@mutmutco/cli 4.5.233 → 4.5.235

package/dist/main.cjs

@@ -25116,6 +25116,7 @@ function createDocsIndexDeps(repoRoot2) {
 var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var BLESSED_KIT_AGENT_FILES_SHA = "a8b273ed418e703c0aa501a53ea87228ba28b1f0";
+var BLESSED_JEV_FAILURES_SHA = "0e5b55b9fd45bdf55f791c1f56dafeb42c9fb88c";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
@@ -25498,7 +25499,9 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     GATE_RUNBOOK_SHA: BLESSED_RUNBOOK_GUARD_SHA,
     // #7407: repo-declared service containers and extra check steps; empty renders today's gate byte-for-byte.
     GATE_SERVICES_YAML: "",
-    GATE_EXTRA_STEPS_YAML: ""
+    GATE_EXTRA_STEPS_YAML: "",
+    // #9293: Jev failure-memory fetch/report steps from the blessed jev-failures pin (an empty pin renders none).
+    ...gateJevStepsYaml(BLESSED_JEV_FAILURES_SHA, runtime)
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
   const trackBranches = track === "trunk" ? ["main"] : track === "single" ? ["development"] : track === "direct" ? ["development", "main"] : ["development", "rc", "main"];
@@ -25647,6 +25650,29 @@ function gateServicesYaml(services) {
   }
   return out;
 }
+function gateJevStepsYaml(sha, runtime = "node") {
+  if (!/^[0-9a-f]{40}$/.test(sha)) return { GATE_JEV_FETCH_YAML: "", GATE_JEV_REPORT_YAML: "" };
+  const step = (name, cond, mode) => [
+    `
+      - name: ${name}`,
+    `
+        if: \${{ ${cond}steps.development-gate.outputs.reuse != 'true' }}`,
+    "\n        continue-on-error: true",
+    "\n        timeout-minutes: 1",
+    `
+        uses: mutmutco/MMI-Hub/.github/actions/jev-failures@${sha}`,
+    "\n        with:",
+    `
+          mode: ${mode}`,
+    mode === "report" ? `
+          report-format: ${runtime === "python" ? "junit-xml" : "vitest-json"}` : "",
+    "\n          token: ${{ github.token }}"
+  ].join("");
+  return {
+    GATE_JEV_FETCH_YAML: step("Fetch Jev recent failures (empty on any fault)", "", "fetch"),
+    GATE_JEV_REPORT_YAML: step("Report failing test files to Jev", "failure() && ", "report")
+  };
+}
 function gateExtraStepsYaml(steps) {
   return steps.map((step) => [
     `
@@ -27242,10 +27268,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.233",
-    tag: "v4.5.233",
-    commit: "5abbe7fd4238",
-    npm: "@mutmutco/cli@4.5.233"
+    version: "4.5.235",
+    tag: "v4.5.235",
+    commit: "c92194a19184",
+    npm: "@mutmutco/cli@4.5.235"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27262,14 +27288,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.233"
+          v3Target: "v4.5.235"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.233 and redeploy the Hub Lambda from tag v4.5.233 (5abbe7fd4238); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.233 (@mutmutco/cli@4.5.233, tag commit 5abbe7fd4238 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.235 and redeploy the Hub Lambda from tag v4.5.235 (c92194a19184); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.235 (@mutmutco/cli@4.5.235, tag commit c92194a19184 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -38291,6 +38317,7 @@ function registryRepoKey(repo) {
 }
 
 // src/ci-audit.ts
+var import_yaml2 = __toESM(require_dist(), 1);
 var HUB_REPO4 = "mutmutco/MMI-Hub";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
 var PRODUCT_GATE_PATH = ".github/workflows/gate.yml";
@@ -38357,6 +38384,85 @@ function auditRunnerFallbacks(repo, files, closure) {
     remediation: f.cost === "hosted" || f.cost === "unknown" ? "Resolve source reads and unsupported selectors/callees; preserve checks and artifacts. See gh-runner-runbook.md." : void 0
   }));
 }
+var LIVE_SELF_HOSTED_LINUX_LABELS = /* @__PURE__ */ new Set([
+  "self-hosted",
+  "linux",
+  "x64",
+  "mmi-live",
+  "mmi-heavy",
+  "mmi-bare-metal",
+  "mmi-journeys",
+  "mmi-deploy",
+  "mmi-browser"
+]);
+var NON_LINUX_RUNNER_LABEL = /^(?:macos|windows|arm64)$/i;
+var NODE_SETUP_USE = /(?:^|\/)(?:actions\/setup-node|runner-node-toolchain)(?:@|$)/;
+var RUNS_NODE = /(?:^|[\s;&|(`])(?:node|npm|npx)(?=\s|$)/m;
+var plainRecord = (value) => Boolean(value && typeof value === "object" && !Array.isArray(value));
+function runsOnLabelSets(job) {
+  const toSet = (value) => typeof value === "string" ? [value] : Array.isArray(value) && value.every((l) => typeof l === "string") ? value : void 0;
+  let selector = job["runs-on"];
+  if (plainRecord(selector)) selector = selector.labels;
+  if (typeof selector !== "string" || !selector.includes("${{")) return [toSet(selector)].filter((s) => Boolean(s));
+  const sets = [];
+  for (const m of selector.matchAll(/fromJSON\('([^']+)'\)/g)) {
+    try {
+      const parsed = toSet(JSON.parse(m[1]));
+      if (parsed) sets.push(parsed);
+    } catch {
+    }
+  }
+  const axis = /^\$\{\{\s*matrix\.([\w-]+)\s*\}\}$/.exec(selector.trim())?.[1];
+  const matrix = plainRecord(job.strategy) && plainRecord(job.strategy.matrix) ? job.strategy.matrix : void 0;
+  if (axis && matrix && Array.isArray(matrix[axis])) for (const value of matrix[axis]) {
+    const s = toSet(value);
+    if (s) sets.push(s);
+  }
+  return sets;
+}
+function auditSelfHostedRunnerHygiene(files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    let doc;
+    try {
+      doc = (0, import_yaml2.parse)(body);
+    } catch {
+      continue;
+    }
+    const jobs = plainRecord(doc) && plainRecord(doc.jobs) ? doc.jobs : {};
+    for (const [id, job] of Object.entries(jobs)) {
+      if (!plainRecord(job)) continue;
+      const linuxSets = runsOnLabelSets(job).filter((set) => set.some((l) => l.toLowerCase() === "self-hosted") && !set.some((l) => NON_LINUX_RUNNER_LABEL.test(l)));
+      if (!linuxSets.length) continue;
+      const stale = [...new Set(linuxSets.flat().filter((l) => !LIVE_SELF_HOSTED_LINUX_LABELS.has(l.toLowerCase())))];
+      if (stale.length) {
+        checks.push({
+          ok: false,
+          label: `self-hosted job requests only live runner labels (#9293): ${path2}:${id}`,
+          detail: stale.map((l) => /^mmi-runner/i.test(l) ? `'${l}' is a host pin \u2014 route by class label, never hostname` : `'${l}' is carried by no live lane`).join("; "),
+          remediation: `Use ubuntu-latest, or a live class tuple such as [self-hosted, linux, x64, mmi-live]. Live labels: ${[...LIVE_SELF_HOSTED_LINUX_LABELS].join(", ")} (gh-runner-runbook.md \xA7 Lane classes).`
+        });
+      }
+      if (job.container !== void 0 || !Array.isArray(job.steps)) continue;
+      for (const [index, step] of job.steps.entries()) {
+        if (!plainRecord(step)) continue;
+        const uses = typeof step.uses === "string" ? step.uses : "";
+        if (NODE_SETUP_USE.test(uses)) break;
+        const command = typeof step.run === "string" ? step.run : uses.includes("run-with-budget") && plainRecord(step.with) && typeof step.with.command === "string" ? step.with.command : "";
+        if (!RUNS_NODE.test(command)) continue;
+        checks.push({
+          ok: true,
+          severity: "warn",
+          label: `self-hosted job sets up node before running it (#9293): ${path2}:${id}`,
+          detail: `step ${index + 1}${typeof step.name === "string" ? ` ('${step.name}')` : ""} runs node/npm/npx before any actions/setup-node or runner-node-toolchain step \u2014 it gets whatever node the lane's PATH has`,
+          remediation: "Add mutmutco/MMI-Hub/.github/actions/runner-node-toolchain (or actions/setup-node) before the first node command, or run the job on ubuntu-latest."
+        });
+        break;
+      }
+    }
+  }
+  return checks;
+}
 var PENDING_LANDING_LABEL = "pending PRs landing (#8783)";
 var PENDING_LANDING_LIST_CAP = 50;
 var PENDING_LANDING_STALL_MS = 15 * 60 * 1e3;
@@ -39150,6 +39256,7 @@ async function auditRepoCi(repo, callerDeps) {
       } catch (e) {
         checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: e instanceof WorkflowSourceError ? e.message : "workflow source: read-failed" });
       }
+      checks.push(...auditSelfHostedRunnerHygiene(workflows));
       if (repoClass !== "hub") checks.push(...await auditSharedActionPins(workflows, deps));
     } else {
       checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: "workflow source inventory unreadable" });

package/dist/runbook-sweep.cjs

@@ -13168,6 +13168,7 @@ function registryRepoKey(repo) {
 }
 
 // src/ci-audit.ts
+var import_yaml2 = __toESM(require_dist(), 1);
 var HUB_REPO4 = "mutmutco/MMI-Hub";
 var DEV_STAGE_STALE_TOLERANCE_MS = 30 * 60 * 1e3;
 var PENDING_LANDING_STALL_MS = 15 * 60 * 1e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.233",
+  "version": "4.5.235",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",