@mutmutco/cli 4.3.8 → 4.3.10

package/dist/main.cjs

@@ -5226,7 +5226,7 @@ function unknownCommandDomainGuide(parentPath, token) {
 }
 
 // src/command-composition.ts
-var import_node_os20 = require("node:os");
+var import_node_os21 = require("node:os");
 var import_node_path46 = require("node:path");
 
 // src/board-read.ts
@@ -15450,10 +15450,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.8",
-    tag: "v4.3.8",
-    commit: "b109b86b97d1",
-    npm: "@mutmutco/cli@4.3.8"
+    version: "4.3.10",
+    tag: "v4.3.10",
+    commit: "6fe2720dc6ef",
+    npm: "@mutmutco/cli@4.3.10"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15470,14 +15470,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.8"
+          v3Target: "v4.3.10"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.8 and redeploy the Hub Lambda from tag v4.3.8 (b109b86b97d1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.8 (@mutmutco/cli@4.3.8, tag commit b109b86b97d1 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.10 and redeploy the Hub Lambda from tag v4.3.10 (6fe2720dc6ef); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.10 (@mutmutco/cli@4.3.10, tag commit 6fe2720dc6ef \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19012,6 +19012,7 @@ Resume it:  ${resumeCommand}
 
 // src/train-doctor.ts
 var import_node_fs23 = require("node:fs");
+var import_node_os13 = require("node:os");
 var import_node_path22 = require("node:path");
 
 // src/doctor-io.ts
@@ -21119,6 +21120,30 @@ function readLocalWorkflowsDefault(root) {
   }
   return files;
 }
+var NPM_REGISTRY = "https://registry.npmjs.org";
+async function probeRegistryWhoami(train) {
+  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path22.join)((0, import_node_os13.tmpdir)(), "mmi-npmrc-"));
+  const rc = (0, import_node_path22.join)(dir, "npmrc");
+  try {
+    (0, import_node_fs23.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
+    await train.runSelf(["secrets", "use", "npm/NPM_TOKEN", "--slug", "_org", "--", "npm", "whoami", "--registry", NPM_REGISTRY, "--userconfig", rc]);
+    return { kind: "ok", detail: "the registry answered a login" };
+  } catch (e) {
+    const err = e;
+    const stderr = typeof err.stderr === "string" ? err.stderr : "";
+    const first = (clean2(stderr) || message(e)).split("\n")[0] ?? "";
+    if (err.code === SECRETS_USE_WRAPPER_EXIT_CODE) return { kind: "unprobed", detail: first };
+    if (/\bE401\b|401 Unauthorized/.test(stderr)) return { kind: "rejected", detail: "npm whoami answered 401 Unauthorized" };
+    return { kind: "unverified", detail: first };
+  } finally {
+    (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
+  }
+}
+var REGISTRY_TOKEN_ENV = /\b(NODE_AUTH_TOKEN|NPM_TOKEN)\b/;
+function publishesViaTrustedPublisher(workflows) {
+  if (!workflows?.length) return false;
+  return workflows.some((f) => /\bid-token:\s*write\b/.test(f.body)) && !workflows.some((f) => REGISTRY_TOKEN_ENV.test(f.body));
+}
 var defaultDeps2 = {
   cliVersion: resolveClientVersion,
   fetchReleasedVersion: fetchNpmReleasedVersion,
@@ -21136,6 +21161,14 @@ var defaultDeps2 = {
     }
   },
   healAlignmentLeg: healStaleAlignmentLeg,
+  readSurfacesRaw: (cwd) => {
+    try {
+      return (0, import_node_fs23.readFileSync)((0, import_node_path22.join)(cwd, "surfaces.json"), "utf8");
+    } catch {
+      return void 0;
+    }
+  },
+  registryWhoami: probeRegistryWhoami,
   env: process.env
 };
 function message(e) {
@@ -21413,6 +21446,18 @@ async function runTrainDoctor(input) {
       add({ code: "npm-major-mismatch", severity: "blocker", source: "local", title: "local npm major differs from the npm CI declares (#5666)", remedy: message(e) });
     }
   }
+  if (/"publishVisibility"\s*:\s*"private"/.test(deps.readSurfacesRaw(cwd) ?? "")) {
+    const probe = await deps.registryWhoami(train);
+    if (probe.kind === "rejected" && publishesViaTrustedPublisher(workflows)) {
+      add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; no lane of this repo consumes it (its workflows publish through OIDC Trusted Publishing and name no registry token)`, remedy: "nothing on the release path. It affects only a manual `npm view` of a restricted package made through the `_org` hop, which 404s exactly like an absent one until the token is rotated (`mmi-cli vault secrets set npm/NPM_TOKEN --slug _org`). If this repo verifies through a different vault entry, this row does not describe that hop (#6187)" });
+    } else if (probe.kind === "rejected") {
+      add({ code: "npm-token-rejected", severity: "warning", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; every authenticated \`npm view\` of a restricted package will 404 exactly like an absent one`, remedy: 'rotate the org token: mint a fresh npm automation token, store it with `mmi-cli vault secrets set npm/NPM_TOKEN --slug _org` (master or an exact grant), and rerun. Until whoami answers a login, a restricted-package 404 proves nothing \u2014 never read it as "not published" (#6184)' });
+    } else if (probe.kind === "unprobed") {
+      add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token was not probed (no _org npm/NPM_TOKEN grant, or a vault error): ${probe.detail}`, remedy: "nothing here \u2014 the release does not depend on it (CI publishes through OIDC Trusted Publishing). Before verifying a private publish by hand, run the whoami probe from an account holding the `_org` npm/NPM_TOKEN grant" });
+    } else if (probe.kind === "unverified") {
+      unverified("the vault npm token (`npm whoami` through the `_org` npm/NPM_TOKEN hop)", probe.detail);
+    }
+  }
   try {
     await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   } catch (e) {
@@ -25576,7 +25621,7 @@ function registerBoardCommands(program3) {
 
 // src/bootstrap-commands.ts
 var import_node_fs26 = require("node:fs");
-var import_node_os13 = require("node:os");
+var import_node_os14 = require("node:os");
 var import_node_path25 = require("node:path");
 
 // src/command-plans.ts
@@ -27428,7 +27473,7 @@ function registerBootstrapCommands(program3) {
     const readFile9 = (p) => (0, import_node_fs26.existsSync)(p) ? (0, import_node_fs26.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path25.join)((0, import_node_os13.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path25.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
@@ -28027,7 +28072,7 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path25.join)((0, import_node_os13.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path25.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
         (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
@@ -28202,7 +28247,7 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path25.join)((0, import_node_os13.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path25.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
@@ -29946,7 +29991,7 @@ async function collectWaveStatus(deps) {
 
 // src/discovery-commands.ts
 var import_node_fs30 = require("node:fs");
-var import_node_os14 = require("node:os");
+var import_node_os15 = require("node:os");
 var import_node_path28 = require("node:path");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function collectStatus() {
@@ -30135,7 +30180,7 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os14.homedir)();
+  const home = (0, import_node_os15.homedir)();
   const plugin = onboardPluginGate({
     readKnown: () => readFileSyncSafe((0, import_node_path28.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs30.readFileSync),
     readSettings: () => readFileSyncSafe((0, import_node_path28.join)(home, ".claude", "settings.json"), import_node_fs30.readFileSync)
@@ -32084,7 +32129,7 @@ var import_node_fs31 = require("node:fs");
 var import_node_crypto9 = require("node:crypto");
 
 // src/issue-body.ts
-var import_node_os15 = require("node:os");
+var import_node_os16 = require("node:os");
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
     super(message2);
@@ -32096,7 +32141,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os15.platform)() === "win32") {
+  if ((0, import_node_os16.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -34593,7 +34638,7 @@ function registerSchedulesCommands(program3) {
 // src/secrets-commands.ts
 var import_node_fs33 = require("node:fs");
 var import_node_path30 = require("node:path");
-var import_node_os16 = require("node:os");
+var import_node_os17 = require("node:os");
 
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
@@ -34716,7 +34761,7 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path30.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path30.join)((0, import_node_os17.tmpdir)(), "mmi-rails-decrypt-"));
   const scriptPath = (0, import_node_path30.join)(scriptDir, "decrypt.rb");
   (0, import_node_fs33.writeFileSync)(scriptPath, script, "utf8");
   try {
@@ -36007,7 +36052,7 @@ async function runPrLand(prNumber, options, deps) {
 // src/merge-cleanup.ts
 var import_node_fs37 = require("node:fs");
 var import_node_path34 = require("node:path");
-var import_node_os17 = require("node:os");
+var import_node_os18 = require("node:os");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -37045,7 +37090,7 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os17.tmpdir)(), "mmi-squash-body-"));
+  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
   const path2 = (0, import_node_path34.join)(dir, "body.txt");
   (0, import_node_fs37.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
@@ -37611,13 +37656,13 @@ var import_node_path38 = require("node:path");
 
 // src/jervcode-node-modules-cleanup.ts
 var import_node_fs39 = require("node:fs");
-var import_node_os18 = require("node:os");
+var import_node_os19 = require("node:os");
 var import_node_path36 = require("node:path");
 var JERVCODE_PACKAGE_ENTRY = (0, import_node_path36.join)("node_modules", "@jervaise", "jervcode", "dist", "launcher-entry.js");
 var WIN_NAMES2 = ["jervcode.cmd", "jervcode"];
 var POSIX_NAMES2 = ["jervcode"];
 var NODE_MODULES_CLEANUP_TIMEOUT_MS = 3e5;
-function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os18.homedir)(), platform2 = process.platform) {
+function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os19.homedir)(), platform2 = process.platform) {
   const names = platform2 === "win32" ? WIN_NAMES2 : POSIX_NAMES2;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
@@ -37625,7 +37670,7 @@ function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os18.h
   }
   return out;
 }
-function resolveJervcodePath(env = process.env, home = (0, import_node_os18.homedir)(), platform2 = process.platform, exists = import_node_fs39.existsSync) {
+function resolveJervcodePath(env = process.env, home = (0, import_node_os19.homedir)(), platform2 = process.platform, exists = import_node_fs39.existsSync) {
   for (const candidate of jervcodeCandidatePaths(env, home, platform2)) {
     if (exists(candidate)) return candidate;
   }
@@ -37634,7 +37679,7 @@ function resolveJervcodePath(env = process.env, home = (0, import_node_os18.home
 function jervcodeExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
   const exists = opts.exists ?? import_node_fs39.existsSync;
-  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os18.homedir)(), platform2, exists);
+  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os19.homedir)(), platform2, exists);
   if (resolved) {
     const entry = (0, import_node_path36.join)((0, import_node_path36.join)(resolved, ".."), JERVCODE_PACKAGE_ENTRY);
     if (exists(entry)) {
@@ -40223,7 +40268,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 var import_node_child_process16 = require("node:child_process");
 var import_node_crypto12 = require("node:crypto");
 var import_node_fs45 = require("node:fs");
-var import_node_os19 = require("node:os");
+var import_node_os20 = require("node:os");
 var import_node_path41 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
@@ -40374,7 +40419,7 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path41.join)((0, import_node_os19.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path41.join)((0, import_node_os20.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
     const cliOut = (0, import_node_path41.join)(stage, "cli-dist");
@@ -43058,7 +43103,7 @@ function envHealLockPath(home) {
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os20.homedir)()),
+      envHealLockPath((0, import_node_os21.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -43154,7 +43199,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os20.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -43182,7 +43227,7 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os20.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
@@ -44320,7 +44365,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os20.homedir)(),
+    (0, import_node_os21.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.8",
+  "version": "4.3.10",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",