@mutmutco/cli 4.6.16 → 4.6.17

package/dist/main.cjs

@@ -27805,10 +27805,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.16",
-    tag: "v4.6.16",
-    commit: "4bd6f2423939",
-    npm: "@mutmutco/cli@4.6.16"
+    version: "4.6.17",
+    tag: "v4.6.17",
+    commit: "efe71da889a6",
+    npm: "@mutmutco/cli@4.6.17"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27825,14 +27825,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.16"
+          v3Target: "v4.6.17"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.16 and redeploy the Hub Lambda from tag v4.6.16 (4bd6f2423939); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.16 (@mutmutco/cli@4.6.16, tag commit 4bd6f2423939 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.17 and redeploy the Hub Lambda from tag v4.6.17 (efe71da889a6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.17 (@mutmutco/cli@4.6.17, tag commit efe71da889a6 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -47165,7 +47165,7 @@ function sshRemoteCommand(remoteCommand) {
 function shellSingleQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-var SSH_RECIPE_AGENT_NOTE = "# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli devops runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.";
+var SSH_RECIPE_AGENT_NOTE = '# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli devops runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.\n# For a multi-line remote body add --stdin (or --body <file>): the recipe then runs `sh -s` on the box,\n# and you stream the body over stdin \u2014 `bash "<path>" < "<body-file>"` \u2014 with no remote re-quoting (#9750).';
 function sshRecipeScript(box, remoteCommand) {
   return `#!/usr/bin/env bash
 ${formatSshRecipe(box, remoteCommand)}
@@ -47249,8 +47249,16 @@ function registerBoxCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  box.command("get <name> [command...]").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (runs under the keyless vault wrapper and loads the key into an ssh-agent; the key is never written to a file or echoed)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, command, o) => {
+  box.command("get <name> [command...]").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (runs under the keyless vault wrapper and loads the key into an ssh-agent; the key is never written to a file or echoed)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").option("--stdin", "with --ssh --script: write the recipe with remote command sh -s so a multi-line script can be piped or redirected on stdin without remote shell re-quoting (#9750)").option("--body <file>", 'with --ssh --script: same as --stdin, and name <file> in the printed run line: bash "<script>" < "<file>" (#9750)').action(async (name, command, o) => {
     try {
+      if ((o.stdin || o.body) && (!o.ssh || !o.script)) {
+        await failGraceful("runtime box get: --stdin/--body requires --ssh --script <path> (it writes an sh -s recipe that reads the remote body from stdin)");
+        return;
+      }
+      if ((o.stdin || o.body) && command && command.length) {
+        await failGraceful("runtime box get: cannot combine --stdin/--body with trailing [command...] arguments \u2014 put the commands in the stdin body file instead");
+        return;
+      }
       const { boxes, incomplete } = await fetchInventory();
       const result = lookupBox(name, boxes, incomplete);
       if (result.kind === "unknown") {
@@ -47269,16 +47277,19 @@ function registerBoxCommands(program3) {
         await failGraceful("runtime box get: --script requires --ssh (it writes the ssh connect recipe)");
         return;
       }
-      const remote = command && command.length ? command.join(" ") : void 0;
+      const useStdin = Boolean(o.stdin || o.body);
+      const remote = useStdin ? "sh -s" : command && command.length ? command.join(" ") : void 0;
+      const stdinSource = o.body ? `"${o.body}"` : "<body.sh>";
       const wroteScript = o.ssh && o.script ? o.script : null;
+      const runLine = wroteScript ? useStdin ? `bash "${wroteScript}" < ${stdinSource}` : `bash "${wroteScript}"` : void 0;
       if (wroteScript) (0, import_node_fs37.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
           incomplete,
-          ...wroteScript ? { script: { path: wroteScript, run: `bash "${wroteScript}"` } } : {}
+          ...wroteScript ? { script: { path: wroteScript, run: runLine, ...useStdin ? { stdin: o.body ?? true } : {} } } : {}
         }, null, 2));
-      } else if (wroteScript) console.log(`wrote ${wroteScript} \u2014 run: bash "${wroteScript}"`);
+      } else if (wroteScript) console.log(`wrote ${wroteScript} \u2014 run: ${runLine}`);
       else if (o.ssh) console.log(`${formatSshRecipe(found, remote)}
 ${SSH_RECIPE_AGENT_NOTE}`);
       else console.log(formatBoxTable([found]));
@@ -68400,6 +68411,22 @@ function stageAllowlistConfig(project2) {
   const stages = cfg.stages.filter((s) => ALLOWLIST_STAGES.includes(s));
   return stages.length > 0 ? { key: cfg.key, stages } : null;
 }
+function resolveStageAllowlistTarget(repo, projects) {
+  if (!projects) return { kind: "registry-unreadable", exitCode: 1, message: "org access sync: could not read the org project registry \u2014 nothing written" };
+  const project2 = projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())) ?? null;
+  if (!project2) return { kind: "unregistered", exitCode: 1, message: `org access sync: ${repo} is not in the org project registry \u2014 nothing written` };
+  if (project2.stageAllowlist == null) {
+    return {
+      kind: "no-opt-in",
+      exitCode: 0,
+      json: { repo, optIn: null, stages: [], skipped: "no-stageAllowlist" },
+      message: `org access sync: ${repo} has no stageAllowlist opt-in \u2014 nothing to rebuild (set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\`)`
+    };
+  }
+  const config = stageAllowlistConfig(project2);
+  if (!config) return { kind: "malformed", exitCode: 1, message: `org access sync: ${repo} has a malformed stageAllowlist in the registry \u2014 set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\`` };
+  return { kind: "sync", exitCode: 0, config };
+}
 function developerAdminLogins(collaborators) {
   const logins = /* @__PURE__ */ new Set();
   for (const c of collaborators) {
@@ -72215,11 +72242,13 @@ access.command("sync [repo]").description("rebuild the stage allowlist (e.g. MM-
   if (!repo) return fail("org access sync: pass <owner/repo> or run inside a repo checkout");
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) return fail("org access sync: Hub API URL not configured");
-  const projects = await fetchProjectsList(registryClientDeps(cfg));
-  if (!projects) return failGraceful("org access sync: could not read the org project registry \u2014 nothing written");
-  const project2 = projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())) ?? null;
-  const config = stageAllowlistConfig(project2);
-  if (!config) return failGraceful(`org access sync: ${repo} has no stageAllowlist opt-in \u2014 set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\``);
+  const target = resolveStageAllowlistTarget(repo, await fetchProjectsList(registryClientDeps(cfg)));
+  if (target.kind === "no-opt-in") {
+    console.log(o.json ? JSON.stringify(target.json, null, 2) : target.message);
+    return;
+  }
+  if (target.kind !== "sync") return failGraceful(target.message);
+  const config = target.config;
   const secretsDeps = makeSecretsDeps(cfg);
   const client = defaultGitHubClient();
   const result = await syncStageAllowlist({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.16",
+  "version": "4.6.17",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",