@mutmutco/cli 4.5.136 → 4.5.138

package/dist/main.cjs

@@ -14682,7 +14682,9 @@ async function claimOneBoardItem(ctx, selector, options) {
   const wouldWrite = flatItem.assignees.length === 0 && (flatItem.status === "Todo" || flatItem.status === "In Progress" || flatItem.status === "In Review");
   if (wouldWrite && !ctx.writable.has(flatItem.repository.toLowerCase())) {
     throw new NotClaimableError(
-      `${flatItem.ref} is not claimable: the token from ${describeTokenSource()} reports no write access to ${flatItem.repository}`,
+      // #8245: name the real source. With a Hub snapshot the probe is the Hub's server-side check for the
+      // session login, not the local gh token, so `gh repo view --json viewerPermission` can disagree.
+      `${flatItem.ref} is not claimable: no write access to ${flatItem.repository} for @${report.viewer} (read from the Hub board snapshot's access probe when one was used, else the token from ${describeTokenSource()})`,
       { ref: flatItem.ref }
     );
   }
@@ -18275,10 +18277,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.136",
-    tag: "v4.5.136",
-    commit: "642526387569",
-    npm: "@mutmutco/cli@4.5.136"
+    version: "4.5.138",
+    tag: "v4.5.138",
+    commit: "2b2ba344f112",
+    npm: "@mutmutco/cli@4.5.138"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18295,14 +18297,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.136"
+          v3Target: "v4.5.138"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.136 and redeploy the Hub Lambda from tag v4.5.136 (642526387569); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.136 (@mutmutco/cli@4.5.136, tag commit 642526387569 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.138 and redeploy the Hub Lambda from tag v4.5.138 (2b2ba344f112); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.138 (@mutmutco/cli@4.5.138, tag commit 2b2ba344f112 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22179,6 +22181,10 @@ async function announceShippedRelease(deps, args, model, legs, deferred) {
   return (await deps.announce(args)).note;
 }
 async function listTargetRun(deps, repo, target, headSha) {
+  const { read: _read, ...run } = await readTargetRun(deps, repo, target, headSha);
+  return run;
+}
+async function readTargetRun(deps, repo, target, headSha) {
   let rows;
   try {
     rows = JSON.parse(await deps.run("gh", [
@@ -22199,11 +22205,12 @@ async function listTargetRun(deps, repo, target, headSha) {
     ]));
     if (!Array.isArray(rows)) throw new Error("run list did not return an array");
   } catch {
-    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending" };
+    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending", read: "failed" };
   }
   const row = rows.find((r) => typeof r.databaseId === "number" && r.event === target.event);
-  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending" };
+  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending", read: "absent" };
   return {
+    read: "found",
     workflow: target.workflow,
     runId: row.databaseId,
     runUrl: row.url,
@@ -25738,6 +25745,8 @@ var COMPOSE_GUARD_HARD_FAIL = /^secrets preflight: .*noEnvFile is (not )?true.*$
 var PREFLIGHT_TIMEOUT = /aborted due to timeout|TimeoutError|ETIMEDOUT|ESOCKETTIMEDOUT|UND_ERR_(?:HEADERS|CONNECT)_TIMEOUT/i;
 var PREFLIGHT_TIMEOUT_RETRIES = 2;
 var PREFLIGHT_RETRY_BASE_MS = 1e3;
+var CANDIDATE_PUSH_GATE_WAIT_MS = 20 * 6e4;
+var CANDIDATE_PUSH_GATE_POLL_MS = 3e4;
 function readOriginWorkflowsDefault(root, ref) {
   const git3 = (args) => (0, import_node_child_process9.execFileSync)("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   let paths;
@@ -26019,6 +26028,51 @@ async function runTrainDoctor(input) {
   if (workflows === null && !startBranchMissing) {
     add({ code: "workflows-unreadable", severity: "blocker", source: "local", title: `.github/workflows at ${workflowsRef} could not be read from ${cwd} \u2014 the tag-addressability (#5428) and npm-major (#5666) preflights did not run`, remedy: `run from a checkout whose git can read ${workflowsRef} (fetch origin first), then rerun; an unread workflow set is unverified, not green` });
   }
+  if (lane === "release" && !startBranchMissing) {
+    const required = meta?.requiredChecks?.length ? meta.requiredChecks : ["gate"];
+    const emitters = (workflows ?? []).filter((f) => parseWorkflowJobIds(f.body).some((id) => required.some((context) => contextMatchesJobId(id, context))));
+    const gateFiles = emitters.length ? emitters : (workflows ?? []).filter((f) => isGateWorkflowPath(f.path));
+    const gates = gateFiles.length ? gateFiles.map((f) => f.path.split("/").pop()) : ["gate"];
+    try {
+      const tip = await git3(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${startBranch}`]);
+      for (const workflow of gates) {
+        let run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
+        let lastUrl = run.runUrl;
+        let elapsed = 0;
+        const startedAt = Date.now();
+        while (input.refuse && run.read === "found" && run.conclusion === "pending" && elapsed < CANDIDATE_PUSH_GATE_WAIT_MS) {
+          train.warn?.(`candidate push gate ${run.runUrl} still running \u2014 ${elapsed / 1e3}s elapsed (20m bound)`);
+          await deps.sleep(CANDIDATE_PUSH_GATE_POLL_MS);
+          run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
+          elapsed = Math.max(elapsed + CANDIDATE_PUSH_GATE_POLL_MS, Date.now() - startedAt);
+          lastUrl = run.runUrl ?? lastUrl;
+        }
+        const url = run.runUrl ?? lastUrl ?? (run.runId ? `https://github.com/${repo}/actions/runs/${run.runId}` : "(no run URL)");
+        if (run.read === "failed") {
+          originUnverified = true;
+          add({ code: "candidate-push-gate-unread", severity: "warning", source: "origin", title: `${workflow} push runs on ${startBranch}@${tip.slice(0, 12)} could not be read`, remedy: `repair the GitHub run-list read and rerun; unread is not a pass${elapsed ? ` \u2014 last observed run: ${url}` : ""}` });
+          if (input.refuse && elapsed) throw new Error(`candidate push gate became unreadable while waiting \u2014 ${url}; nothing was tagged`);
+        } else if (run.read === "absent") {
+          add({ code: "candidate-push-gate-missing", severity: "warning", source: "origin", title: `no ${workflow} push run on ${startBranch}@${tip.slice(0, 12)}`, remedy: "no pre-tag push verdict is available; some repos intentionally run gate only on PRs and tags" });
+        } else if (run.conclusion === "failure") {
+          let jobs = "failed jobs unreadable";
+          try {
+            const rows = JSON.parse(await train.run("gh", ["run", "view", String(run.runId), "--repo", repo, "--json", "jobs"]));
+            jobs = rows.jobs.filter((j) => !["success", "skipped", "neutral", ""].includes(j.conclusion)).map((j) => j.name).join(", ") || "no failed job names reported";
+          } catch {
+          }
+          add({ code: "candidate-push-gate-red", severity: "blocker", source: "origin", title: `${workflow} push gate failed on ${startBranch}@${tip.slice(0, 12)} \u2014 ${url}`, remedy: `${url} \u2014 failed job(s): ${jobs}. Fix on development through a normal CI-gated PR and rerun; --heal never clears a red gate` });
+        } else if (run.conclusion === "pending") {
+          add({ code: "candidate-push-gate-running", severity: "warning", source: "origin", title: `${workflow} push gate still running \u2014 ${url}`, remedy: "wait for the run to conclude and rerun; apply waits up to 20 minutes before refusing" });
+          if (input.refuse) throw new Error(`candidate push gate still running after 20 minutes \u2014 ${url}; nothing was tagged`);
+        }
+      }
+    } catch (e) {
+      if (input.refuse) throw e;
+      originUnverified = true;
+      add({ code: "candidate-push-gate-unread", severity: "warning", source: "origin", title: `candidate push gate could not be read: ${message(e)}`, remedy: "repair the candidate SHA / GitHub read and rerun; unread is not a pass" });
+    }
+  }
   if (!startBranchMissing) {
     try {
       const required = await discoverRequiredCheckContexts(train, ctx, stage);

package/dist/runbook-sweep.cjs

@@ -4548,6 +4548,10 @@ function rcWindow(since) {
   return since === void 0 ? void 0 : since - 6e4;
 }
 async function listTargetRun(deps, repo, target, headSha) {
+  const { read: _read, ...run } = await readTargetRun(deps, repo, target, headSha);
+  return run;
+}
+async function readTargetRun(deps, repo, target, headSha) {
   let rows;
   try {
     rows = JSON.parse(await deps.run("gh", [
@@ -4568,11 +4572,12 @@ async function listTargetRun(deps, repo, target, headSha) {
     ]));
     if (!Array.isArray(rows)) throw new Error("run list did not return an array");
   } catch {
-    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending" };
+    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending", read: "failed" };
   }
   const row = rows.find((r) => typeof r.databaseId === "number" && r.event === target.event);
-  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending" };
+  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending", read: "absent" };
   return {
+    read: "found",
     workflow: target.workflow,
     runId: row.databaseId,
     runUrl: row.url,
@@ -5444,6 +5449,7 @@ async function selfConvergeTrainCli(input) {
 // src/train-doctor.ts
 var TROUBLESHOOTING_GUIDE = "docs/Guides/train-troubleshooting.md";
 var TROUBLESHOOTING_GUIDE_URL = `https://github.com/mutmutco/MMI-Hub/blob/development/${TROUBLESHOOTING_GUIDE}`;
+var CANDIDATE_PUSH_GATE_WAIT_MS = 20 * 6e4;
 function readOriginWorkflowsDefault(root, ref) {
   const git = (args) => (0, import_node_child_process7.execFileSync)("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   let paths;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.136",
+  "version": "4.5.138",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",