@mutmutco/cli 4.5.62 → 4.5.63

package/dist/main.cjs

@@ -8489,6 +8489,22 @@ function shouldWithdrawSurfaceFlag(result) {
 
 // src/secrets-transport.ts
 init_client_version();
+
+// ../shared/quota-attribution.ts
+var ATTRIBUTION_MAX = 120;
+function sanitizeAttribution(value, max = ATTRIBUTION_MAX) {
+  if (typeof value !== "string" || !Number.isInteger(max) || max < 1) return void 0;
+  const cleaned = value.replace(/[^A-Za-z0-9 ._/@:-]/g, "").replace(/\s+/g, " ").trim().slice(0, max);
+  return cleaned.length > 0 ? cleaned : void 0;
+}
+function attributionFields(attr) {
+  if (!attr) return {};
+  const command = sanitizeAttribution(attr.command);
+  const via = sanitizeAttribution(attr.via);
+  return { ...command ? { for: command } : {}, ...via ? { via } : {} };
+}
+
+// src/secrets-transport.ts
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
@@ -8664,7 +8680,7 @@ async function fetchSecretValue(deps, key, opts, diagnose = false) {
     const res = await fetchVaultRead(deps, `${deps.apiUrl}/secrets/get`, {
       method: "POST",
       headers: await deps.headers({ "content-type": "application/json" }),
-      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} })
+      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {}, ...attributionFields(opts.attribution) })
     });
     if (!res.ok) {
       if (diagnose) {
@@ -17156,10 +17172,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.62",
-    tag: "v4.5.62",
-    commit: "5328997bb80a",
-    npm: "@mutmutco/cli@4.5.62"
+    version: "4.5.63",
+    tag: "v4.5.63",
+    commit: "89c6b4bfae7e",
+    npm: "@mutmutco/cli@4.5.63"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17176,14 +17192,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.62"
+          v3Target: "v4.5.63"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.62 and redeploy the Hub Lambda from tag v4.5.62 (5328997bb80a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.62 (@mutmutco/cli@4.5.62, tag commit 5328997bb80a \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.63 and redeploy the Hub Lambda from tag v4.5.63 (89c6b4bfae7e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.63 (@mutmutco/cli@4.5.63, tag commit 89c6b4bfae7e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -35608,6 +35624,16 @@ async function suiteRcand(deps, opts) {
   ];
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
+  if (record?.leadReleased && record.announcement === "pending") {
+    const reason = await deps.announceSkipReason(record);
+    if (!reason) throw new Error(`the finished cut ${record.leadRcTag} has an unverified announcement (pending); verify whether it was posted, then finish it with suite release --owner-go before a new cut (never post twice)`);
+    record.announcement = "skipped";
+    record.announcementNote = reason;
+    writeSuiteCut(deps.recordPath, record);
+  }
+  if (record?.leadReleased && !record.announcement) {
+    throw new Error(`the cut ${record.leadRcTag} already released the lead but never announced; finish it with suite release --owner-go before a new cut`);
+  }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
     if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
@@ -35649,6 +35675,17 @@ async function suiteRcand(deps, opts) {
       writeSuiteCut(deps.recordPath, record);
       continue;
     }
+    const onHead = [];
+    for (const tag of (await deps.rcTagsAt(member.repo, member.previousRc)).filter((t) => RC_TAG.test(t))) {
+      if (!await deps.tagSha(member.repo, suiteReleaseTag(tag))) onHead.push(tag);
+    }
+    if (onHead.length > 1) throw new Error(`${member.repo}: several unreleased rc tags sit on its rc head (${onHead.join(", ")}); pin the one to reuse before the suite cut`);
+    if (onHead.length === 1) {
+      member.tag = onHead[0];
+      member.sha = member.previousRc;
+      writeSuiteCut(deps.recordPath, record);
+      continue;
+    }
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m))) {
@@ -44768,6 +44805,16 @@ var GIT_COMMIT_TIMEOUT_MS = 6e4;
 function trainGitArgs(args) {
   return ["-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args];
 }
+async function announceSummaryLineCountRefusal(path2) {
+  let content;
+  try {
+    content = await (0, import_promises9.readFile)(path2, "utf8");
+  } catch (e) {
+    return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
+  }
+  const lines2 = summaryFileLines(content);
+  return lines2.length < 3 || lines2.length > 6 ? `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing` : null;
+}
 async function announceSummaryRefusal(path2, isHub = false) {
   let lines2;
   try {
@@ -45221,6 +45268,10 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const retryDeploy = new Option("--retry-deploy", "re-dispatch the FAILED rc deploy of the promoted candidate in the active rcand ledger \u2014 same tag and SHA, never re-cut or re-pushed (#7053)");
     trainCmd.addOption(commandName === "rcand" ? retryDeploy : retryDeploy.hideHelp());
     trainCmd.option("--repo <owner/repo>", "dry-run plan for a target repo without relying on the current checkout; --apply still uses the current checkout").action(async (o) => {
+      if (commandName === "release" && o.announceSummaryFile) {
+        const refusal = await announceSummaryLineCountRefusal(o.announceSummaryFile);
+        if (refusal) return fail(refusal);
+      }
       try {
         await requireFreshTrainCli(commandName);
       } catch (e) {
@@ -45693,12 +45744,18 @@ async function withEnv(name, value, fn) {
   }
 }
 async function prepareRcCheckout(git3, repo) {
-  if ((await git3(["status", "--porcelain"])).trim()) throw new Error(`${repo}: checkout has uncommitted changes; refuse to switch it to rc for release`);
+  await prepareLaneCheckout(git3, repo, "rc", "release");
+}
+async function prepareDevelopmentCheckout(git3, repo) {
+  await prepareLaneCheckout(git3, repo, "development", "rcand");
+}
+async function prepareLaneCheckout(git3, repo, branch, lane) {
+  if ((await git3(["status", "--porcelain"])).trim()) throw new Error(`${repo}: checkout has uncommitted changes; refuse to switch it to ${branch} for ${lane}`);
   await git3(["fetch", "origin", "--tags"]);
-  await git3(["switch", "rc"]);
-  await git3(["merge", "--ff-only", "origin/rc"]);
-  const [head, origin] = (await git3(["rev-parse", "HEAD", "origin/rc"])).trim().split(/\s+/);
-  if (!head || head !== origin) throw new Error(`${repo}: local rc ${head?.slice(0, 12)} is not origin/rc ${origin?.slice(0, 12)}; stop`);
+  await git3(["switch", branch]);
+  await git3(["merge", "--ff-only", `origin/${branch}`]);
+  const [head, origin] = (await git3(["rev-parse", "HEAD", `origin/${branch}`])).trim().split(/\s+/);
+  if (!head || head !== origin) throw new Error(`${repo}: local ${branch} ${head?.slice(0, 12)} is not origin/${branch} ${origin?.slice(0, 12)}; stop`);
 }
 function rcRunCauseFromLog(log) {
   const causes = [...new Set([...log.matchAll(/##\[error\](?!Process completed with exit code)([^\r\n]+)/g)].map((m) => m[1].trim()).filter(Boolean))];
@@ -45775,6 +45832,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
     }
   };
   const runRcand = async (repo, previousRc, rcWasAbsent) => inTrain(repo, async (deps) => {
+    if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
     await deps.run("git", ["fetch", "origin", "--tags"]);
     let rcNow;
     try {
@@ -45924,6 +45982,12 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
       }
     },
     tagSha,
+    rcTagsAt: async (repo, sha) => {
+      if (!/^[0-9a-f]{40}$/i.test(sha)) return [];
+      const target = await checkout(repo);
+      await exec("git", ["fetch", "--quiet", "origin", "--tags"], target, WATCH_TIMEOUT);
+      return (await exec("git", ["tag", "--points-at", sha, "--list", "v*-rc.*"], target)).split("\n").map((t) => t.trim()).filter(Boolean);
+    },
     contains: async (repo, ancestor, descendant) => {
       const target = await checkout(repo);
       await exec("git", ["fetch", "origin", "--tags"], target);
@@ -51534,9 +51598,13 @@ program2.addHelpText(
   \`mmi-cli commands\` shows the agentic map; \`mmi-cli <house> --help\` lists one house.
 `
 );
+var appActorCommand = "poll";
 function appActorDeps() {
   return {
-    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, { repo: APP_VAULT_REPO }),
+    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, {
+      repo: APP_VAULT_REPO,
+      attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
+    }),
     fetch: (url, init) => fetch(url, init)
   };
 }
@@ -51544,6 +51612,7 @@ setPollTokenProvider(() => pollTokenOrUndefined(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
   const commandPath3 = commandPathOf(actionCommand);
+  appActorCommand = commandPath3;
   emitCliCallTelemetry(commandPath3);
   try {
     await activateAppActor(commandPath3, process.env, () => mintInstallationToken(appActorDeps()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.62",
+  "version": "4.5.63",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",