@mutmutco/cli 4.3.39 → 4.3.41

package/README.md

@@ -6,21 +6,23 @@ This package is published from [mutmutco/MMI-Hub](https://github.com/mutmutco/MM
 
 The CLI carries the org **Hub endpoint** intrinsically (override with the `MMI_HUB_URL` env var), so a product repo needs **no committed control-plane config** to reach the Hub — board coords, deploy coordinates, OAuth, and the secrets layout are all discovered from the Hub registry at runtime.
 
+Local stage recipes and printed plans use Bash on every platform. Windows requires Git Bash in its standard system or user installation, or `SHELL` set to the absolute `bash.exe` path. A missing Bash installation fails explicitly. Native Windows administration helpers remain independent of the stage shell.
+
 ## Install
 
-```powershell
+```bash
 npm install -g @mutmutco/cli
 ```
 
 Authenticate GitHub once for Hub session issuance and Project board operations:
 
-```powershell
+```bash
 gh auth login --hostname github.com --git-protocol https --web --scopes "project"
 ```
 
 Then verify the installed command:
 
-```powershell
+```bash
 mmi-cli --version
 mmi-cli doctor --json
 ```
@@ -79,7 +81,7 @@ they don't get re-derived or re-litigated per session:
 
 When working inside an `MMI-Hub` checkout before npm is available, use the committed bundle directly:
 
-```powershell
+```bash
 node cli/dist/index.cjs --version
 node cli/dist/index.cjs doctor --json
 ```

package/dist/main.cjs

@@ -12198,10 +12198,9 @@ async function postIssueComment(client, input) {
 
 // src/board-claim-move.ts
 var CLAIM_CONCURRENCY = 5;
-function withPowerShellChainHint(message2, platform2 = process.platform) {
-  if (platform2 !== "win32") return message2;
+function withGatedWriteChainHint(message2) {
   return `${message2}
-note: in PowerShell a ';' chain runs every statement regardless of the previous exit code, so the chain ran past this refusal \u2014 rerun the refused write solo or chain gated writes with '&&'`;
+note: run refused writes separately or join dependent commands with '&&'; a ';' chain continues after failure`;
 }
 function isArchivedItemRefusal(message2) {
   return /The item is archived and cannot be updated/i.test(message2);
@@ -12387,7 +12386,7 @@ async function claimOneBoardItem(ctx, selector, options) {
     }
     if (!options.force) {
       const refusal = laneContestMessage(item.ref, contest, "claim");
-      throw new Error(options.bulk ? refusal : withPowerShellChainHint(refusal));
+      throw new Error(options.bulk ? refusal : withGatedWriteChainHint(refusal));
     }
     previousHolder = displaced();
   };
@@ -12571,7 +12570,7 @@ async function unclaimBoardIssue(options, deps = {}) {
   const toStatus = options.toStatus ?? "Todo";
   if (!options.force && item.contentType === "Issue") {
     const contest = await checkLaneContest(client, item);
-    if (contest.contested) throw new Error(withPowerShellChainHint(laneContestMessage(item.ref, contest, "unclaim")));
+    if (contest.contested) throw new Error(withGatedWriteChainHint(laneContestMessage(item.ref, contest, "unclaim")));
   }
   try {
     await client.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`, {
@@ -14100,7 +14099,7 @@ function expectedHosts(cfg) {
   if (cfg.fofuSubdomain !== void 0) {
     out.push(cfg.fofuSubdomain ? `${cfg.fofuSubdomain}.fofu.ai` : "fofu.ai");
   }
-  return uniq(out);
+  return uniq([...out, ...cfg.edgeHosts ?? []]);
 }
 function expectedJsOrigins(cfg) {
   return uniq([...expectedHosts(cfg).map((h) => `https://${h}`), ...LOOPBACK]);
@@ -14167,7 +14166,7 @@ function parseOauthConfig(mmiConfig, slug) {
   const meta = mmiConfig ?? {};
   const rawFofuSub = raw.fofuSubdomain;
   const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain(slug) : void 0;
-  return { subdomains, domains, callbackPath, extraCallbackPaths, fofuSubdomain };
+  return { subdomains, domains, callbackPath, extraCallbackPaths, fofuSubdomain, edgeHosts: Object.values(edgeDomainsByStage(mmiConfig)) };
 }
 function probeRedirectUri(callbackPath, port = 9123) {
   return `http://localhost:${port}${callbackPath}`;
@@ -14186,6 +14185,20 @@ function buildAuthorizeProbeUrl(clientId, redirectUri) {
 function authorizeBodyHasMismatch(body) {
   return /redirect_uri_mismatch/i.test(body);
 }
+async function probeOauthRedirects(cfg, clientId, request = fetch) {
+  const uris = uniq([probeRedirectUri(cfg.callbackPath), ...expectedRedirectUris(cfg)]);
+  const signal = AbortSignal.timeout(1e4);
+  const results = [];
+  for (let i = 0; i < uris.length; i += 4) {
+    results.push(...await Promise.all(uris.slice(i, i + 4).map(async (redirectUri) => {
+      const response = await request(buildAuthorizeProbeUrl(clientId, redirectUri), { redirect: "follow", signal });
+      const mismatch = authorizeBodyHasMismatch(await response.text());
+      if (!mismatch && !response.ok) throw new Error(`authorize probe returned HTTP ${response.status}`);
+      return { redirectUri, mismatch };
+    })));
+  }
+  return results;
+}
 
 // src/project-runtime.ts
 function hasRuntimeSecretContract(contract) {
@@ -15695,10 +15708,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.39",
-    tag: "v4.3.39",
-    commit: "cc67ff24bbec",
-    npm: "@mutmutco/cli@4.3.39"
+    version: "4.3.41",
+    tag: "v4.3.41",
+    commit: "02cc438cfbf4",
+    npm: "@mutmutco/cli@4.3.41"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15715,14 +15728,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.39"
+          v3Target: "v4.3.41"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.39 and redeploy the Hub Lambda from tag v4.3.39 (cc67ff24bbec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.39 (@mutmutco/cli@4.3.39, tag commit cc67ff24bbec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.41 and redeploy the Hub Lambda from tag v4.3.41 (02cc438cfbf4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.41 (@mutmutco/cli@4.3.41, tag commit 02cc438cfbf4 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -25957,7 +25970,7 @@ function registerBoardCommands(program3) {
     return `Claimed ${ref} for ${holder} - In Progress${reclaimed}`;
   }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
-  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nNever capture the JSON with a shell redirect on Windows: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
+  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   withExamples(mutating(
     board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n\nreclaim from In Review (#6339): an In Review item with no holder, or one held by the claiming\nlogin, is claimable \u2014 it moves back to In Progress and the receipt names the status it came from.\nAn In Review item another login holds is refused (ask the holder, or wait for the review to land),\nand Done stays refused. The board status is the authority; no PR state is consulted.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "oracle board claim", issues: args[0] ?? [] })
@@ -30097,6 +30110,18 @@ function stageComposeFileEnv(files) {
 // src/stage-runner.ts
 var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process11.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
+function stageBash() {
+  if (process.platform !== "win32") return "bash";
+  const configured = process.env.SHELL;
+  if (configured && (0, import_node_path27.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs28.existsSync)(configured)) return configured;
+  const candidates = [
+    (0, import_node_path27.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path27.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+  ];
+  const bash = candidates.find((path2) => (0, import_node_fs28.existsSync)(path2));
+  if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
+  return bash;
+}
 var EARLY_EXIT_GRACE_MS = 2e3;
 function earlyExitGraceMs() {
   if (process.env.NODE_ENV === "test") {
@@ -30287,24 +30312,6 @@ function mergeEnvSecretsIntoFile(content, secrets) {
   return body.endsWith("\n") ? body : `${body}
 `;
 }
-var POSIX_ONLY_VERBS = ["cp", "mv", "rm", "ln", "cat", "touch", "chmod", "export"];
-function posixOnlyShellProblems(command, field, platform2 = process.platform) {
-  if (platform2 !== "win32" || !command?.trim()) return [];
-  const problems = [];
-  if (/(^|&&|\||;)\s*[A-Za-z_][A-Za-z0-9_]*=\S/.test(command)) {
-    problems.push(
-      `stage.${field} uses POSIX inline env assignment (VAR=value command) which fails in cmd.exe on Windows; use 'set VAR=value && command' or a cross-platform launcher`
-    );
-  }
-  for (const verb of POSIX_ONLY_VERBS) {
-    if (new RegExp(`(^|&&|\\||;|\\()\\s*${verb}\\b`).test(command)) {
-      problems.push(
-        `stage.${field} calls POSIX '${verb}' which does not exist in cmd.exe on Windows; use the cmd/PowerShell equivalent or a cross-platform script`
-      );
-    }
-  }
-  return problems;
-}
 function validateStageConfig(config = {}, action) {
   const problems = [];
   if (action === "run" && !config.build?.trim() && !config.ensureEnv) problems.push("stage.build is required for stage run");
@@ -30312,8 +30319,6 @@ function validateStageConfig(config = {}, action) {
   if (config.healthUrl != null && config.healthUrl.trim() && !/^https?:\/\//.test(config.healthUrl.trim())) {
     problems.push("stage.healthUrl must be an http(s) URL");
   }
-  if (action === "run") problems.push(...posixOnlyShellProblems(config.build, "build"));
-  problems.push(...posixOnlyShellProblems(config.up, "up"));
   if (config.portRange != null) {
     const r = config.portRange;
     const ok = Array.isArray(r) && r.length === 2 && r.every((n) => Number.isInteger(n) && n >= 1024 && n <= 65535) && r[0] <= r[1];
@@ -30338,14 +30343,27 @@ function isPortFree(port) {
   });
 }
 async function shell(command, cwd, timeoutMs, env) {
-  await execFileP3(command, [], {
+  const execution = execFileP3(stageBash(), ["-c", command], {
     cwd,
-    shell: true,
-    timeout: timeoutMs,
+    timeout: process.platform === "win32" ? timeoutMs + 5e3 : timeoutMs,
     windowsHide: true,
     maxBuffer: 1024 * 1024 * 4,
     ...env ? { env: { ...process.env, ...env } } : {}
   });
+  let cleanup;
+  const timer = process.platform === "win32" ? setTimeout(() => {
+    cleanup = killTree(execution.child.pid ?? 0);
+  }, timeoutMs) : void 0;
+  try {
+    await execution;
+    if (cleanup) throw new Error(`stage command timed out after ${timeoutMs}ms`);
+  } catch (error) {
+    if (cleanup) throw new Error(`stage command timed out after ${timeoutMs}ms`, { cause: error });
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    await cleanup;
+  }
 }
 async function listDockerContainers() {
   const { stdout } = await execFileP3("docker", ["container", "ls", "--format", "{{json .}}"], {
@@ -30585,7 +30603,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
 async function killTree(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return;
   if (process.platform === "win32") {
-    await execFileP3("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }).catch(() => void 0);
+    await execFileP3("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, timeout: 5e3 }).catch(() => void 0);
     return;
   }
   try {
@@ -30651,6 +30669,7 @@ async function stopStage(opts = {}) {
   };
 }
 async function startStage(config = {}, opts = {}) {
+  const bash = stageBash();
   const problems = validateStageConfig(config, "start");
   if (problems.length) throw new Error(problems.join("; "));
   const cwd = opts.cwd ?? process.cwd();
@@ -30672,9 +30691,8 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child2 = (0, import_node_child_process11.spawn)(up, {
+  const child2 = (0, import_node_child_process11.spawn)(bash, ["-c", up], {
     cwd,
-    shell: true,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
     // `taskkill /T /F` (no group needed), and detached+shell defeats windowsHide — every spawn would
     // flash a Windows Terminal window (0x800700e8) on dev machines.
@@ -30728,6 +30746,7 @@ function stageEnvRefusal(cwd) {
   return `stage refuses to run: .env file(s) present in the repo (${envFiles.join(", ")}) \u2014 secrets belong in the Hub vault; delete the file(s) and re-run (#5908)`;
 }
 async function runStage(config = {}, opts = {}) {
+  stageBash();
   const problems = validateStageConfig(config, "run");
   if (problems.length) throw new Error(problems.join("; "));
   const cwd = opts.cwd ?? process.cwd();
@@ -36038,8 +36057,8 @@ var import_node_fs34 = require("node:fs");
 var import_node_path31 = require("node:path");
 
 // src/stage-default.ts
-function shellFor(platform2 = process.platform) {
-  return platform2 === "win32" ? "powershell" : "bash";
+function shellFor() {
+  return "bash";
 }
 function isCentralContainerModel(model) {
   return model === "tenant-container" || model === "solo-container";
@@ -36510,7 +36529,7 @@ function registerStageCommands(program3) {
       fail(`stage stop: ${e.message}`);
     }
   });
-  stage.command("start").description("start the configured local stage process and optionally wait for health").option("--json", "machine-readable output").option("--apply", "start the configured stage.up process").option("--port <port>", "loopback port for this worktree stage (1024..65535)").option("--timeout-ms <ms>", "bounded health timeout", "60000").option("--allow-stale-env", "start despite a stale ensureEnv target file").action(async () => {
+  stage.command("start").description("start the configured local stage process and optionally wait for health").option("--json", "machine-readable output").option("--apply", "start the configured stage.up process in Bash (Git Bash on Windows)").option("--port <port>", "loopback port for this worktree stage (1024..65535)").option("--timeout-ms <ms>", "bounded health timeout", "60000").option("--allow-stale-env", "start despite a stale ensureEnv target file").action(async () => {
     const o = { json: rawFlag("--json"), apply: rawFlag("--apply"), timeoutMs: rawValue("--timeout-ms", "60000"), allowStaleEnv: rawFlag("--allow-stale-env") };
     const { resolution: res, project: project2, cfg: stageCfg } = await resolveStage();
     if (!o.apply) {
@@ -45554,22 +45573,22 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
     return failGraceful("org oauth verify: no client_id (pass --client-id, or provision the repo so GOOGLE_CLIENT_ID exists)");
   }
   const redirectUri = probeRedirectUri(oc.callbackPath);
-  let body = "";
+  let probes;
   try {
-    const res = await fetch(buildAuthorizeProbeUrl(clientId, redirectUri), { redirect: "follow", signal: AbortSignal.timeout(1e4) });
-    body = await res.text();
+    probes = await probeOauthRedirects(oc, clientId);
   } catch (e) {
     return failGraceful(`org oauth verify: probe request failed: ${e.message}`);
   }
-  const mismatch = authorizeBodyHasMismatch(body);
+  const portAgnostic = !probes[0].mismatch;
+  const mismatches = probes.filter((probe) => probe.mismatch);
   if (o.json) {
-    console.log(JSON.stringify({ slug, redirectUri, portAgnostic: !mismatch }));
-  } else if (mismatch) {
-    console.error(`FAIL ${slug}: redirect_uri_mismatch for ${redirectUri} \u2014 client is not port-agnostic (run /oauth-provision)`);
+    console.log(JSON.stringify({ slug, redirectUri, portAgnostic, probes }));
+  } else if (mismatches.length) {
+    for (const probe of mismatches) console.error(`FAIL ${slug}: redirect_uri_mismatch for ${probe.redirectUri} \u2014 run /oauth-provision`);
   } else {
-    console.log(`PASS ${slug}: ${redirectUri} accepted \u2014 port-agnostic OAuth is live`);
+    console.log(`PASS ${slug}: no redirect_uri_mismatch across ${probes.length} callbacks, including the arbitrary-port loopback`);
   }
-  if (mismatch) process.exitCode = 1;
+  if (mismatches.length) process.exitCode = 1;
 });
 registerCollaborationCommands(program2);
 function ciAuditDeps2() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.39",
+  "version": "4.3.41",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",