@mutmutco/cli 4.5.191 → 4.5.193

package/dist/main.cjs

@@ -19193,10 +19193,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.191",
-    tag: "v4.5.191",
-    commit: "095bd01c1301",
-    npm: "@mutmutco/cli@4.5.191"
+    version: "4.5.193",
+    tag: "v4.5.193",
+    commit: "8a9085b5492f",
+    npm: "@mutmutco/cli@4.5.193"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19213,14 +19213,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.191"
+          v3Target: "v4.5.193"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.191 and redeploy the Hub Lambda from tag v4.5.191 (095bd01c1301); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.191 (@mutmutco/cli@4.5.191, tag commit 095bd01c1301 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.193 and redeploy the Hub Lambda from tag v4.5.193 (8a9085b5492f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.193 (@mutmutco/cli@4.5.193, tag commit 8a9085b5492f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -33363,15 +33363,49 @@ function planRemoteScript(dests) {
     lines2.push(`if [ -f '${d}' ]; then printf '%s %s %s\\n' "$(md5sum < '${d}' | cut -d' ' -f1)" "$(stat -c %a '${d}')" '${d}'; else printf 'MISSING - %s\\n' '${d}'; fi`);
   }
   lines2.push(`for f in ${ALERT_DIR}/*; do [ -f "$f" ] && printf 'ALERT %s %s\\n' "$(basename "$f")" "$(head -c 300 "$f" | tr '\\n' ' ')"; done; true`);
+  lines2.push(`if command -v needrestart >/dev/null 2>&1 && nr_out=$(needrestart -b -r l 2>/dev/null); then printf 'PENDING_RESTART_STATUS ok\\n'; printf '%s\\n' "$nr_out" | sed -n 's/^NEEDRESTART-SVC:[[:space:]]*/PENDING_RESTART /p'; else printf 'PENDING_RESTART_STATUS unavailable\\n'; fi; true`);
   return `${lines2.join("\n")}
 `;
 }
 var ALERT_DIR = "/var/lib/mmi-control/alerts";
+var SUPPRESSED_RUNNER_PRIVATE_KEY_GLOB = "*/.local/share/docker/containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/*/fs/etc/ssl/private/ssl-cert-snakeoil.key";
+var SUPPRESSED_RUNNER_PRIVATE_KEY_RE = new RegExp(
+  `^${SUPPRESSED_RUNNER_PRIVATE_KEY_GLOB.split("*").map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`
+);
+function isSuppressedRunnerPrivateKeyPath(p) {
+  return SUPPRESSED_RUNNER_PRIVATE_KEY_RE.test(p.trim());
+}
 function parseAlerts(output) {
   const out = [];
   for (const line of output.split("\n")) {
     const m = /^ALERT ([A-Za-z0-9._-]+) ?(.*)$/.exec(line.trim());
-    if (m) out.push({ name: m[1], message: m[2].trim() });
+    if (!m) continue;
+    const name = m[1];
+    let message2 = m[2].trim();
+    if (name === "runner-private-key") {
+      const pm = /^(\d+)( private key file\(s\) readable by every CI job on this box \(#7535\): )(.+)$/.exec(message2);
+      if (pm) {
+        const kept = pm[3].trim().split(/\s+/).filter((p) => p && !isSuppressedRunnerPrivateKeyPath(p));
+        if (kept.length === 0) continue;
+        message2 = `${kept.length}${pm[2]}${kept.join(" ")}`;
+      }
+    }
+    out.push({ name, message: message2 });
+  }
+  return out;
+}
+function parsePendingRestartStatus(output) {
+  for (const line of output.split("\n")) {
+    if (line.trim() === "PENDING_RESTART_STATUS ok") return "ok";
+    if (line.trim() === "PENDING_RESTART_STATUS unavailable") return "unavailable";
+  }
+  return "unavailable";
+}
+function parsePendingRestarts(output) {
+  const out = [];
+  for (const line of output.split("\n")) {
+    const m = /^PENDING_RESTART ([A-Za-z0-9@_.:-]+)$/.exec(line.trim());
+    if (m && !out.includes(m[1])) out.push(m[1]);
   }
   return out;
 }
@@ -35240,9 +35274,17 @@ ${SSH_RECIPE_AGENT_NOTE}`);
       const drift = results.filter((r) => r.status !== "in-sync").length;
       const unread = results.some((r) => r.status === "unread");
       const alerts = parseAlerts(output);
-      const payload = { box: found.box.name, ref: o.ref, mode: o.apply ? "apply" : "plan", files: results, drift, alerts, ok: drift === 0 && alerts.length === 0 };
+      const pendingRestartsStatus = parsePendingRestartStatus(output);
+      const pendingRestarts = parsePendingRestarts(output);
+      const payload = { box: found.box.name, ref: o.ref, mode: o.apply ? "apply" : "plan", files: results, drift, alerts, pendingRestartsStatus, pendingRestarts, ok: drift === 0 && alerts.length === 0 };
       if (o.json) console.log(JSON.stringify(payload, null, 2));
-      else console.log([formatControl(payload.mode, found.box.name, results), ...alerts.map((a) => `ALERT ${a.name}: ${a.message}`)].join("\n"));
+      else {
+        console.log([
+          formatControl(payload.mode, found.box.name, results),
+          ...alerts.map((a) => `ALERT ${a.name}: ${a.message}`),
+          ...pendingRestartsStatus === "unavailable" ? ["PENDING_RESTART: unavailable (needrestart probe missing or failed)"] : pendingRestarts.length ? [`PENDING_RESTART: ${pendingRestarts.join(", ")}`] : []
+        ].join("\n"));
+      }
       process.exitCode = unread ? 2 : drift || alerts.length ? 1 : 0;
     } catch (e) {
       if (o.json) console.log(JSON.stringify({ box: name, ref: o.ref, ok: false, error: e.message }, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.191",
+  "version": "4.5.193",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",