@mutmutco/cli 4.3.68 → 4.4.1

package/dist/main.cjs

@@ -6380,7 +6380,7 @@ function decorateAwsModel(entries, registry2, verdicts) {
   });
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli devops runtime box get <box> --ssh)" },
+  { name: "mmi-backup (mm-central, mm-work, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli devops runtime box get <box> --ssh)" },
   // #3370/#6270: the one runner hygiene layer (runner-hygiene.yml was folded in and deleted). A workflow ran ON the runner and needed checkout +
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
@@ -9439,6 +9439,18 @@ function resolveUseEnvNames(keys, name) {
   }
   return { ok: true, entries };
 }
+function referencesDollarEnv(arg, name) {
+  return arg.includes(`\${${name}}`) || new RegExp(`\\$${name}(?![A-Za-z0-9_])`).test(arg);
+}
+function secretsUseDollarHint(command, envNames) {
+  for (const arg of command) {
+    for (const name of envNames) {
+      if (!referencesDollarEnv(arg, name)) continue;
+      return `secrets use: $${name} is injected into the CHILD's env, not your shell \u2014 the caller expanded it (empty) before this ran. Wrap the consumer so expansion happens inside: bash -c 'your-command "$${name}"'`;
+    }
+  }
+  return null;
+}
 var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
@@ -9490,6 +9502,8 @@ async function secretsUse(deps, keys, opts) {
     deps.err(named.error);
     return false;
   }
+  const dollarHint = secretsUseDollarHint(command, named.entries.map((e) => e.envName));
+  if (dollarHint) deps.err(dollarHint);
   const repo = await targetRepo(deps, opts);
   const slug = opts.slug?.toLowerCase();
   const env = { ...process.env };
@@ -14238,9 +14252,6 @@ function expectedHosts(cfg) {
       for (const env of ENV_PREFIXES) out.push(env ? `${env}.${base}` : base);
     }
   }
-  if (cfg.fofuSubdomain !== void 0) {
-    out.push(cfg.fofuSubdomain ? `${cfg.fofuSubdomain}.fofu.ai` : "fofu.ai");
-  }
   return uniq([...out, ...cfg.edgeHosts ?? []]);
 }
 function expectedJsOrigins(cfg) {
@@ -14305,10 +14316,7 @@ function parseOauthConfig(mmiConfig, slug) {
     );
   }
   const extraCallbackPaths = parseExtraCallbackPaths(raw.extraCallbackPaths);
-  const meta = mmiConfig ?? {};
-  const rawFofuSub = raw.fofuSubdomain;
-  const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain(slug) : void 0;
-  return { subdomains, domains, callbackPath, extraCallbackPaths, fofuSubdomain, edgeHosts: Object.values(edgeDomainsByStage(mmiConfig)) };
+  return { subdomains, domains, callbackPath, extraCallbackPaths, edgeHosts: Object.values(edgeDomainsByStage(mmiConfig)) };
 }
 function probeRedirectUri(callbackPath, port = 9123) {
   return `http://localhost:${port}${callbackPath}`;
@@ -15862,10 +15870,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.68",
-    tag: "v4.3.68",
-    commit: "e9edc6e353ec",
-    npm: "@mutmutco/cli@4.3.68"
+    version: "4.4.1",
+    tag: "v4.4.1",
+    commit: "a4bb2ac4bdb4",
+    npm: "@mutmutco/cli@4.4.1"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15882,14 +15890,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.68"
+          v3Target: "v4.4.1"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.68 and redeploy the Hub Lambda from tag v4.3.68 (e9edc6e353ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.68 (@mutmutco/cli@4.3.68, tag commit e9edc6e353ec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.4.1 and redeploy the Hub Lambda from tag v4.4.1 (a4bb2ac4bdb4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.4.1 (@mutmutco/cli@4.4.1, tag commit a4bb2ac4bdb4 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -15986,12 +15994,6 @@ var rollout_plan_default = {
           schedule: "train",
           v3Target: "v0.3.0"
         },
-        {
-          repo: "mutmutco/mm-fofu",
-          role: "member",
-          schedule: "train",
-          v3Target: "v0.1.0"
-        },
         {
           repo: "mutmutco/mmi-junior",
           role: "member",
@@ -21626,6 +21628,9 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
 function supersedeablePublishLegShape(rec) {
   return rec.state === "failed" || rec.state === "pending" && rec.runId == null;
 }
+function deferredGatewayDeployLegShape(rec) {
+  return rec.state === "pending" && rec.runId == null && rec.workflow === "jerv-gateway";
+}
 async function supersedeContentCausedPublishLeg(deps, cwd) {
   const path2 = releaseLedgerPath(cwd);
   return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
@@ -21651,7 +21656,9 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       const closed = await alignmentLegClosedLive(deps, prior);
       if (closed) phases.alignment = closed;
     }
-    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "deploy", "alignment"].filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
+    let gatewayDeploy;
+    const deferredGateway = isJervHubRepo(prior.repo) && deferredGatewayDeployLegShape(phases.deploy);
+    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "deploy", "alignment"].filter((phase) => !(phase === "deploy" && deferredGateway)).filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
     if (unresolved.length > 0) {
       throw new Error(
         `release --supersede-publish: ${prior.tag} has unresolved legs besides publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the supersession closes only the publish leg of an otherwise-complete release; resolve those first, nothing was written (#6638)`
@@ -21704,6 +21711,25 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
         note: `closed the deleted ${prior.tag} publish failure by archiving its ledger after origin and GitHub both proved absent; start a fresh release train to carry the cause fix`
       };
     }
+    if (deferredGateway) {
+      const dispatch = await appendJervGatewayReleaseDeploy(
+        deps,
+        prior.repo,
+        prior.tag,
+        prior.tagSha,
+        { note: `Jerv Gateway operator-host deploy leg for ${prior.tag} run during the publish supersession`, deployStatus: "success" }
+      );
+      phases.deploy = {
+        ...phaseEntry(deployPhaseInput("registry-publish", dispatch, { releaseSha: prior.tagSha })),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      if (dispatch.deployStatus !== "success") {
+        throw new Error(
+          `release --supersede-publish: the deferred ${prior.tag} Jerv Gateway operator-host deploy leg did not verify (${dispatch.note}) \u2014 run \`scripts/jerv-gateway-release-deploy.sh --tag ${prior.tag}\` to a healthy receipt naming the released tag and commit, then retry; nothing was written (#6742)`
+        );
+      }
+      gatewayDeploy = { workflow: "jerv-gateway", state: "complete", note: dispatch.note };
+    }
     const note = `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6638)`;
     atomicWriteJson(path2, {
       ...prior,
@@ -21718,7 +21744,8 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       repo: prior.repo,
       tag: prior.tag,
       tagSha: prior.tagSha,
-      note: `closed the ${prior.tag} publish leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix`
+      note: `closed the ${prior.tag} publish leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix`,
+      ...gatewayDeploy ? { gatewayDeploy } : {}
     };
   });
 }
@@ -29667,12 +29694,12 @@ function registerDeployCommands(program3) {
 init_cli_shared();
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
-var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
+var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
 function previewRegistryMetaMerge(existing, patch) {
   const out = { ...existing ?? {} };
   for (const [key, value] of Object.entries(patch)) {
@@ -29868,7 +29895,7 @@ function parseOauthVar(raw) {
     throw new Error(`org project set: oauth must be JSON, e.g. {"subdomains":["app"],"domains":["example.co"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}`);
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("org project set: oauth must be a {subdomains,domains,callbackPath,extraCallbackPaths,fofuSubdomain} object");
+    throw new Error("org project set: oauth must be a {subdomains,domains,callbackPath,extraCallbackPaths} object");
   }
   const map = parsed;
   const out = {};
@@ -29896,11 +29923,8 @@ function parseOauthVar(raw) {
       } catch (e) {
         throw new Error(`org project set: ${e.message}`);
       }
-    } else if (key === "fofuSubdomain") {
-      if (typeof value !== "string") throw new Error('org project set: oauth.fofuSubdomain must be a string ("" selects the apex fofu.ai)');
-      out.fofuSubdomain = value.trim();
     } else {
-      throw new Error(`org project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/extraCallbackPaths/fofuSubdomain`);
+      throw new Error(`org project set: oauth key "${key}" \u2014 expected only subdomains/domains/callbackPath/extraCallbackPaths`);
     }
   }
   return out;
@@ -29922,11 +29946,6 @@ function parsePublishRequiredVar(raw) {
   if (raw === "false") return false;
   throw new Error("org project set: publishRequired must be true or false");
 }
-function parseFofuEnabledVar(raw) {
-  if (raw === "true") return true;
-  if (raw === "false") return false;
-  throw new Error("org project set: fofuEnabled must be true or false");
-}
 function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
@@ -30084,7 +30103,6 @@ var SETTABLE_VAR_KEYS = [
   "releaseChannel",
   "releaseLanguage",
   "dsManifestPath",
-  "fofuEnabled",
   "consumesDesignSystem",
   "runtimeVaultOnly",
   "requiredGcpApis",
@@ -30113,12 +30131,11 @@ var SETTABLE_VAR_HINTS = {
   releaseChannel: "Slack channel id, e.g. C0BE0BRGAT0",
   releaseLanguage: "2-letter language code for release notes, e.g. tr (default en)",
   dsManifestPath: "relative path to a package.json, e.g. web/package.json",
-  fofuEnabled: "true|false",
   consumesDesignSystem: '"fofu"',
   runtimeVaultOnly: "true|false",
   seedCanary: "true|false",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
-  oauth: "JSON {subdomains,domains,callbackPath,extraCallbackPaths,fofuSubdomain}",
+  oauth: "JSON {subdomains,domains,callbackPath,extraCallbackPaths}",
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
@@ -30214,8 +30231,6 @@ function buildProjectSetPatch(input) {
       patch[key] = parseReposVar(raw);
     } else if (key === "publishRequired") {
       patch[key] = parsePublishRequiredVar(raw);
-    } else if (key === "fofuEnabled") {
-      patch[key] = parseFofuEnabledVar(raw);
     } else if (key === "runtimeVaultOnly") {
       patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "seedCanary") {
@@ -36752,7 +36767,7 @@ async function runStageLiveDown(deps, t) {
 var GITHUB_PACKAGES_TOKEN_REF = "@github-packages-token";
 var ENV_ID_RE = /^[A-Z_][A-Z0-9_]*$/;
 var BARE_VAULT_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
-var CROSS_SLUG_REF_RE = /^(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*$/;
+var CROSS_SLUG_REF_RE = /^(?:_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*$/;
 function parseStageBuildSecretEntry(entry) {
   const trimmed = entry.trim();
   if (!trimmed) return null;
@@ -36824,7 +36839,6 @@ async function fetchVaultRef(fetchVault, ref) {
   if (colon === -1) return fetchVault(ref);
   const prefix = ref.slice(0, colon);
   const key = ref.slice(colon + 1);
-  if (prefix === "mm-fofu") return fetchVault(key, { slug: "mm-fofu" });
   if (prefix.startsWith("_org/")) {
     const provider = prefix.slice("_org/".length);
     return fetchVault(`${provider}/${key}`, { slug: "_org" });
@@ -42014,7 +42028,7 @@ function formatBoxTable(boxes) {
   }
   return lines2.join("\n");
 }
-function formatSshRecipe(box) {
+function formatSshRecipe(box, remoteCommand) {
   if (!box.address) {
     return `box ${box.name} has no public IPv4 \u2014 it is not directly reachable over ssh.`;
   }
@@ -42028,13 +42042,21 @@ function formatSshRecipe(box) {
     "  --with-decryption --query Parameter.Value --output text --region eu-central-1 \\",
     `  | tr -d '\\r' > "$kf"`,
     'test -s "$kf"       # never hand ssh an empty key file',
-    `ssh -i "$kf" -o StrictHostKeyChecking=accept-new root@${box.address} 'hostname; uptime'`
+    `ssh -i "$kf" -o StrictHostKeyChecking=accept-new root@${box.address} ${shellSingleQuote(sshRemoteCommand(remoteCommand))}`
   ].join("\n");
 }
+var SSH_DEFAULT_PROBE = "hostname; uptime";
+function sshRemoteCommand(remoteCommand) {
+  const trimmed = remoteCommand?.trim();
+  return trimmed ? trimmed : SSH_DEFAULT_PROBE;
+}
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 var SSH_RECIPE_AGENT_NOTE = "# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli devops runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.";
-function sshRecipeScript(box) {
+function sshRecipeScript(box, remoteCommand) {
   return `#!/usr/bin/env bash
-${formatSshRecipe(box)}
+${formatSshRecipe(box, remoteCommand)}
 `;
 }
 
@@ -42109,7 +42131,7 @@ function registerBoxCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  box.command("get <name>").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, o) => {
+  box.command("get <name> [command...]").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (materializes the key to a temp file; never echoes it)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, command, o) => {
     try {
       const { boxes, incomplete } = await fetchInventory();
       const result = lookupBox(name, boxes, incomplete);
@@ -42129,8 +42151,9 @@ function registerBoxCommands(program3) {
         await failGraceful("runtime box get: --script requires --ssh (it writes the ssh connect recipe)");
         return;
       }
+      const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs42.writeFileSync)(wroteScript, sshRecipeScript(found), "utf8");
+      if (wroteScript) (0, import_node_fs42.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -42138,7 +42161,7 @@ function registerBoxCommands(program3) {
           ...wroteScript ? { script: { path: wroteScript, run: `bash "${wroteScript}"` } } : {}
         }, null, 2));
       } else if (wroteScript) console.log(`wrote ${wroteScript} \u2014 run: bash "${wroteScript}"`);
-      else if (o.ssh) console.log(`${formatSshRecipe(found)}
+      else if (o.ssh) console.log(`${formatSshRecipe(found, remote)}
 ${SSH_RECIPE_AGENT_NOTE}`);
       else console.log(formatBoxTable([found]));
       if (!o.json) warnIncomplete2(incomplete);
@@ -44615,7 +44638,8 @@ function renderReleaseSupersedeDeploy(r) {
   return `mmi-cli devops release --supersede-deploy --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
 }
 function renderReleaseSupersedePublish(r) {
-  return `mmi-cli devops release --supersede-publish --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+  const base = `mmi-cli devops release --supersede-publish --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+  return r.gatewayDeploy ? `${base}; the deferred Jerv Gateway operator-host deploy leg was run and verified during the supersession (jerv-gateway=complete): ${r.gatewayDeploy.note}` : base;
 }
 function renderReleasePublishRetry(r) {
   return `mmi-cli devops release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
@@ -44847,7 +44871,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
       { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
       { flags: "--supersede-deploy", description: "with --apply, master-approved closure of a content-caused failed deploy leg on a PUBLISHED release whose immutable tag can never deploy green \u2014 the next patch train then carries the fix (#6553)" },
-      { flags: "--supersede-publish", description: "with --apply, master-approved closure of a content-caused failed publish leg on a fully PROMOTED release whose immutable tag can never publish green \u2014 the next patch train then carries the fix (#6638)" },
+      { flags: "--supersede-publish", description: "with --apply, master-approved closure of a content-caused failed publish leg on a fully PROMOTED release whose immutable tag can never publish green \u2014 a deferred Jerv-Hub operator-host Gateway deploy leg is run and verified as part of the closure \u2014 the next patch train then carries the fix (#6638/#6742)" },
       { flags: "--retry-publish <run-id>", description: "with --apply, retry one proven failed or cancelled Hub publish release run (#3949/#5797)" }
     ];
     for (const f of RELEASE_ONLY_FLAGS) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.68",
+  "version": "4.4.1",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",