@mutmutco/cli 4.3.9 → 4.3.11

package/dist/main.cjs

@@ -10515,7 +10515,14 @@ var SESSION_ID_ENV_VARS = [
   "CODEX_THREAD_ID",
   "CURSOR_SESSION_ID",
   "HERMES_SESSION_ID",
-  "PI_SESSION_ID"
+  "PI_SESSION_ID",
+  // #6193: lane runners spawn the CLI through the host's extension shell operations, which strip
+  // the PI_* session variables; the JervCode launcher's durable lane id (JERV_SESSION_ID) is what
+  // survives in that env. Read it LAST so interactive invocations keep their own PI_SESSION_ID and
+  // a stripped spawn still resolves to its owning lane — otherwise the actor degrades to a
+  // synth/shell identity and the claim guard contests the caller's OWN lane (the #3414/#3438
+  // refusals of jerv_worktree_land's `devops pr create` from the claimed task worktree).
+  "JERV_SESSION_ID"
 ];
 var SYNTH_SESSION_PREFIX = "synth-";
 function isHostSessionId(session) {
@@ -12048,6 +12055,11 @@ async function postIssueComment(client, input) {
 
 // src/board-claim-move.ts
 var CLAIM_CONCURRENCY = 5;
+function withPowerShellChainHint(message2, platform2 = process.platform) {
+  if (platform2 !== "win32") return message2;
+  return `${message2}
+note: in PowerShell a ';' chain runs every statement regardless of the previous exit code, so the chain ran past this refusal \u2014 rerun the refused write solo or chain gated writes with '&&'`;
+}
 async function moveBoardItem(options, deps = {}) {
   if (!BOARD_STATUSES.includes(options.status)) {
     throw new Error(`unknown status '${options.status}'; expected one of ${BOARD_STATUSES.join(", ")}`);
@@ -12209,7 +12221,7 @@ async function claimOneBoardItem(ctx, selector, options) {
       }
       return;
     }
-    if (!options.force) throw new Error(laneContestMessage(item.ref, contest, "claim"));
+    if (!options.force) throw new Error(withPowerShellChainHint(laneContestMessage(item.ref, contest, "claim")));
     previousHolder = displaced();
   };
   await refuseIfContested();
@@ -12392,7 +12404,7 @@ async function unclaimBoardIssue(options, deps = {}) {
   const toStatus = options.toStatus ?? "Todo";
   if (!options.force && item.contentType === "Issue") {
     const contest = await checkLaneContest(client, item);
-    if (contest.contested) throw new Error(laneContestMessage(item.ref, contest, "unclaim"));
+    if (contest.contested) throw new Error(withPowerShellChainHint(laneContestMessage(item.ref, contest, "unclaim")));
   }
   try {
     await client.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`, {
@@ -15450,10 +15462,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.9",
-    tag: "v4.3.9",
-    commit: "64fc1be95e37",
-    npm: "@mutmutco/cli@4.3.9"
+    version: "4.3.11",
+    tag: "v4.3.11",
+    commit: "c898259b41c3",
+    npm: "@mutmutco/cli@4.3.11"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15470,14 +15482,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.9"
+          v3Target: "v4.3.11"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.9 and redeploy the Hub Lambda from tag v4.3.9 (64fc1be95e37); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.9 (@mutmutco/cli@4.3.9, tag commit 64fc1be95e37 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.11 and redeploy the Hub Lambda from tag v4.3.11 (c898259b41c3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.11 (@mutmutco/cli@4.3.11, tag commit c898259b41c3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21139,6 +21151,11 @@ async function probeRegistryWhoami(train) {
     (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
   }
 }
+var REGISTRY_TOKEN_ENV = /\b(NODE_AUTH_TOKEN|NPM_TOKEN)\b/;
+function publishesViaTrustedPublisher(workflows) {
+  if (!workflows?.length) return false;
+  return workflows.some((f) => /\bid-token:\s*write\b/.test(f.body)) && !workflows.some((f) => REGISTRY_TOKEN_ENV.test(f.body));
+}
 var defaultDeps2 = {
   cliVersion: resolveClientVersion,
   fetchReleasedVersion: fetchNpmReleasedVersion,
@@ -21443,7 +21460,9 @@ async function runTrainDoctor(input) {
   }
   if (/"publishVisibility"\s*:\s*"private"/.test(deps.readSurfacesRaw(cwd) ?? "")) {
     const probe = await deps.registryWhoami(train);
-    if (probe.kind === "rejected") {
+    if (probe.kind === "rejected" && publishesViaTrustedPublisher(workflows)) {
+      add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; no lane of this repo consumes it (its workflows publish through OIDC Trusted Publishing and name no registry token)`, remedy: "nothing on the release path. It affects only a manual `npm view` of a restricted package made through the `_org` hop, which 404s exactly like an absent one until the token is rotated (`mmi-cli vault secrets set npm/NPM_TOKEN --slug _org`). If this repo verifies through a different vault entry, this row does not describe that hop (#6187)" });
+    } else if (probe.kind === "rejected") {
       add({ code: "npm-token-rejected", severity: "warning", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; every authenticated \`npm view\` of a restricted package will 404 exactly like an absent one`, remedy: 'rotate the org token: mint a fresh npm automation token, store it with `mmi-cli vault secrets set npm/NPM_TOKEN --slug _org` (master or an exact grant), and rerun. Until whoami answers a login, a restricted-package 404 proves nothing \u2014 never read it as "not published" (#6184)' });
     } else if (probe.kind === "unprobed") {
       add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token was not probed (no _org npm/NPM_TOKEN grant, or a vault error): ${probe.detail}`, remedy: "nothing here \u2014 the release does not depend on it (CI publishes through OIDC Trusted Publishing). Before verifying a private publish by hand, run the whoami probe from an account holding the `_org` npm/NPM_TOKEN grant" });
@@ -33475,6 +33494,10 @@ async function fetchBranchTipSha(repo, ref, gh = defaultGhApi) {
 async function fetchRestPrSnapshot(prNumber, repo, gh = defaultGhApi) {
   return parseRestPrSnapshot(JSON.parse(await gh([`repos/${repo}/pulls/${prNumber}`])));
 }
+async function fetchRestRepoMergeSettings(repo, gh = defaultGhApi) {
+  const payload = JSON.parse(await gh([`repos/${repo}`]));
+  return typeof payload.delete_branch_on_merge === "boolean" ? { deleteBranchOnMerge: payload.delete_branch_on_merge } : {};
+}
 var PR_SNAPSHOT_READ_RETRIES = 3;
 var PR_SNAPSHOT_READ_DELAY_MS = 2e3;
 async function readRestPrSnapshotWithRetry(prNumber, repo, gh = defaultGhApi, options) {
@@ -39643,8 +39666,8 @@ ${list}`);
     if (closingGuardVerdict.message) console.warn(closingGuardVerdict.message);
     if (prMeta.state !== "MERGED" && !o.preserveWorktree) {
       if (!repoForPostCleanup) throw new Error("pr merge: repository is unreadable; cannot prove remote branch preservation");
-      const repoSettings = await defaultGitHubClient().rest("GET", `repos/${repoForPostCleanup}`);
-      assertRemoteBranchPreservedOnMerge(repoForPostCleanup, repoSettings.delete_branch_on_merge);
+      const repoSettings = await fetchRestRepoMergeSettings(repoForPostCleanup);
+      assertRemoteBranchPreservedOnMerge(repoForPostCleanup, repoSettings.deleteBranchOnMerge);
     }
     const startingPath = (await execFileP("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
     const housekeeping = assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr merge", { force: o.force });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.9",
+  "version": "4.3.11",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",