@mutmutco/cli 4.6.15 → 4.6.16

package/dist/main.cjs

@@ -25523,6 +25523,7 @@ __export(gate_budget_exports, {
   BLESSED_JEV_FAILURES_SHA: () => BLESSED_JEV_FAILURES_SHA,
   BLESSED_KIT_AGENT_FILES_SHA: () => BLESSED_KIT_AGENT_FILES_SHA,
   BLESSED_RUNBOOK_GUARD_SHA: () => BLESSED_RUNBOOK_GUARD_SHA,
+  BLESSED_RUNNER_CHECK_POLICY_SHA: () => BLESSED_RUNNER_CHECK_POLICY_SHA,
   BLESSED_RUNNER_CHOICE_SHA: () => BLESSED_RUNNER_CHOICE_SHA,
   BLESSED_RUNNER_GATE_SHA: () => BLESSED_RUNNER_GATE_SHA,
   BLESSED_RUN_WITH_BUDGET_SHA: () => BLESSED_RUN_WITH_BUDGET_SHA,
@@ -25533,6 +25534,7 @@ __export(gate_budget_exports, {
 });
 var BLESSED_RUN_WITH_BUDGET_SHA = "cb31a94c89729beac83500ad4d301132dcfe2e4c";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
+var BLESSED_RUNNER_CHECK_POLICY_SHA = "67bb2012710a96d21be825c29a5d5c2b4b8001e2";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
 var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
@@ -25912,6 +25914,11 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA,
     GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA,
+    GATE_CHECK_POLICY_SHA: BLESSED_RUNNER_CHECK_POLICY_SHA,
+    // No shared threshold: only a caller's matched complete-check experiment may enable concurrency.
+    GATE_CHECK_PARALLEL_MIN_FREE_MB: "0",
+    GATE_CHECK_POLICY_STEP_YAML: "",
+    GATE_CHECK_POLICY_ENV_YAML: "",
     // #9161: the suite-only kit-file drift action arrived after the shared runner pin, so it carries its own
     // blessed revision — bumping GATE_RUNNER_SHA for it would move every generic repo's toolchain too.
     KIT_AGENT_FILES_SHA: BLESSED_KIT_AGENT_FILES_SHA,
@@ -25979,6 +25986,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches, requiredChecks))) {
     out[key] ??= value;
   }
+  Object.assign(out, gateCheckPolicyYaml(out.GATE_CHECK_POLICY_SHA, out.GATE_CHECK_PARALLEL_MIN_FREE_MB, runtime));
   if (!out.GATE_AFFECTED_CMD.trim()) out.GATE_AFFECTED_CMD = out.GATE_CMD;
   return out;
 }
@@ -26147,6 +26155,26 @@ function gateJevStepsYaml(sha, runtime = "node") {
     GATE_JEV_REPORT_YAML: step("Report test outcomes to Jev", "always() && ", "outcomes")
   };
 }
+function gateCheckPolicyYaml(sha, minFreeMb, runtime) {
+  if (runtime !== "node" || !/^[0-9a-f]{40}$/.test(sha) || !/^0*[1-9][0-9]*$/.test(minFreeMb)) {
+    return { GATE_CHECK_POLICY_STEP_YAML: "", GATE_CHECK_POLICY_ENV_YAML: "" };
+  }
+  return {
+    GATE_CHECK_POLICY_STEP_YAML: [
+      "\n      - name: Choose check scheduling",
+      "\n        id: check-policy",
+      "\n        if: ${{ steps.development-gate.outputs.reuse != 'true' }}",
+      "\n        continue-on-error: true",
+      "\n        timeout-minutes: 1",
+      `
+        uses: mutmutco/MMI-Hub/.github/actions/runner-check-policy@${sha}`,
+      "\n        with:",
+      `
+          min-free-mb: ${yamlScalar(minFreeMb)}`
+    ].join(""),
+    GATE_CHECK_POLICY_ENV_YAML: "\n          RUN_CHECK_SERIAL: ${{ steps.check-policy.outputs.serial || '1' }}"
+  };
+}
 function gateExtraStepsYaml(steps) {
   return steps.map((step) => [
     `
@@ -27186,7 +27214,16 @@ async function auditRepoCollaborators(repo, owners, deps, projectAdmins = /* @__
   }
   return findings;
 }
-async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
+async function directWriters(deps, repo) {
+  const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
+  const writers = /* @__PURE__ */ new Set();
+  for (const c of collabs) {
+    const role = collaboratorRole(c);
+    if (role !== null && POWERED_ROLES.has(role)) writers.add(c.login.toLowerCase());
+  }
+  return writers;
+}
+async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), writers = /* @__PURE__ */ new Set()) {
   let restrictions = null;
   try {
     restrictions = await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection/restrictions`) ?? null;
@@ -27221,15 +27258,16 @@ async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @
   }
   const findings = [];
   const users = (restrictions.users ?? []).map((u) => u.login);
+  const listed = (logins, login) => [...logins].some((entry) => entry.toLowerCase() === login.toLowerCase());
   for (const login of users) {
-    if (!owners.has(login) && !projectAdmins.has(login)) {
+    if (!listed(owners, login) && !listed(projectAdmins, login) && !listed(writers, login)) {
       findings.push({
         repo,
         branch,
         kind: "train-allowlist-extra",
         severity: "medium",
         actor: login,
-        detail: `@${login} is on the ${branch} push allowlist \u2014 legitimate only if an intended full-write project-admin; confirm`,
+        detail: `@${login} is on the ${branch} push allowlist \u2014 legitimate only if an intended full-write member (project-admin or direct repo writer); confirm`,
         remediation: `# if NOT an intended full-write member: gh api -X DELETE repos/${repo}/branches/${branch}/protection/restrictions/users -f users[]="${login}"`
       });
     }
@@ -27296,8 +27334,9 @@ async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /*
   findings.push(...await auditRepoCollaborators(repo, owners, deps, projectAdmins, sanctionedAdmins));
   if (dataAccess) findings.push(...auditDataAccessContracts(repo, dataAccess));
   const track = releaseTrack ?? (repoClass === "content" ? "trunk" : void 0);
+  const writers = repo.toLowerCase() === PLUGIN_READ_REPO2.toLowerCase() ? /* @__PURE__ */ new Set() : await directWriters(deps, repo);
   for (const branch of lockedBranches(repoClass, track)) {
-    findings.push(...await auditTrainBranch(repo, branch, owners, deps, projectAdmins));
+    findings.push(...await auditTrainBranch(repo, branch, owners, deps, projectAdmins, writers));
   }
   return { repo, class: repoClass, releaseTrack: track, ok: !findings.some((f) => f.severity === "high"), findings };
 }
@@ -27766,10 +27805,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.15",
-    tag: "v4.6.15",
-    commit: "ad44168c2ed4",
-    npm: "@mutmutco/cli@4.6.15"
+    version: "4.6.16",
+    tag: "v4.6.16",
+    commit: "4bd6f2423939",
+    npm: "@mutmutco/cli@4.6.16"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27786,14 +27825,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.15"
+          v3Target: "v4.6.16"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.15 and redeploy the Hub Lambda from tag v4.6.15 (ad44168c2ed4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.15 (@mutmutco/cli@4.6.15, tag commit ad44168c2ed4 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.16 and redeploy the Hub Lambda from tag v4.6.16 (4bd6f2423939); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.16 (@mutmutco/cli@4.6.16, tag commit 4bd6f2423939 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -68336,6 +68375,7 @@ function registerSchedulesCommands(program3) {
 var company_emails_default = {
   _comment: "Org-level, NON-secret GitHub login -> company email map (#7678). `mmi-cli oracle org access sync <repo>` maps a repo's current developer/admin collaborators through it to rebuild the stage allowlist a project opts into with the registry field `stageAllowlist` (e.g. MM-Work's MMW_STAGE_ALLOWLIST). Bundled into mmi-cli at build time (cli/src/stage-allowlist.ts) \u2014 one source of truth, edited here in a PR. Keys are lowercase GitHub logins; a collaborator missing here is reported loudly by the sync, never silently dropped.",
   emails: {
+    guzelt: "guzel@mutatismutandis.co",
     jervaise: "suphi@mutatismutandis.co",
     sezenlerinadil: "adil@mutatismutandis.co"
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.15",
+  "version": "4.6.16",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",