attempts.push(`gh workflow run --repo ${CANARY_REPO}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const detail = `could not dispatch ${CANARY_WORKFLOW} on ${CANARY_REPO} \u2014 ${attempts.join(" | ")}.`;
+  if (attempts.some((a) => isActionsBillingBlockText(a))) {
+    throw actionsBillingRefusal(`${detail} A hosted publish job may not start (the v1.54.2 class).`);
   }
+  throw actionsCanaryUndispatchedRefusal(
+    attempts.every((a) => isCanaryAccessBlockText(a)) ? `${detail} Every door answered with an access refusal \u2014 the caller may read MMI-Hub but not start its workflows.` : detail
+  );
+}
+async function assertActionsJobsCanStart(deps, targetRepo2) {
+  const scanned = await scanRepoForBillingBlock(deps, targetRepo2);
+  if (scanned) throw actionsBillingRefusal(scanned);
+  if (targetRepo2.toLowerCase() !== CANARY_REPO.toLowerCase()) {
+    const hubScan = await scanRepoForBillingBlock(deps, CANARY_REPO);
+    if (hubScan) throw actionsBillingRefusal(hubScan);
+  }
+  const nonce = `5604-${(deps.now ?? Date.now)().toString(36)}`;
+  await dispatchCanary(deps, targetRepo2, nonce);
   const runId = await correlateCanaryRun(deps, nonce);
   const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let last = "pending";
@@ -21277,10 +21307,10 @@ function message(e) {
 function laneStage(lane) {
   return lane === "rcand" ? "rc" : "main";
 }
-function laneStartBranch(lane, track) {
+function laneStartBranch(lane, track, dev) {
   if (lane === "hotfix") return void 0;
   if (lane === "rcand") return "development";
-  return track === "full" ? "rc" : "development";
+  return track === "full" && !dev ? "rc" : "development";
 }
 function defaultLane(track, currentBranch2) {
   if (track === "full") return currentBranch2 === "rc" ? "release" : "rcand";
@@ -21361,7 +21391,8 @@ async function runTrainDoctor(input) {
   } catch {
     currentBranch2 = "";
   }
-  const lane = input.lane ?? defaultLane(track, currentBranch2);
+  const lane = input.lane ?? (input.dev === true ? "release" : defaultLane(track, currentBranch2));
+  const dev = input.dev === true && lane === "release";
   if (lane === "rcand" && track === "direct") {
     add({ code: "lane-mismatch", severity: "blocker", source: "origin", title: `${repo} is direct-track (no rc) \u2014 rcand does not apply`, remedy: "run `mmi-cli devops release --apply` from development instead of rcand" });
   } else if (track === "trunk") {
@@ -21449,7 +21480,7 @@ async function runTrainDoctor(input) {
     if (restored.length) add({ code: "tree-churn", severity: "healed", source: "local", title: `restored content-identical churn: ${restored.join(", ")}`, remedy: "nothing \u2014 the paths carried no content change (mode/EOL churn)" });
     if (left.length) add({ code: "tree-churn", severity: "blocker", source: "local", title: `content-identical churn blocks the clean-tree gate: ${left.join(", ")}`, remedy: `run \`mmi-cli devops train doctor --heal\` or \`git checkout -- ${left.join(" ")}\`` });
   }
-  const startBranch = laneStartBranch(lane, track);
+  const startBranch = laneStartBranch(lane, track, dev);
   if (startBranch && currentBranch2 !== startBranch) {
     let linked = false;
     try {
@@ -21468,7 +21499,8 @@ async function runTrainDoctor(input) {
     const missing = [
       ...!hints.hasDevelopmentBranch && lane !== "hotfix" ? ["development"] : [],
       ...!hints.hasMainBranch ? ["main"] : [],
-      ...!hints.hasRcBranch && track === "full" ? ["rc"] : []
+      // #6318: a `--dev` release never reads, merges or tags rc — a missing rc branch cannot block it.
+      ...!hints.hasRcBranch && track === "full" && !dev ? ["rc"] : []
     ];
     if (missing.length) add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `train branch(es) missing on origin: ${missing.join(", ")}`, remedy: `bootstrap the repo train: \`mmi-cli devops bootstrap apply ${repo} --execute\` (from the MMI-Hub root), then rerun` });
   }
@@ -23410,7 +23442,7 @@ async function resolveHotfixVersion(deps, env = process.env) {
 }
 async function runTrainApply(command, deps, options = {}) {
   const watch = options.watch ?? false;
-  await runTrainDoctor({ lane: command === "rcand" ? "rcand" : "release", heal: true, train: deps, refuse: true });
+  await runTrainDoctor({ lane: command === "rcand" ? "rcand" : "release", dev: command === "release" && options.dev === true, heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
   await runGitRemoteRead(deps, ["fetch", "origin"]);
@@ -43134,10 +43166,13 @@ function readRepoVersion() {
 }
 function registerTrainCommands(program3, trainDeps) {
   const train = program3.command("train").description("release-train observability \u2014 track position, version lag, and the shared preflight-and-heal doctor (#2688, #6067)");
-  train.command("doctor").description("one shared preflight-and-heal verdict for the release, rcand and hotfix lanes; read-only unless --heal (#6067)").addOption(new Option("--lane <lane>", "train lane to check (defaults from the release track: direct \u2192 release)").choices([...TRAIN_LANES])).option("--heal", "repair safe local reconstructible state (scratch gitignore, churn, stray local tags, ff-only branch lag, finished scratch branches, stale alignment ledger leg)").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").option("--json", "machine-readable output").addHelpText("after", "\nExit codes:\n  0  ready \u2014 no blocker and origin verified\n  1  a blocker remains, or origin could not be verified (never green on an unread origin)\n\nEvery finding carries code, severity (blocker|warning|healed|info), source (local|origin), remedy and a\ndocs/Guides/train-troubleshooting.md#<code> anchor. `release --apply` and `rcand --apply` run this at step 0 with --heal.\n").action(async (o) => {
+  train.command("doctor").description("one shared preflight-and-heal verdict for the release, rcand and hotfix lanes; read-only unless --heal (#6067)").addOption(new Option("--lane <lane>", "train lane to check (defaults from the release track: direct \u2192 release)").choices([...TRAIN_LANES])).option("--dev", "judge the `release --dev` lane (development -> main, skipping rc): the lane starts from development and is read on development's workflows (#6318)").option("--heal", "repair safe local reconstructible state (scratch gitignore, churn, stray local tags, ff-only branch lag, finished scratch branches, stale alignment ledger leg)").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").option("--json", "machine-readable output").addHelpText("after", "\nExit codes:\n  0  ready \u2014 no blocker and origin verified\n  1  a blocker remains, or origin could not be verified (never green on an unread origin)\n\nEvery finding carries code, severity (blocker|warning|healed|info), source (local|origin), remedy and a\ndocs/Guides/train-troubleshooting.md#<code> anchor. `release --apply` and `rcand --apply` run this at step 0 with --heal.\n").action(async (o) => {
     try {
+      if (o.dev && o.lane && o.lane !== "release") {
+        return failGraceful(`train doctor: --dev applies only to the release lane \u2014 it names the development -> main variant that skips rc, which the ${o.lane} lane does not have`);
+      }
       if (o.repo) {
-        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli devops train doctor${o.lane ? ` --lane ${o.lane}` : ""}${o.heal ? " --heal" : ""}${o.json ? " --json" : ""}`, "train doctor");
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli devops train doctor${o.lane ? ` --lane ${o.lane}` : ""}${o.dev ? " --dev" : ""}${o.heal ? " --heal" : ""}${o.json ? " --json" : ""}`, "train doctor");
         if (!guard.ok) return failGraceful(`train doctor: ${guard.message}`);
       }
       const root = (await execFileP("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
@@ -43153,7 +43188,7 @@ function registerTrainCommands(program3, trainDeps) {
           }
         }
       };
-      const verdict = await runTrainDoctor({ lane: o.lane, heal: o.heal === true, train: deps, repo: o.repo, cwd: root, argv: INVOKED_ARGV });
+      const verdict = await runTrainDoctor({ lane: o.lane, dev: o.dev === true, heal: o.heal === true, train: deps, repo: o.repo, cwd: root, argv: INVOKED_ARGV });
       if (verdict.reexecCode !== void 0) return process.exit(verdict.reexecCode);
       console.log(o.json ? JSON.stringify(verdict, null, 2) : formatTrainDoctor(verdict));
       if (!verdict.ready) process.exitCode = 1;
@@ -43262,6 +43297,16 @@ function trainApplyDeps() {
         throw new Error(`tenant deploy dispatch failed: ${detail}`);
       }
     },
+    // Hub-App-authority dispatch of the #5604 hosted-job canary (#6319) — the Hub fires the
+    // workflow_dispatch with its App token, so a train-authorized project-admin (pull-only on MMI-Hub)
+    // runs the probe instead of being refused with a 404 misread as a billing block (#6320).
+    dispatchActionsCanary: async ({ repo, nonce }) => {
+      const res = await actionsCanary({ repo, nonce }, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        const detail = res.body?.error ?? res.error ?? `HTTP ${res.status}`;
+        throw new Error(`Hub /actions-canary refused: ${detail}`);
+      }
+    },
     // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
@@ -43735,7 +43780,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       let doctor;
       if (repo && (!o.repo || (await resolveRepo())?.toLowerCase() === repo.toLowerCase())) {
         try {
-          doctor = await runTrainDoctor({ lane: commandName, heal: false, train: trainApplyDeps(), repo });
+          doctor = await runTrainDoctor({ lane: commandName, dev: commandName === "release" && o.dev === true, heal: false, train: trainApplyDeps(), repo });
         } catch (e) {
           consoleIo.err(`mmi-cli: train doctor did not complete: ${e.message}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.23",
+  "version": "4.3.24",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",