@mutmutco/cli 4.5.137 → 4.5.139

package/dist/main.cjs

@@ -18277,10 +18277,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.137",
-    tag: "v4.5.137",
-    commit: "5d0403299d67",
-    npm: "@mutmutco/cli@4.5.137"
+    version: "4.5.139",
+    tag: "v4.5.139",
+    commit: "59be27fc975d",
+    npm: "@mutmutco/cli@4.5.139"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18297,14 +18297,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.137"
+          v3Target: "v4.5.139"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.137 and redeploy the Hub Lambda from tag v4.5.137 (5d0403299d67); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.137 (@mutmutco/cli@4.5.137, tag commit 5d0403299d67 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.139 and redeploy the Hub Lambda from tag v4.5.139 (59be27fc975d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.139 (@mutmutco/cli@4.5.139, tag commit 59be27fc975d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20427,7 +20427,10 @@ async function readTrainLogin(deps, waitMs = 18e4, attempts = 5) {
     try {
       return requireValue(clean2(await deps.run("gh", ["api", "user", "--jq", ".login"])), "GitHub login");
     } catch (e) {
-      if (i >= attempts || !isRateLimitText(e instanceof Error ? e.message : String(e))) throw e;
+      if (!isRateLimitText(e instanceof Error ? e.message : String(e))) throw e;
+      const stored = clean2(await deps.run("gh", ["config", "get", "user", "-h", "github.com"]).catch(() => ""));
+      if (stored) return stored;
+      if (i >= attempts) throw e;
       deps.warn?.(`GitHub login read rate-limited; retrying in ${waitMs / 6e4} min (${i}/${attempts - 1})`);
       await resolveSleep(deps)(waitMs);
     }
@@ -22181,6 +22184,10 @@ async function announceShippedRelease(deps, args, model, legs, deferred) {
   return (await deps.announce(args)).note;
 }
 async function listTargetRun(deps, repo, target, headSha) {
+  const { read: _read, ...run } = await readTargetRun(deps, repo, target, headSha);
+  return run;
+}
+async function readTargetRun(deps, repo, target, headSha) {
   let rows;
   try {
     rows = JSON.parse(await deps.run("gh", [
@@ -22201,11 +22208,12 @@ async function listTargetRun(deps, repo, target, headSha) {
     ]));
     if (!Array.isArray(rows)) throw new Error("run list did not return an array");
   } catch {
-    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending" };
+    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending", read: "failed" };
   }
   const row = rows.find((r) => typeof r.databaseId === "number" && r.event === target.event);
-  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending" };
+  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending", read: "absent" };
   return {
+    read: "found",
     workflow: target.workflow,
     runId: row.databaseId,
     runUrl: row.url,
@@ -25740,6 +25748,8 @@ var COMPOSE_GUARD_HARD_FAIL = /^secrets preflight: .*noEnvFile is (not )?true.*$
 var PREFLIGHT_TIMEOUT = /aborted due to timeout|TimeoutError|ETIMEDOUT|ESOCKETTIMEDOUT|UND_ERR_(?:HEADERS|CONNECT)_TIMEOUT/i;
 var PREFLIGHT_TIMEOUT_RETRIES = 2;
 var PREFLIGHT_RETRY_BASE_MS = 1e3;
+var CANDIDATE_PUSH_GATE_WAIT_MS = 20 * 6e4;
+var CANDIDATE_PUSH_GATE_POLL_MS = 3e4;
 function readOriginWorkflowsDefault(root, ref) {
   const git3 = (args) => (0, import_node_child_process9.execFileSync)("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   let paths;
@@ -26021,6 +26031,51 @@ async function runTrainDoctor(input) {
   if (workflows === null && !startBranchMissing) {
     add({ code: "workflows-unreadable", severity: "blocker", source: "local", title: `.github/workflows at ${workflowsRef} could not be read from ${cwd} \u2014 the tag-addressability (#5428) and npm-major (#5666) preflights did not run`, remedy: `run from a checkout whose git can read ${workflowsRef} (fetch origin first), then rerun; an unread workflow set is unverified, not green` });
   }
+  if (lane === "release" && !startBranchMissing) {
+    const required = meta?.requiredChecks?.length ? meta.requiredChecks : ["gate"];
+    const emitters = (workflows ?? []).filter((f) => parseWorkflowJobIds(f.body).some((id) => required.some((context) => contextMatchesJobId(id, context))));
+    const gateFiles = emitters.length ? emitters : (workflows ?? []).filter((f) => isGateWorkflowPath(f.path));
+    const gates = gateFiles.length ? gateFiles.map((f) => f.path.split("/").pop()) : ["gate"];
+    try {
+      const tip = await git3(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${startBranch}`]);
+      for (const workflow of gates) {
+        let run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
+        let lastUrl = run.runUrl;
+        let elapsed = 0;
+        const startedAt = Date.now();
+        while (input.refuse && run.read === "found" && run.conclusion === "pending" && elapsed < CANDIDATE_PUSH_GATE_WAIT_MS) {
+          train.warn?.(`candidate push gate ${run.runUrl} still running \u2014 ${elapsed / 1e3}s elapsed (20m bound)`);
+          await deps.sleep(CANDIDATE_PUSH_GATE_POLL_MS);
+          run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
+          elapsed = Math.max(elapsed + CANDIDATE_PUSH_GATE_POLL_MS, Date.now() - startedAt);
+          lastUrl = run.runUrl ?? lastUrl;
+        }
+        const url = run.runUrl ?? lastUrl ?? (run.runId ? `https://github.com/${repo}/actions/runs/${run.runId}` : "(no run URL)");
+        if (run.read === "failed") {
+          originUnverified = true;
+          add({ code: "candidate-push-gate-unread", severity: "warning", source: "origin", title: `${workflow} push runs on ${startBranch}@${tip.slice(0, 12)} could not be read`, remedy: `repair the GitHub run-list read and rerun; unread is not a pass${elapsed ? ` \u2014 last observed run: ${url}` : ""}` });
+          if (input.refuse && elapsed) throw new Error(`candidate push gate became unreadable while waiting \u2014 ${url}; nothing was tagged`);
+        } else if (run.read === "absent") {
+          add({ code: "candidate-push-gate-missing", severity: "warning", source: "origin", title: `no ${workflow} push run on ${startBranch}@${tip.slice(0, 12)}`, remedy: "no pre-tag push verdict is available; some repos intentionally run gate only on PRs and tags" });
+        } else if (run.conclusion === "failure") {
+          let jobs = "failed jobs unreadable";
+          try {
+            const rows = JSON.parse(await train.run("gh", ["run", "view", String(run.runId), "--repo", repo, "--json", "jobs"]));
+            jobs = rows.jobs.filter((j) => !["success", "skipped", "neutral", ""].includes(j.conclusion)).map((j) => j.name).join(", ") || "no failed job names reported";
+          } catch {
+          }
+          add({ code: "candidate-push-gate-red", severity: "blocker", source: "origin", title: `${workflow} push gate failed on ${startBranch}@${tip.slice(0, 12)} \u2014 ${url}`, remedy: `${url} \u2014 failed job(s): ${jobs}. Fix on development through a normal CI-gated PR and rerun; --heal never clears a red gate` });
+        } else if (run.conclusion === "pending") {
+          add({ code: "candidate-push-gate-running", severity: "warning", source: "origin", title: `${workflow} push gate still running \u2014 ${url}`, remedy: "wait for the run to conclude and rerun; apply waits up to 20 minutes before refusing" });
+          if (input.refuse) throw new Error(`candidate push gate still running after 20 minutes \u2014 ${url}; nothing was tagged`);
+        }
+      }
+    } catch (e) {
+      if (input.refuse) throw e;
+      originUnverified = true;
+      add({ code: "candidate-push-gate-unread", severity: "warning", source: "origin", title: `candidate push gate could not be read: ${message(e)}`, remedy: "repair the candidate SHA / GitHub read and rerun; unread is not a pass" });
+    }
+  }
   if (!startBranchMissing) {
     try {
       const required = await discoverRequiredCheckContexts(train, ctx, stage);

package/dist/runbook-sweep.cjs

@@ -4548,6 +4548,10 @@ function rcWindow(since) {
   return since === void 0 ? void 0 : since - 6e4;
 }
 async function listTargetRun(deps, repo, target, headSha) {
+  const { read: _read, ...run } = await readTargetRun(deps, repo, target, headSha);
+  return run;
+}
+async function readTargetRun(deps, repo, target, headSha) {
   let rows;
   try {
     rows = JSON.parse(await deps.run("gh", [
@@ -4568,11 +4572,12 @@ async function listTargetRun(deps, repo, target, headSha) {
     ]));
     if (!Array.isArray(rows)) throw new Error("run list did not return an array");
   } catch {
-    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending" };
+    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending", read: "failed" };
   }
   const row = rows.find((r) => typeof r.databaseId === "number" && r.event === target.event);
-  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending" };
+  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending", read: "absent" };
   return {
+    read: "found",
     workflow: target.workflow,
     runId: row.databaseId,
     runUrl: row.url,
@@ -5444,6 +5449,7 @@ async function selfConvergeTrainCli(input) {
 // src/train-doctor.ts
 var TROUBLESHOOTING_GUIDE = "docs/Guides/train-troubleshooting.md";
 var TROUBLESHOOTING_GUIDE_URL = `https://github.com/mutmutco/MMI-Hub/blob/development/${TROUBLESHOOTING_GUIDE}`;
+var CANDIDATE_PUSH_GATE_WAIT_MS = 20 * 6e4;
 function readOriginWorkflowsDefault(root, ref) {
   const git = (args) => (0, import_node_child_process7.execFileSync)("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   let paths;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.137",
+  "version": "4.5.139",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",