@mutmutco/cli 4.5.58 → 4.5.59

package/dist/main.cjs

@@ -5825,11 +5825,14 @@ function waitReadFailureMessage(e) {
   return (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 300);
 }
 var PR_CHECKS_POLL_MS = 3e4;
+function pollIntervalMs(elapsedMs) {
+  return Math.min(4 * PR_CHECKS_POLL_MS, PR_CHECKS_POLL_MS * 2 ** Math.floor(Math.max(0, elapsedMs) / 3e5));
+}
 var PR_CHECKS_TIMEOUT_MS = 30 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
 var PR_CHECKS_CONFIRM_MS = 5e3;
 var PR_CHECKS_FAILURE_CONFIRMATIONS = 2;
-var PR_CHECKS_RATELIMIT_FLOOR = 50;
+var PR_CHECKS_RATELIMIT_FLOOR = 1e3;
 var PR_CHECKS_RATELIMIT_JITTER_MAX_MS = 5e3;
 var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
 var PR_CHECKS_ZERO_RUNS_GRACE_MS = 2 * 6e4;
@@ -5965,7 +5968,7 @@ async function waitForPrChecks(deps) {
     }
     if (state === "failing") {
       lastDetail = "failing (a check failed; others still running)";
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
     if (state === "success") {
@@ -6003,11 +6006,11 @@ async function waitForPrChecks(deps) {
       } else {
         zeroRunsStreak = 0;
       }
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
     lastDetail = state;
-    await deps.sleep(PR_CHECKS_POLL_MS);
+    await deps.sleep(pollIntervalMs(now() - started));
   }
   return { policy, status: "timeout", reason, detail: lastDetail, waitedMs: now() - started };
 }
@@ -6044,15 +6047,38 @@ async function pollToken() {
   pollTokenOnce ??= pollTokenProvider().catch(() => void 0);
   return pollTokenOnce;
 }
-async function defaultGhApi(args) {
-  const token = await pollToken();
-  const { stdout } = await execFileP("gh", ["api", ...args], {
-    timeout: REST_GH_TIMEOUT_MS,
-    // Only when a token was actually minted: passing `env` at all would otherwise replace the
-    // inherited environment wholesale, and `gh` needs the rest of it (PATH, GH_HOST, config home).
-    ...token ? { env: { ...process.env, GH_TOKEN: token } } : {}
+var INCLUDED_HEADER_BLOCK = /^(?:\r?\n)?HTTP\/\d(?:\.\d)? (\d{3})[^\n]*\n(?:[^\n]+\n)*?\r?\n/gm;
+function parseIncludedOutput(out) {
+  let status;
+  let etag;
+  let pages = 0;
+  const body = out.replace(INCLUDED_HEADER_BLOCK, (block, code) => {
+    if (pages++ === 0) {
+      status = Number(code);
+      etag = /^etag:\s*(.+?)\s*$/im.exec(block)?.[1];
+    }
+    return "";
   });
-  return stdout;
+  return { body, status, etag, pages };
+}
+var etagCache = /* @__PURE__ */ new Map();
+async function defaultGhApi(args) {
+  const key = args.join("\0");
+  const cached = etagCache.get(key);
+  let stdout;
+  try {
+    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+      timeout: REST_GH_TIMEOUT_MS
+    }));
+  } catch (e) {
+    const out = e.stdout;
+    if (cached && typeof out === "string" && parseIncludedOutput(out).status === 304) return cached.body;
+    throw e;
+  }
+  const { body, etag, pages } = parseIncludedOutput(stdout);
+  if (etag && pages === 1) etagCache.set(key, { etag, body });
+  else etagCache.delete(key);
+  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -8475,6 +8501,9 @@ function isValidSecretKey(key) {
   if (key.includes("..") || key.startsWith("/") || key.includes("*")) return false;
   return KEY_RE.test(key);
 }
+function stripTrailingCRLF(value) {
+  return value.replace(/\r\n$|\r$|\n$/, "");
+}
 function classifyTier(_slug, key) {
   const slash2 = key.indexOf("/");
   if (slash2 === -1) return "project";
@@ -8637,7 +8666,7 @@ async function fetchSecretValue(deps, key, opts, diagnose = false) {
     if (!res.ok) {
       if (diagnose) {
         const body = await readJsonBody(res);
-        const reason = res.status === 403 ? "authority refused" : res.status === 429 ? "rate limited" : "Hub route refused";
+        const reason = res.status === 403 ? "authority refused" : res.status === 429 ? "rate limited" : body.code === "github-rate-limited" ? "Hub GitHub App allowance used up, not a denial" : "Hub route refused";
         throw new Error(`${reason} (HTTP ${res.status}${typeof body.error === "string" && /^(forbidden|unauthorized|rate limit|too many requests|master-admin only)$/i.test(body.error) ? `: ${body.error}` : ""})`);
       }
       return null;
@@ -9918,6 +9947,10 @@ async function secretsVerify(deps, key, opts) {
   }
   const hasProviderVerifier = Boolean(providerForSecretKey(key));
   const value = await fetchSecretValue(deps, key, opts);
+  if (value && value !== stripTrailingCRLF(value)) {
+    deps.err(`${key}: stored value ends in a CR or LF character \u2014 likely corrupted by a piped write; re-set it with \`mmi-cli vault secrets set ${key}\``);
+    return false;
+  }
   if (!hasProviderVerifier) {
     if (!value) {
       deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
@@ -10105,6 +10138,40 @@ async function secretsDeclare(deps, key, opts) {
   deps.log(`declared ${key} (project tier, ${slug}) \u2014 catalog metadata only; ask master (secrets request) to wire it into requiredRuntimeSecrets`);
   return true;
 }
+async function secretsUndeclare(deps, key, opts) {
+  if (!DECLARE_KEY_RE.test(key.split("@")[0] ?? "")) {
+    deps.err(`secrets undeclare: invalid key ${JSON.stringify(key)} \u2014 must be an env-style name (UPPER_SNAKE convention), optionally @dev|rc|main`);
+    return false;
+  }
+  const repo = await targetRepo(deps, opts);
+  const slug = await vaultSlug(deps, opts);
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/projects/${slug}/secrets/undeclare`, {
+      method: "POST",
+      headers: await deps.headers({ "content-type": "application/json" }),
+      body: JSON.stringify({ repo, key }),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+  } catch (e) {
+    deps.err(`secrets undeclare: ${e.message}`);
+    return false;
+  }
+  const body = await readJsonBody(res);
+  if (!res.ok) {
+    deps.err(await upgradeMessage(res, body) ?? `secrets undeclare failed: HTTP ${res.status}${errorDetail(body)}`);
+    return false;
+  }
+  const undeclared = body?.undeclared !== false;
+  if (opts.json) {
+    deps.log(JSON.stringify({ ok: true, key, undeclared }));
+    return true;
+  }
+  deps.log(
+    undeclared ? `undeclared ${key} (project tier, ${slug}) \u2014 catalog entry removed; the vault value was already absent` : `${key} was not declared in ${slug}'s catalog \u2014 nothing to undeclare`
+  );
+  return true;
+}
 function parseRailsCredentialMapping(raw, stage) {
   const eq = raw.indexOf("=");
   if (eq <= 0 || eq === raw.length - 1) return null;
@@ -16302,6 +16369,17 @@ function isHubControlRepo(repo) {
 function isJervHubRepo(repo) {
   return repo.toLowerCase() === JERV_HUB_REPO.toLowerCase();
 }
+var WINDOWS_GIT_BASH_MSYSTEM = /^(?:MINGW(?:32|64)|UCRT64|CLANG(?:64|ARM64))$/u;
+function isWindowsGitBash(msystem) {
+  return WINDOWS_GIT_BASH_MSYSTEM.test(msystem ?? "");
+}
+function assertGitBashOnWindowsForJervHubRelease(repo, platform2 = process.platform, env = process.env) {
+  if (platform2 !== "win32" || !isJervHubRepo(repo)) return;
+  if (isWindowsGitBash(env.MSYSTEM)) return;
+  throw new Error(
+    `${repo}: Windows Git Bash required \u2014 the release train's Jerv Gateway deploy leg refuses outside it, and the current shell is not Git Bash (MSYSTEM=${env.MSYSTEM ?? "(unset)"}). Run the release from Git Bash instead, e.g.: "C:/Program Files/Git/bin/bash.exe" -lc "mmi-cli devops release --apply"`
+  );
+}
 
 // src/train-apply-correlation.ts
 var import_node_fs18 = require("node:fs");
@@ -17070,10 +17148,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.58",
-    tag: "v4.5.58",
-    commit: "05d087d1fcb7",
-    npm: "@mutmutco/cli@4.5.58"
+    version: "4.5.59",
+    tag: "v4.5.59",
+    commit: "ea079366d96e",
+    npm: "@mutmutco/cli@4.5.59"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17090,14 +17168,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.58"
+          v3Target: "v4.5.59"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.58 and redeploy the Hub Lambda from tag v4.5.58 (05d087d1fcb7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.58 (@mutmutco/cli@4.5.58, tag commit 05d087d1fcb7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.59 and redeploy the Hub Lambda from tag v4.5.59 (ea079366d96e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.59 (@mutmutco/cli@4.5.59, tag commit ea079366d96e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -25157,6 +25235,7 @@ function enforceGateBudget(deps, repo) {
   }
 }
 async function preflight(deps, ctx, stage, meta, lane) {
+  assertGitBashOnWindowsForJervHubRelease(ctx.repo);
   deps.warn?.("Release: Checking release prerequisites");
   if (deps.suiteCut && !authorisedSuiteCut(ctx.repo, meta, deps.suiteCut))
     throw new Error(`${ctx.repo}: suite cut context does not match registry META; no deployment or tag was changed`);
@@ -27467,15 +27546,16 @@ async function branchPresence(deps, repo, branch) {
   }
 }
 function collectRegistryRepos(projects) {
-  const seen = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const raw of project2.repos ?? []) {
       const repo = raw.includes("/") ? raw : `mutmutco/${raw}`;
-      seen.add(repo);
+      const key = repo.toLowerCase();
+      if (!seen.has(key)) seen.set(key, repo);
     }
   }
-  if (![...seen].some((r) => r.toLowerCase() === HUB_REPO4.toLowerCase())) seen.add(HUB_REPO4);
-  return [...seen].sort((a, b) => a.localeCompare(b));
+  if (!seen.has(HUB_REPO4.toLowerCase())) seen.set(HUB_REPO4.toLowerCase(), HUB_REPO4);
+  return [...seen.values()].sort((a, b) => a.localeCompare(b));
 }
 async function prTriggeredWorkflowsOnRef(deps, repo, branch, repoClass) {
   const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, branch, PRODUCT_GATE_PATH);
@@ -27522,7 +27602,29 @@ async function filterPullRequestTriggered(deps, repo, branch, paths) {
   }
   return kept;
 }
-async function auditRepoCi(repo, deps) {
+function trackUnauditableReads(deps) {
+  let reason;
+  const record = (e) => {
+    if (reason) return;
+    const err = e;
+    if (err?.rateLimited) reason = `GitHub App rate-limited: ${err.message ?? "rate limit exceeded"}`;
+    else if (err?.status === 403 || err?.status === 429) reason = `HTTP ${err.status}${err.message ? `: ${err.message}` : ""}`;
+  };
+  const client = {
+    ...deps.client,
+    rest: async (method, path2, init) => {
+      try {
+        return await deps.client.rest(method, path2, init);
+      } catch (e) {
+        record(e);
+        throw e;
+      }
+    }
+  };
+  return { deps: { ...deps, client }, reason: () => reason };
+}
+async function auditRepoCi(repo, callerDeps) {
+  const { deps, reason: unauditedReason } = trackUnauditableReads(callerDeps);
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const repoClass = classifyRepo(repo, meta);
   const checks = [];
@@ -27817,6 +27919,10 @@ async function auditRepoCi(repo, deps) {
     const workflows = await getBranchWorkflows();
     if (workflows) checks.push(...await auditSharedActionPins(workflows, deps));
   }
+  const failure = unauditedReason();
+  if (failure) {
+    return { repo, class: repoClass, mergePolicy: policy, ok: false, checks: [], explicitNoCi, unauditedReason: failure };
+  }
   const ok = checks.every((c) => c.ok);
   return { repo, class: repoClass, mergePolicy: policy, ok, checks, explicitNoCi };
 }
@@ -27858,8 +27964,8 @@ function renderCiAuditMarkdown(report) {
     "|------|-------|--------|----|---------|"
   ];
   for (const r of report.repos) {
-    const gap = r.checks.find((c) => !c.ok);
-    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap?.label ?? "\u2014"} |`);
+    const gap = r.unauditedReason ? `CANNOT AUDIT \u2014 ${r.unauditedReason}` : r.checks.find((c) => !c.ok)?.label ?? "\u2014";
+    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap} |`);
   }
   return lines2.join("\n");
 }
@@ -27869,8 +27975,13 @@ function renderCiAuditText(report) {
     renderCiAuditScopeLine(report)
   ];
   for (const r of report.repos) {
+    const verdict = r.unauditedReason ? "CANNOT AUDIT" : r.ok ? "OK" : "GAP";
     lines2.push(`
-${r.repo} (${r.class}, policy=${r.mergePolicy}) ${r.ok ? "OK" : "GAP"}`);
+${r.repo} (${r.class}, policy=${r.mergePolicy}) ${verdict}`);
+    if (r.unauditedReason) {
+      lines2.push(`  UNAUDITED \u2014 ${r.unauditedReason}`);
+      continue;
+    }
     for (const c of r.checks) {
       lines2.push(`  ${c.ok ? "OK" : "FAIL"} ${c.label}${c.detail ? ` \u2014 ${c.detail}` : ""}`);
     }
@@ -31356,7 +31467,7 @@ async function readSecretStdin() {
   }
   const chunks = [];
   for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  return stripTrailingCRLF(Buffer.concat(chunks).toString("utf8"));
 }
 function makeSecretsDeps(cfg) {
   return {
@@ -31508,6 +31619,10 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("undeclare <key>").description("project-admin self-undeclare: retire a secrets-catalog entry for your own repo (catalog metadata only \u2014 never a value); declare's exact inverse (MMI-Hub#7524). Refuses (409) while a live vault value still exists for the key at any declared stage \u2014 delete the value first (`secrets rm`), then undeclare. A key that is not declared is a no-op, not an error.").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsUndeclare(d, key, { repo: o.repo, json: o.json });
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("verify <key>").description("validate a known provider secret without printing its value; a key with no configured provider verifier falls back to a value-free PRESENT/ABSENT reachability check (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
@@ -33370,9 +33485,13 @@ function applyWaivers(checks, waivers) {
   const set = new Set(waivers);
   return checks.map((c) => !c.ok && set.has(c.label) ? { ...c, waived: true } : c);
 }
+var laneReasons = (doctor) => doctor.findings.filter((f) => (f.severity === "blocker" || f.code === "origin-unverified") && f.code !== SUITE_GUARD_CODE);
+function onlySuiteLeadOwned(doctor) {
+  return !doctor.ready && laneReasons(doctor).length === 0 && doctor.findings.some((f) => f.code === SUITE_GUARD_CODE);
+}
 function laneNotEvaluatedFromThisBranch(doctor) {
   if (doctor.ready) return void 0;
-  const reasons = doctor.findings.filter((f) => f.severity === "blocker" || f.code === "origin-unverified");
+  const reasons = laneReasons(doctor);
   const only = reasons.length === 1 ? reasons[0] : void 0;
   return only?.code === "branch-mismatch" ? only.title : void 0;
 }
@@ -33383,7 +33502,7 @@ function attachTrainDoctorVerdicts(report, trainDoctors) {
   });
   return {
     ...report,
-    ok: report.ok && marked.every((doctor) => doctor.ready || doctor.notEvaluatedFromThisBranch !== void 0),
+    ok: report.ok && marked.every((doctor) => doctor.ready || doctor.notEvaluatedFromThisBranch !== void 0 || onlySuiteLeadOwned(doctor)),
     ...marked.length ? { trainDoctors: marked } : {}
   };
 }
@@ -33397,6 +33516,8 @@ function renderBootstrapVerifyReport(report) {
     lines2.push("", formatTrainDoctor(doctor));
     if (doctor.notEvaluatedFromThisBranch) {
       lines2.push(`  NOT EVALUATED from this branch \u2014 ${doctor.notEvaluatedFromThisBranch}; one checkout stands on one branch, so this lane does not fail the verify (#6677). Run \`mmi-cli devops train doctor --lane ${doctor.lane}\` from that branch for its own verdict.`);
+    } else if (onlySuiteLeadOwned(doctor)) {
+      lines2.push("  SUITE MEMBER: this lane is run from the suite lead (mmi-cli devops suite rcand|release), so suite-member-solo does not fail the verify (#7511).");
     }
   }
   return lines2.join("\n");
@@ -42112,6 +42233,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     try {
       entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
+      if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
@@ -43930,7 +44052,7 @@ ${list}`);
         console.error(line);
       }
     }
-    const credential = await pollToken().catch(() => void 0) ? "app_installation" : "user";
+    const credential = "user";
     if (o.json) printLine(JSON.stringify({ ...result, credential }));
     else printLine(
       `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
@@ -44445,9 +44567,8 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      const watchToken = file === "gh" && args[0] === "run" && args[1] === "watch" ? await pollToken() : void 0;
       try {
-        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...watchToken ? { env: { ...process.env, GH_TOKEN: watchToken } } : {} })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.58",
+  "version": "4.5.59",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",