@mutmutco/cli 4.6.32 → 4.6.34

package/dist/main.cjs

@@ -27062,6 +27062,71 @@ function contentPutInputArgs(repo, path2, inputFile) {
     inputFile
   ];
 }
+var BANK_REQUEST_REPO = "mutmutco/Jerv-Hub";
+var BANK_REQUEST_LABEL = "bank-request";
+var BANK_REQUEST_SOURCE = "MMI-Hub#9958";
+function bankRequestTitle(repoName2) {
+  return `bank-request: coding-agent::${repoName2}`;
+}
+function bankRequestBody(fullName) {
+  return `Create the coding-agent memory bank for \`${fullName}\` (asked by \`mmi-cli devops bootstrap apply\`; see ${BANK_REQUEST_SOURCE}).`;
+}
+function planBankRequest(fullName, existing) {
+  const parsed = parseOwnerRepo(fullName);
+  const base = { title: bankRequestTitle(parsed.name), label: BANK_REQUEST_LABEL, body: bankRequestBody(parsed.fullName) };
+  if (existing == null) return { ...base, action: "skip", reason: `could not read ${BANK_REQUEST_REPO} issues` };
+  const found = existing.find((issue) => issue?.title === base.title);
+  if (found) {
+    return {
+      ...base,
+      action: "exists",
+      number: found.number,
+      state: found.state ?? "open",
+      url: found.url ?? `https://github.com/${BANK_REQUEST_REPO}/issues/${found.number}`
+    };
+  }
+  return { ...base, action: "create" };
+}
+var oneLine = (e) => String(e?.message ?? e).split("\n")[0].trim();
+function bankRequestManualStep(request, reason) {
+  return `file it by hand at https://github.com/${BANK_REQUEST_REPO}/issues/new \u2014 title "${request.title}", label ${request.label}, body: ${request.body} (${reason})`;
+}
+function renderBankRequestPlan(result) {
+  return [
+    "bootstrap apply \u2014 coding-agent memory bank request (dry-run; no issue filed):",
+    `  PLAN file issue "${result.title}" (label ${result.label}) in ${BANK_REQUEST_REPO}`,
+    `  body: ${result.body}`
+  ].join("\n");
+}
+function renderBankRequestLine(result) {
+  if (result.status === "opened") {
+    return `memory bank request: ${BANK_REQUEST_REPO}#${result.number} opened \u2014 "${result.title}" (label ${result.label})${result.url ? ` ${result.url}` : ""}`;
+  }
+  if (result.status === "exists") {
+    return `memory bank request: already requested \u2014 ${BANK_REQUEST_REPO}#${result.number} (${result.state})${result.url ? ` ${result.url}` : ""}`;
+  }
+  return `memory bank request: SKIPPED (${result.reason ?? "not attempted"}) \u2014 ${bankRequestManualStep(result, result.reason ?? "not attempted")}`;
+}
+async function runBankRequest(fullName, options, deps) {
+  const parsed = parseOwnerRepo(fullName);
+  const request = { title: bankRequestTitle(parsed.name), label: BANK_REQUEST_LABEL, body: bankRequestBody(parsed.fullName) };
+  if (options.dryRun) return { ...request, status: "planned" };
+  let existing;
+  try {
+    existing = await deps.listIssues();
+  } catch (e) {
+    return { ...request, status: "skipped", reason: `could not read ${BANK_REQUEST_REPO} issues: ${oneLine(e)}` };
+  }
+  const plan = planBankRequest(fullName, existing);
+  if (plan.action === "exists") return { ...request, status: "exists", number: plan.number, state: plan.state, url: plan.url };
+  if (plan.action === "skip") return { ...request, status: "skipped", reason: plan.reason };
+  try {
+    const created = await deps.createIssue(request);
+    return { ...request, status: "opened", number: created.number, url: created.url };
+  } catch (e) {
+    return { ...request, status: "skipped", reason: `App issue write failed: ${oneLine(e)}` };
+  }
+}
 
 // src/train-apply-contracts.ts
 var import_node_fs21 = require("node:fs");
@@ -28301,10 +28366,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.32",
-    tag: "v4.6.32",
-    commit: "0e477e5e2765",
-    npm: "@mutmutco/cli@4.6.32"
+    version: "4.6.34",
+    tag: "v4.6.34",
+    commit: "a094b40adf8d",
+    npm: "@mutmutco/cli@4.6.34"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28321,14 +28386,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.32"
+          v3Target: "v4.6.34"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.32 and redeploy the Hub Lambda from tag v4.6.32 (0e477e5e2765); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.32 (@mutmutco/cli@4.6.32, tag commit 0e477e5e2765 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.34 and redeploy the Hub Lambda from tag v4.6.34 (a094b40adf8d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.34 (@mutmutco/cli@4.6.34, tag commit a094b40adf8d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -51508,6 +51573,7 @@ function registerBootstrapCommands(program3) {
     }
     const actions = [];
     const applied = [];
+    let bankRequest = null;
     let applyDeployModel;
     let applyProjectType;
     try {
@@ -51986,6 +52052,48 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         applied.push(`ddb register ${registerPayload.slug} (failed: ${why})`);
       }
     }
+    if (!onlyTarget) {
+      bankRequest = await runBankRequest(repo, { dryRun: !o.execute }, {
+        listIssues: async () => {
+          const listed = await gh2([
+            "issue",
+            "list",
+            "--repo",
+            BANK_REQUEST_REPO,
+            "--state",
+            "all",
+            "--search",
+            `in:title "${bankRequestTitle(parsedRepo.name)}"`,
+            "--json",
+            "number,title,state,url",
+            "--limit",
+            "50"
+          ]);
+          const rows = JSON.parse(listed.stdout || "[]");
+          if (!Array.isArray(rows)) throw new Error("issue list is not an array");
+          return rows;
+        },
+        createIssue: async (request) => {
+          const out = await gh2([
+            "issue",
+            "create",
+            "--repo",
+            BANK_REQUEST_REPO,
+            "--title",
+            request.title,
+            "--body",
+            request.body,
+            "--label",
+            request.label
+          ]);
+          const url = out.stdout.trim().split("\n").pop()?.trim() ?? "";
+          const number = Number(/(\d+)$/.exec(url)?.[1]);
+          if (!url || !Number.isFinite(number)) throw new Error(`issue create returned no issue URL: ${out.stdout.trim().slice(0, 200)}`);
+          return { number, url };
+        }
+      });
+      if (o.execute) applied.push(renderBankRequestLine(bankRequest));
+    }
     if (o.execute && !onlyTarget) {
       const github = await readBootstrapGitHubFacts(repo, effectiveTrack, controlClient);
       controlDeployFacts = await fetchDeployFactsBySlug(slug, registryClientDeps(await loadConfig()));
@@ -52081,13 +52189,15 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         return failGraceful(`bootstrap apply: cannot plan labels/environments; no writes made: ${e.message}`);
       }
     }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, labels: ancillaryPlan, environments: environmentPlan, applied, ddbWrites }, null, 2));
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, labels: ancillaryPlan, environments: environmentPlan, bankRequest, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (controlRows.length) console.log(`
 ${renderBootstrapControlPlan(controlRows)}`);
       if (ancillaryPlan && environmentPlan) console.log(`
 ${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan, repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug).filter((spec) => spec.exception).map((spec) => ({ name: spec.name, detail: spec.exception })))}`);
+      if (bankRequest?.status === "planned") console.log(`
+${renderBankRequestPlan(bankRequest)}`);
       if (o.execute) console.log(`
 LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
@@ -56455,6 +56565,7 @@ async function verifyCustodyBootstrap(value, api, controller, requiredContexts,
 // src/release-custody.ts
 var RELEASE_CUSTODY_BRANCH = "mmi-release-state";
 var RELEASE_CUSTODY_PATH = "release-custody.json";
+var HUB_RELEASE_CUSTODY_JOB = "release";
 var ReleaseCustodyError = class extends Error {
   constructor(message2) {
     super("Release custody: " + message2);
@@ -56528,6 +56639,14 @@ function githubCustodyStore(repo, baseSha, api = defaultGitHubClient()) {
         `repos/${repo}/actions/runs/${controller.runId}/attempts/${controller.runAttempt}`
       );
       return run.id === controller.runId && run.run_attempt === controller.runAttempt && run.path === HUB_RELEASE_WORKFLOW && run.status === "completed";
+    },
+    async jobCompleted(controller) {
+      const jobs = await api.rest(
+        "GET",
+        `repos/${repo}/actions/runs/${controller.runId}/attempts/${controller.runAttempt}/jobs?per_page=100`
+      );
+      const job = (jobs?.jobs ?? []).find((row) => row.name === (controller.job ?? HUB_RELEASE_CUSTODY_JOB));
+      return job?.status === "completed" && job.conclusion === "success";
     }
   };
 }
@@ -56546,8 +56665,12 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
   poison;
   static async acquire(store, controller, repo, initialize, prepare) {
     const found = await store.read();
-    if (found.state && !await store.terminal(found.state.controller)) {
-      throw new ReleaseCustodyError(`previous controller run ${found.state.controller.runId} attempt ${found.state.controller.runAttempt} is not proven terminal`);
+    const prior = found.state?.controller;
+    if (prior) {
+      const handoff = prior.runId === controller.runId && prior.runAttempt === controller.runAttempt;
+      if (!(handoff ? await store.jobCompleted(prior) : await store.terminal(prior))) {
+        throw new ReleaseCustodyError(handoff ? `previous controller ${prior.job ?? HUB_RELEASE_CUSTODY_JOB} job of run ${prior.runId} attempt ${prior.runAttempt} is not proven completed` : `previous controller run ${prior.runId} attempt ${prior.runAttempt} is not proven terminal`);
+      }
     }
     let state = {
       ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto21.randomUUID)(), effects: {}, ...await initialize() },
@@ -56845,7 +56968,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto21.randomUUID)() };
+        const controller = { ...runIdentity, token: (0, import_node_crypto21.randomUUID)(), ...process.env.GITHUB_JOB ? { job: process.env.GITHUB_JOB } : {} };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -61005,9 +61128,10 @@ async function preparePrCreate(input, deps = createPreparationDeps(input)) {
   const reads = await Promise.allSettled([
     deps.claims(refs.candidate),
     refs.candidate ? deps.docs(refs.candidate) : Promise.resolve(void 0),
-    observePolicy(deps, refs.candidate)
+    observePolicy(deps, refs.candidate),
+    refs.candidate ? deps.queueWaiver?.(refs.candidate) : Promise.resolve(void 0)
   ]);
-  const [claims, docs, policy] = reads;
+  const [claims, docs, policy, waiver] = reads;
   if (claims.status === "fulfilled") {
     observations.push(...claims.value.findings.length ? claims.value.findings.map((detail) => ({ check: "claims", state: "failed", detail })) : [{ check: "claims", state: "passed", detail: "issue and claim evidence read" }]);
   } else observations.push({ check: "claims", state: "unavailable", detail: `issue/claim evidence unavailable (${rejectionReason(claims.reason)}); retry the read` });
@@ -61015,6 +61139,8 @@ async function preparePrCreate(input, deps = createPreparationDeps(input)) {
   else if (docs.value) observations.push({ check: "docs", state: docs.value.state, detail: [docs.value.detail, docs.value.fix].filter(Boolean).join(" \u2014 ") });
   if (policy.status === "rejected") observations.push({ check: "policy", state: "unavailable", detail: `committed test-policy observation unavailable (${rejectionReason(policy.reason)}); check policy validity and fetch full candidate history before retrying` });
   else if (policy.value) observations.push(policy.value);
+  if (waiver.status === "rejected") observations.push({ check: "queue", state: "skipped", detail: `the queue squash waiver placement was not checked (${rejectionReason(waiver.reason)}); this is non-blocking` });
+  else if (waiver.value) observations.push(waiver.value);
   const findings = observations.filter((item) => item.state === "failed" || item.state === "unavailable");
   let attempted = false;
   return {
@@ -61115,6 +61241,34 @@ function createPreparationDeps(input, io = {}) {
   return {
     candidate: readCandidate,
     publish: (proof) => publishPreparedPrHead(proof, exec3),
+    // #9831/#9968: publication happens only in commit(), after this read-only preparation, so the queue's
+    // buried-waiver refusal is decided here — with the queue's own reader and setting reads — before an
+    // absent remote head is pushed and a PR opened. A range or setting it cannot read is a skip (#9968).
+    queueWaiver: async (candidate) => {
+      const result = (state, detail) => ({ check: "queue", state, detail });
+      if (!candidate.root) return void 0;
+      const range = await exec3("git", ["-C", candidate.root, "log", "--reverse", "--format=%B%x00", `${candidate.baseSha}..${candidate.headSha}`], { timeout: GIT_TIMEOUT_MS }).then((read) => ({ log: read.stdout }), (error) => ({ reason: rejectionReason(error) }));
+      if (!("log" in range)) return result("skipped", `candidate commits ${candidate.baseSha}..${candidate.headSha} could not be read (${range.reason}), so the queue squash waiver placement was not checked; this is non-blocking`);
+      const messages = range.log.split("\0").filter((message2) => message2.trim()).map((message2) => {
+        const [headline, ...body] = message2.trim().split("\n");
+        return { headline, body: body.join("\n") };
+      });
+      const refusal = checkQueueSquashOverride("Candidate PR", "0", messages, candidate.root);
+      if (!refusal) return void 0;
+      const [owner, name] = candidate.repo.split("/");
+      const setting = await (async () => {
+        const metadata = await client.graphql(
+          "query($owner:String!,$name:String!,$base:String!) { repository(owner:$owner,name:$name) { squashMergeCommitMessage mergeQueue(branch:$base) { configuration { mergeMethod } } } }",
+          { owner, name, base: candidate.base }
+        );
+        const rules = await client.restPaginate(`repos/${candidate.repo}/rules/branches/${encodeURIComponent(candidate.base)}?per_page=100`);
+        const methods = [...new Set(rules.filter((rule) => rule.type === "merge_queue").map((rule) => rule.parameters?.merge_method))];
+        const method = methods.length === 1 ? methods[0] : !methods.length ? metadata.repository.mergeQueue?.configuration?.mergeMethod : void 0;
+        return method === "SQUASH" && metadata.repository.squashMergeCommitMessage === "COMMIT_MESSAGES";
+      })().then((squash) => squash, (error) => rejectionReason(error));
+      if (typeof setting === "string") return result("skipped", `the repository's queue squash-message setting could not be read (${setting}), so the queue squash waiver placement was not checked; this is non-blocking`);
+      return setting ? result("failed", `${refusal.error} \u2014 ${refusal.preparation.nextAction}`) : void 0;
+    },
     // #9946: the retry needs the exact candidate objects. Fetch each ref on its own so a fork-only head
     // that origin cannot resolve never costs the base fetch too, and never surface a fetch failure as the
     // reason the policy read stayed unreadable.
@@ -61135,25 +61289,6 @@ function createPreparationDeps(input, io = {}) {
       if (!await docs.refResolves(candidate.root, candidate.headSha) || !await docs.refResolves(candidate.root, candidate.baseSha)) {
         return result("skipped", "exact remote candidate objects are not available locally; committed test policy was not checked");
       }
-      const log = (await exec3("git", ["-C", candidate.root, "log", "--reverse", "--format=%B%x00", `${candidate.baseSha}..${candidate.headSha}`], { timeout: GIT_TIMEOUT_MS })).stdout;
-      const messages = log.split("\0").filter((message2) => message2.trim()).map((message2) => {
-        const [headline, ...body] = message2.trim().split("\n");
-        return { headline, body: body.join("\n") };
-      });
-      const refusal = checkQueueSquashOverride("Candidate PR", "0", messages, candidate.root);
-      if (refusal) {
-        const [owner, name] = candidate.repo.split("/");
-        const metadata = await client.graphql(
-          "query($owner:String!,$name:String!,$base:String!) { repository(owner:$owner,name:$name) { squashMergeCommitMessage mergeQueue(branch:$base) { configuration { mergeMethod } } } }",
-          { owner, name, base: candidate.base }
-        );
-        const rules = await client.restPaginate(`repos/${candidate.repo}/rules/branches/${encodeURIComponent(candidate.base)}?per_page=100`);
-        const methods = [...new Set(rules.filter((rule) => rule.type === "merge_queue").map((rule) => rule.parameters?.merge_method))];
-        const method = methods.length === 1 ? methods[0] : !methods.length ? metadata.repository.mergeQueue?.configuration?.mergeMethod : void 0;
-        if (method === "SQUASH" && metadata.repository.squashMergeCommitMessage === "COMMIT_MESSAGES") {
-          return result("failed", `${refusal.error} \u2014 ${refusal.preparation.nextAction}`);
-        }
-      }
       let policy;
       try {
         policy = runTestPolicy(candidate.root, { candidate: { head: candidate.headSha, base: candidate.baseSha } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.32",
+  "version": "4.6.34",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",