@mutmutco/cli 4.6.13 → 4.6.14

package/dist/main.cjs

@@ -13880,6 +13880,49 @@ function boardClaimStatusFlagRecovery(flag, canonicalPath, argv) {
     corrected: `mmi-cli ${kept.join(" ")}`
   };
 }
+function boardClaimLaneFlagRecovery(flag, canonicalPath, argv) {
+  if (canonicalPath !== "oracle board claim") return void 0;
+  if (!/^--(?:agent|actor|on-behalf)(?:=|$)/.test(flag)) return void 0;
+  const baseFlag = flag.split("=")[0];
+  const kept = [];
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith(`${baseFlag}=`)) {
+      kept.push(`--for=${tok.slice(baseFlag.length + 1)}`);
+      continue;
+    }
+    if (tok === baseFlag) {
+      kept.push("--for");
+      if (i + 1 >= argv.length || argv[i + 1].startsWith("-")) kept.push("<login>");
+      continue;
+    }
+    kept.push(tok);
+  }
+  return {
+    message: `unknown option '${baseFlag}' \u2014 \`oracle board claim\` declares lane attribution as \`--for <login>\` ('assign to this login instead of @me \u2014 agent claims on behalf of the master')`,
+    corrected: `mmi-cli ${kept.join(" ")}`
+  };
+}
+var BOARD_CLAIM_AGENT_FLAGS = /* @__PURE__ */ new Set(["--agent", "--lane", "--by"]);
+function boardClaimAgentFlagRecovery(flag, canonicalPath, argv) {
+  if (canonicalPath !== "oracle board claim") return void 0;
+  const bare = flag.split("=")[0];
+  if (!BOARD_CLAIM_AGENT_FLAGS.has(bare)) return void 0;
+  const kept = [];
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith(`${bare}=`)) continue;
+    if (tok === bare) {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) i++;
+      continue;
+    }
+    kept.push(tok);
+  }
+  return {
+    message: `unknown option '${bare}' \u2014 \`oracle board claim\` stamps the claiming session itself \u2014 drop ${bare} and its value; \`--for <login>\` assigns on behalf of another login`,
+    corrected: `mmi-cli ${kept.join(" ")}`
+  };
+}
 function issueCommentAppendOnlyRecovery(flag, canonicalPath, argv) {
   if (canonicalPath !== "oracle issue comment") return void 0;
   const hasEditVerb = argv.some((t, idx) => idx >= 3 && !t.startsWith("-") && /^(?:edit|update|patch|modify)$/i.test(t));
@@ -18996,9 +19039,10 @@ function surfaceInferenceSuffix(inferred) {
 }
 function uncertainSurfaceRefusal(inferred, command = "issue create") {
   if (!inferred.uncertain) return void 0;
+  const bareName = inferred.label.toLowerCase().startsWith(SURFACE_PREFIX) ? inferred.label.slice(SURFACE_PREFIX.length) : inferred.label;
   const alternatives = inferred.alternatives?.length ? ` Other candidates: ${inferred.alternatives.join(", ")}.` : "";
   return {
-    message: `${command}: surface inference is uncertain (${inferred.reason}) \u2014 pass --surface <value> to choose explicitly or --no-surface only when the filing is genuinely exempt.${alternatives}`,
+    message: `${command}: surface inference is uncertain (${inferred.reason}) \u2014 pass --surface <value> to choose explicitly or --no-surface only when the filing is genuinely exempt. The closest match was ${inferred.label} \u2014 re-run the same create with --surface ${bareName}.${alternatives}`,
     payload: {
       code: ERROR_CODES.ERR_MISSING_FLAG,
       offending_flag: "--surface",
@@ -25472,7 +25516,7 @@ var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
 var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
-var BLESSED_RUNNER_CHOICE_SHA = "f6b691f966611ec2a3b688c74c92a92f23133f41";
+var BLESSED_RUNNER_CHOICE_SHA = "cf35db6cdf053746bc5b2cd75f241a7d93cf7f48";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
@@ -27702,10 +27746,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.13",
-    tag: "v4.6.13",
-    commit: "70ee5f41b61b",
-    npm: "@mutmutco/cli@4.6.13"
+    version: "4.6.14",
+    tag: "v4.6.14",
+    commit: "5bbc73222ade",
+    npm: "@mutmutco/cli@4.6.14"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27722,14 +27766,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.13"
+          v3Target: "v4.6.14"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.13 and redeploy the Hub Lambda from tag v4.6.13 (70ee5f41b61b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.13 (@mutmutco/cli@4.6.13, tag commit 70ee5f41b61b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.14 and redeploy the Hub Lambda from tag v4.6.14 (5bbc73222ade); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.14 (@mutmutco/cli@4.6.14, tag commit 5bbc73222ade \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -32308,7 +32352,7 @@ var STANDARD_HOSTED_ALLOWLIST = [
   ["mutmutco/MMI-Hub", ".github/workflows/launcher-build.yml", "build", "windows-latest"],
   ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"]
 ];
-var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*'([^']+)'\s*\|\|\s*)?fromJSON\(needs\.([\w-]+)\.outputs\.(\w+_runs_on)\s*\|\|\s*('[^']+')\)\s*\}\}$/;
+var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*(?:'(?<leg>[^']+)'|fromJSON\(needs\.(?<legDecider>[\w-]+)\.outputs\.(?<legOutput>\w+_runs_on)\s*\|\|\s*(?<legOwned>'[^']+')\))\s*\|\|\s*)?fromJSON\(needs\.(?<decider>[\w-]+)\.outputs\.(?<output>\w+_runs_on)\s*\|\|\s*(?<owned>'[^']+')\)\s*\}\}$/;
 var RUNNER_CHOICE_ACTION = "mutmutco/MMI-Hub/.github/actions/runner-choice";
 function runnerChoiceProduces(job, decider, output, source) {
   const needs = job.needs;
@@ -32338,8 +32382,11 @@ function classifyJobRunnerCost(job, allowance2, source) {
   if (approved(raw) || allowance2 === "windows-11-arm" && raw === allowance2) return "standard-hosted";
   const fallback = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'([^']+)'\s*\|\|\s*(fromJSON\('[^']+'\))\s*\}\}$/.exec(raw);
   if (fallback && approved(fallback[1]) && classifyRunnerCost("${{ " + fallback[2] + " }}") === "self-hosted") return "standard-hosted";
-  const spill = HOSTED_SPILL_RE.exec(raw);
-  if (spill && source && (!spill[1] || STANDARD_HOSTED_LABEL_RE.test(spill[1])) && classifyRunnerCost(`\${{ fromJSON(${spill[4]}) }}`) === "self-hosted" && runnerChoiceProduces(job, spill[2], spill[3], source)) return "standard-hosted";
+  const layerZero = /^\$\{\{\s*vars\.[\w-]+\s*==\s*'off'\s*&&\s*(fromJSON\('[^']+'\))\s*\|\|\s*'([^']+)'\s*\}\}$/.exec(raw);
+  if (layerZero && classifyRunnerCost("${{ " + layerZero[1] + " }}") === "self-hosted" && STANDARD_HOSTED_LABEL_RE.test(layerZero[2])) return "standard-hosted";
+  const spill = HOSTED_SPILL_RE.exec(raw)?.groups;
+  const legOk = (g) => g.legDecider ? classifyRunnerCost(`\${{ fromJSON(${g.legOwned}) }}`) === "self-hosted" && Boolean(source) && runnerChoiceProduces(job, g.legDecider, g.legOutput, source) : !g.leg || STANDARD_HOSTED_LABEL_RE.test(g.leg);
+  if (spill && source && legOk(spill) && classifyRunnerCost(`\${{ fromJSON(${spill.owned}) }}`) === "self-hosted" && runnerChoiceProduces(job, spill.decider, spill.output, source)) return "standard-hosted";
   const direct = classifyRunnerCost(raw);
   const matrix = /^\$\{\{\s*matrix\.([\w-]+)(?:\.([\w-]+))?\s*\}\}$/.exec(raw);
   if (!matrix || direct === "hosted") return direct;
@@ -39219,6 +39266,92 @@ function auditRunnerFallbacks(repo, files, closure) {
     remediation: f.cost === "hosted" || f.cost === "unknown" ? "Resolve source reads and unsupported selectors/callees; preserve checks and artifacts. See gh-runner-runbook.md." : void 0
   }));
 }
+var yamlStrings = (value) => typeof value === "string" ? [value] : value && typeof value === "object" ? Object.values(value).flatMap(yamlStrings) : [];
+var survivesDeciderFailure = (job) => {
+  const guard = typeof job.if === "string" ? job.if.replace(/^\s*\$\{\{\s*|\s*\}\}\s*$/g, "").trim() : "";
+  return (guard === "!cancelled()" || guard.startsWith("!cancelled() &&") || /\balways\(\)/.test(guard)) && !/\bsuccess\(\)/.test(guard);
+};
+function auditDeciderSkipTrap(repo, files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    let doc;
+    try {
+      doc = (0, import_yaml2.parse)(body);
+    } catch {
+      continue;
+    }
+    const jobs = plainRecord(doc) && plainRecord(doc.jobs) ? Object.entries(doc.jobs).filter(([, j]) => plainRecord(j)) : [];
+    const deciders = /* @__PURE__ */ new Set();
+    for (const [id, job] of jobs) {
+      const selector = [
+        typeof job["runs-on"] === "string" ? job["runs-on"] : "",
+        ...typeof job.uses === "string" ? yamlStrings(job.with) : []
+      ].join("\n");
+      const found = [...new Set([...selector.matchAll(/needs\.([\w-]+)\.outputs\.\w+_runs_on/g)].map((m) => m[1]))];
+      if (!found.length) continue;
+      for (const d of found) deciders.add(d);
+      const guard = typeof job.if === "string" ? job.if.replace(/^\s*\$\{\{\s*|\s*\}\}\s*$/g, "").trim() : "";
+      const guarded = survivesDeciderFailure(job);
+      checks.push({
+        ok: guarded,
+        label: `job reading decider ${found.map((d) => `needs.${d}`).join(", ")} outputs survives a failed decider (#9670): ${repo}/${path2}:${id}`,
+        detail: guarded ? void 0 : `${id}: ${guard ? `if: \`${guard}\`` : "no if:"} lets a failed decider SKIP this job, and a skipped required check counts as passing`,
+        remediation: guarded ? void 0 : `Start the job's if: with \`!cancelled() &&\` (or use \`always()\`), never \`success()\`, so it runs on the owned fallback when ${found[0]} fails. See gh-runner-runbook.md.`
+      });
+      if (typeof job.uses === "string") {
+        const uses = job.uses;
+        const callee = uses.startsWith("./.github/workflows/") ? files.find((file) => file.path === uses.slice(2)) : void 0;
+        let target;
+        if (callee) {
+          try {
+            target = (0, import_yaml2.parse)(callee.body);
+          } catch {
+          }
+        }
+        const targetJobs = plainRecord(target) && plainRecord(target.jobs) ? target.jobs : void 0;
+        if (!targetJobs) checks.push({
+          ok: false,
+          label: `unverified decider consumer (#9678): ${repo}/${path2}:${id}`,
+          detail: `${id}: reusable workflow ${job.uses} is unresolved; decider runner inputs cannot be verified`
+        });
+        else {
+          const inputs = plainRecord(job.with) ? Object.entries(job.with).filter(([, value]) => yamlStrings(value).some((text) => /needs\.[\w-]+\.outputs\.\w+_runs_on/.test(text))).map(([name]) => name) : [];
+          for (const [targetId, targetJob] of Object.entries(targetJobs)) {
+            if (!plainRecord(targetJob) || typeof targetJob["runs-on"] !== "string") continue;
+            if (!inputs.some((name) => new RegExp(`inputs\\.${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`).test(targetJob["runs-on"]))) continue;
+            const ok = survivesDeciderFailure(targetJob);
+            checks.push({
+              ok,
+              label: `reusable decider consumer survives a failed decider (#9678): ${repo}/${callee.path}:${targetId}`,
+              detail: ok ? void 0 : `${id} -> ${targetId}: callee runner input needs !cancelled() or always(), never success()`
+            });
+          }
+        }
+      }
+    }
+    if (deciders.size) {
+      const possibleResult = /\btoJSON\s*\(\s*needs\s*\)|\bneeds\s*\.\s*\*\s*\.\s*result\b|\bneeds(?:\.[\w-]+)?\s*\[\s*(?!['"][\w-]+['"]\s*\])/;
+      for (const [id, job] of jobs) if (yamlStrings(job).some((text) => possibleResult.test(text))) {
+        checks.push({
+          ok: false,
+          label: `possible decider result read (#9678): ${repo}/${path2}:${id}`,
+          detail: `${id}: toJSON(needs), wildcard result or dynamic needs read may expose a failed decider result; use only explicit decider outputs`
+        });
+      }
+    }
+    for (const decider of deciders) {
+      const read = new RegExp(String.raw`needs(?:\.${decider}|\[\s*['"]${decider}['"]\s*\])(?:\.result|\[\s*['"]result['"]\s*\])`);
+      const readers = jobs.filter(([, job]) => yamlStrings(job).some((text) => read.test(text))).map(([id]) => id);
+      checks.push({
+        ok: readers.length === 0,
+        label: `needs.${decider}.result is never read (#9670): ${repo}/${path2}`,
+        detail: readers.length ? `${readers.join(", ")} read needs.${decider}.result; a decider that failed to start has no result to trust` : void 0,
+        remediation: readers.length ? `Remove the needs.${decider}.result read from ${readers.join(", ")}; the empty ${decider} output already selects the owned fallback. See gh-runner-runbook.md.` : void 0
+      });
+    }
+  }
+  return checks;
+}
 var LIVE_SELF_HOSTED_LINUX_LABELS = /* @__PURE__ */ new Set([
   "self-hosted",
   "linux",
@@ -40194,6 +40327,7 @@ async function auditRepoCi(repo, callerDeps) {
       } catch (e) {
         checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: e instanceof WorkflowSourceError ? e.message : "workflow source: read-failed" });
       }
+      checks.push(...auditDeciderSkipTrap(repo, workflows));
       checks.push(...auditSelfHostedRunnerHygiene(workflows));
       checks.push(...auditJevOutcomes(workflows));
       checks.push(...auditVerdictReceipt(workflows));
@@ -41972,11 +42106,13 @@ async function runPrLandOnce(prNumber, options, deps) {
       const preflight2 = await deps.preflightQueue(prNumber, repo, pinned);
       if (preflight2 && preflight2.mergeStatus === "failed") {
         const rawError = preflight2.error ?? "queue preparation needed";
+        const nextAction = preflight2.preparation?.nextAction;
+        const error = nextAction ? rawError.includes(nextAction) ? rawError : `${rawError} \u2014 ${nextAction}` : !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
         return {
           ...base,
           mergeStatus: "failed",
           ...preflight2.preparation ? { preparation: preflight2.preparation } : {},
-          error: !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError
+          error
         };
       }
     }
@@ -42030,7 +42166,8 @@ async function runPrLandOnce(prNumber, options, deps) {
   }
   if (merge.mergeStatus === "failed") {
     const rawError = merge.error ?? "merge failed";
-    const error = hasQueue && !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
+    const nextAction = merge.preparation?.nextAction;
+    const error = nextAction ? rawError.includes(nextAction) ? rawError : `${rawError} \u2014 ${nextAction}` : hasQueue && !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
     return { ...base, ...merge.preparation ? { preparation: merge.preparation } : {}, ...merge.outcomeUnknown ? { outcomeUnknown: true } : {}, error };
   }
   if (hasQueue) {
@@ -44417,7 +44554,7 @@ function refuseNotClaimable(e, json) {
   process.exitCode = 1;
   return true;
 }
-var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n";
+var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
 function flattenBoardReport(report) {
   const closingByRef = /* @__PURE__ */ new Map();
   for (const pull of report.pullRequests ?? []) {
@@ -66222,12 +66359,12 @@ async function readRunLog(id, o, runner) {
   const base = `repos/${repo}/actions/runs/${runId}`;
   const pages = JSON.parse(await readAppApi(`${base}${attempt === void 0 ? "" : `/attempts/${attempt}`}/jobs`, runner));
   const jobs = pages.flatMap((page) => page.jobs);
-  const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName);
+  const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName || String(job.id) === jobName);
   const result = { runId, repo, jobs: [] };
   if (!selected.length && jobName === void 0) return { result, exitCode: 1, message: `read run log: no matching job for run ${runId} in ${repo}; conclusions seen: ${[...new Set(jobs.map((j) => j.conclusion ?? "pending"))].join(", ") || "none"}` };
   if (!selected.length) {
     const listed = jobs.slice(0, 30).map((j) => `${j.name} (${j.id})`).join(", ");
-    return { result, exitCode: 1, message: `read run log: --job takes the exact job name, not its id; jobs in run ${runId}: ${listed || "none"}${jobs.length > 30 ? `, \u2026+${jobs.length - 30} more` : ""}` };
+    return { result, exitCode: 1, message: `read run log: --job takes the exact job name or numeric job id; jobs in run ${runId}: ${listed || "none"}${jobs.length > 30 ? `, \u2026+${jobs.length - 30} more` : ""}` };
   }
   for (const job of selected) {
     const text = await readAppApi(`repos/${repo}/actions/jobs/${parseBrokerId(String(job.id), "job id")}/logs`, runner);
@@ -66236,7 +66373,7 @@ async function readRunLog(id, o, runner) {
   return { result, exitCode: 0 };
 }
 function registerRunLogRead(run, runner) {
-  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
+  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name or numeric job id").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
     requireBrokerApp("read run log");
     const env = brokerChildEnv();
     try {
@@ -66324,6 +66461,11 @@ function localJqEnv(base = process.env) {
   }
   return env;
 }
+function formatJqFailureMessage(code, stderr) {
+  const base = `--jq expression failed (jq exit ${code}): ${stderr.trim()}`;
+  if (!/Invalid escape/i.test(stderr)) return base;
+  return `${base} \u2014 the expression is handed to jq verbatim (mmi-cli never re-quotes it), so if a shell or seat layer collapsed a backslash, use an escape-free form such as \`test("bundle[.]css")\` or \`contains("bundle.css")\`, or drop --jq and filter the JSON locally`;
+}
 var systemJqRunner = (expr, input, env) => new Promise((resolveOut, reject2) => {
   const child2 = (0, import_node_child_process20.spawn)("jq", [...process.platform === "win32" ? ["--binary"] : [], "-r", "-c", expr], { env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
   let stdout = "";
@@ -66335,7 +66477,7 @@ var systemJqRunner = (expr, input, env) => new Promise((resolveOut, reject2) =>
     stderr += chunk;
   });
   child2.on("error", (e) => reject2(e.code === "ENOENT" ? new Error("--jq needs the jq binary on PATH and none was found \u2014 install jq, or drop --jq and filter the --json output locally") : e));
-  child2.on("close", (code) => code === 0 ? resolveOut(stdout) : reject2(new Error(`--jq expression failed (jq exit ${code}): ${stderr.trim()}`)));
+  child2.on("close", (code) => code === 0 ? resolveOut(stdout) : reject2(new Error(formatJqFailureMessage(code, stderr))));
   child2.stdin.on("error", () => {
   });
   child2.stdin.end(input);
@@ -66949,7 +67091,7 @@ var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
 var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
 var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
 var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/issues/comments/{id}, repos/{owner}/{repo}/issues/{n}/comments[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/artifacts[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
-var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing.";
+var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing. Piping empty stdout into JSON.parse hides the stderr refusal; check the exit code before parsing.";
 var TYPED_READ_ROUTE_RE = new RegExp(`^repos/(${NAME})/(${NAME})/(issues|pulls)(?:/(comments/\\d+|\\d+)(?:/([a-z_]+))?)?$`);
 function typedReadHint(path2) {
   const match = TYPED_READ_ROUTE_RE.exec(path2.split("?")[0]);
@@ -66970,7 +67112,7 @@ function typedReadHint(path2) {
   }
   if (!item) return say(`mmi-cli devops read pr list --repo ${slug} --json number,title,state,headRefName`);
   if (item.startsWith("comments/")) return say(`mmi-cli devops read pr view <pr> --repo ${slug} --json comments,reviews`);
-  return say(`mmi-cli devops read pr view ${item} --repo ${slug} --json title,state,comments,reviews,commits,statusCheckRollup`);
+  return say(`mmi-cli devops read pr view ${item} --repo ${slug} --json title,state,comments,reviews,commits,statusCheckRollup,mergedAt,mergeCommit,headRefOid`, "; `mergedAt`, `mergeCommit` and `headRefOid` carry the merge and head evidence, and `--json` is a field list callers may narrow or extend");
 }
 function runsReadHint(path2) {
   const q = path2.indexOf("?");
@@ -67015,11 +67157,18 @@ function checkRunsReadHint(path2) {
   const slug = `${match[1]}/${match[2]}`;
   return ` Check-suite and check-run routes are deliberately outside the App allowlist \u2014 read per-check / per-job conclusions with the allowlisted \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs/<id>/jobs?per_page=100"\` or \`mmi-cli devops read run view <id> --repo ${slug} --json databaseId,workflowName,event,status,conclusion,jobs\`; check-run annotations and output text have no App-token read (ask a human token holder).`;
 }
+function workflowRunsReadHint(path2) {
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/actions/workflows(?:/([^/?#]+)(?:/runs)?)?(?:[/?#]|$)`).exec(path2.split("?")[0]);
+  if (!match) return "";
+  const [, owner, repo, workflow] = match;
+  const slug = `${owner}/${repo}`;
+  return ` Workflow routes are outside the App allowlist \u2014 use the typed workflow runs read \`MMI_ACTOR=app mmi-cli devops read run list --repo ${slug} --workflow ${workflow ?? "<workflow.yml>"} --branch <branch> --limit <n> --json databaseId,workflowName,event,status,conclusion\`, or the allowlisted REST runs list \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs?branch=<branch>&per_page=<n>"\`.`;
+}
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${workflowRunsReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -67079,7 +67228,7 @@ function registerApiReadCommands(program3, overrides) {
       if (!zip && o.out !== void 0) {
         return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>), or use the typed read (e.g. \`mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion\`). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
       }
-      return fail(shapes);
+      return fail(`${shapes} \u2014 append \`--out <file>\` to this command (e.g. \`MMI_ACTOR=app mmi-cli devops api get ${req.path} --out .jerv/tmp/job.log\`), or for job logs use the typed read \`MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> --job <name|id>\`. Shell redirection (\`>\` / \`2>&1\`) is not a substitute: this refusal exits 1 on stderr with nothing written to stdout, so \`>\` leaves a zero-byte file \u2014 delete it and check the exit code.`);
     }
     const appRoute = req.kind.startsWith("actions-") || req.kind.startsWith("release-");
     if (appRoute) requireBrokerApp("api get");
@@ -70650,7 +70799,7 @@ function envelopeAwareWriteErr(str2) {
     const invoked = resolveCommandFromArgv(program2, argv);
     const invokedPath = invoked ? canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked) : void 0;
     const canonicalArgv = canonicalArgvFor(argv);
-    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, invokedPath, canonicalArgv) ?? issueCommentAppendOnlyRecovery(flag, invokedPath, canonicalArgv) ?? trainPlanRedundantFlagRecovery(flag, invokedPath, canonicalArgv) : void 0;
+    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, invokedPath, canonicalArgv) ?? boardClaimLaneFlagRecovery(flag, invokedPath, canonicalArgv) ?? boardClaimAgentFlagRecovery(flag, invokedPath, canonicalArgv) ?? issueCommentAppendOnlyRecovery(flag, invokedPath, canonicalArgv) ?? trainPlanRedundantFlagRecovery(flag, invokedPath, canonicalArgv) : void 0;
     if (claimStatus) {
       if (argvWantsJson3()) {
         process.stderr.write(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.13",
+  "version": "4.6.14",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",