@mutmutco/cli 4.6.38 → 4.6.40

package/dist/main.cjs

@@ -19611,6 +19611,48 @@ function isValidSecretKey(key) {
 function stripTrailingCRLF(value) {
   return value.replace(/\r\n$|\r$|\n$/, "");
 }
+function countCaptureGroups(source) {
+  let count = 0;
+  let inClass = false;
+  for (let i = 0; i < source.length; i += 1) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i += 1;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch !== "(") continue;
+    if (source[i + 1] !== "?") {
+      count += 1;
+      continue;
+    }
+    if (source[i + 2] === "<" && source[i + 3] !== "=" && source[i + 3] !== "!") count += 1;
+  }
+  return count;
+}
+function compileExtractRegex(source) {
+  let re;
+  try {
+    re = new RegExp(source);
+  } catch {
+    return { ok: false, reason: "syntax" };
+  }
+  if (countCaptureGroups(source) !== 1) return { ok: false, reason: "capture-groups" };
+  return { ok: true, re };
+}
+function extractSingleMatch(text, re) {
+  const flags = re.flags.includes("g") ? re.flags : `${re.flags}g`;
+  const all = [...text.matchAll(new RegExp(re.source, flags))];
+  if (all.length !== 1) return { ok: false, count: all.length };
+  return { ok: true, value: all[0][1] ?? "" };
+}
 var ORG_WIDE_SLUGS = /* @__PURE__ */ new Set([ORG_INFRA_SLUG, "shared", "cloudflare", "docs", "mmi-hub"]);
 function classifyTier(slug, _key) {
   return ORG_WIDE_SLUGS.has(slug) ? "org" : "project";
@@ -21231,6 +21273,64 @@ async function secretsSet(deps, key, opts) {
   }
   return putSecret(deps, key, value, opts);
 }
+async function secretsSetFromClipboard(deps, key, opts) {
+  let value;
+  try {
+    if (!isValidSecretKey(key)) {
+      deps.err(`invalid secret key ${JSON.stringify(key)}`);
+      return false;
+    }
+    let re;
+    if (opts.extract !== void 0) {
+      const compiled = compileExtractRegex(opts.extract);
+      if (!compiled.ok) {
+        deps.err(
+          compiled.reason === "syntax" ? "secrets set: --extract is not a valid regular expression \u2014 aborted (nothing written)" : "secrets set: --extract must contain exactly one capture group, e.g. '--token\\s+(\\S+)' \u2014 aborted (nothing written)"
+        );
+        return false;
+      }
+      re = compiled.re;
+    }
+    if (!deps.readClipboard) {
+      deps.err("secrets set: --from-clipboard is not available in this build \u2014 aborted (nothing written)");
+      return false;
+    }
+    let text;
+    try {
+      text = await deps.readClipboard();
+    } catch (e) {
+      deps.err(`secrets set: --from-clipboard: ${e.message}`);
+      return false;
+    }
+    if (re) {
+      const matched = extractSingleMatch(text, re);
+      if (!matched.ok) {
+        deps.err(
+          matched.count === 0 ? "secrets set: --from-clipboard: --extract found no match (0 matches) \u2014 aborted (nothing written)" : `secrets set: --from-clipboard: --extract matched ${matched.count} times \u2014 need exactly one; aborted (nothing written)`
+        );
+        return false;
+      }
+      value = stripTrailingCRLF(matched.value);
+    } else {
+      value = stripTrailingCRLF(text);
+    }
+    if (!value) {
+      deps.err(`secrets set: --from-clipboard: empty value for ${key} \u2014 aborted (nothing written)`);
+      return false;
+    }
+    const ok = await putSecret(deps, key, value, opts);
+    if (ok) deps.log(`set ${key} (${value.length} chars)`);
+    return ok;
+  } finally {
+    if (deps.writeClipboard) {
+      try {
+        await deps.writeClipboard("");
+      } catch (e) {
+        deps.err(`secrets set: warning: could not clear the clipboard \u2014 ${e.message}`);
+      }
+    }
+  }
+}
 var DECLARE_KEY_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
 var DECLARE_STAGES = /* @__PURE__ */ new Set(["dev", "rc", "main"]);
 var DECLARE_CONSUMERS = /* @__PURE__ */ new Set(["runtime", "build", "lambda", "actions", "agent", "box"]);
@@ -28405,10 +28505,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.38",
-    tag: "v4.6.38",
-    commit: "975581f0f6ce",
-    npm: "@mutmutco/cli@4.6.38"
+    version: "4.6.40",
+    tag: "v4.6.40",
+    commit: "0c850872865f",
+    npm: "@mutmutco/cli@4.6.40"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28425,14 +28525,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.38"
+          v3Target: "v4.6.40"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.38 and redeploy the Hub Lambda from tag v4.6.38 (975581f0f6ce); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.38 (@mutmutco/cli@4.6.38, tag commit 975581f0f6ce \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.40 and redeploy the Hub Lambda from tag v4.6.40 (0c850872865f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.40 (@mutmutco/cli@4.6.40, tag commit 0c850872865f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -44015,7 +44115,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     for (let readAttempt = 0; readAttempt < maxReads; readAttempt++) {
       if (readAttempt) await sleep3(readAttempt * 1e3);
       try {
-        const observed = await readPrMergeQueue(pr, repo, read);
+        const observed = await readPrMergeQueue(pr, repo, read, options.sleep);
         if (observed.state === "MERGED" && observed.headRefOid === head) return markReenqueued({ mergeStatus: "merged" });
         if (observed.isInMergeQueue && observed.headRefOid === head) {
           const entry = observed.mergeQueueEntry;
@@ -44057,13 +44157,13 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
   if (receipt && (receipt.state === "enqueued" || receipt.state === "merged")) {
     if (receipt.head.toLowerCase() !== head.toLowerCase()) {
       try {
-        const observed = await readPrMergeQueue(pr, repo, read);
+        const observed = await readPrMergeQueue(pr, repo, read, options.sleep);
         superseded = observed.state === "OPEN" && !observed.isInMergeQueue;
       } catch {
       }
     } else {
       try {
-        const observed = await readPrMergeQueue(pr, repo, read);
+        const observed = await readPrMergeQueue(pr, repo, read, options.sleep);
         if (observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid?.toLowerCase() === receipt.head.toLowerCase()) {
           const boundMs = receipt.queueEntry ? Date.parse(receipt.queueEntry.enqueuedAt) : receipt.observedAt + UNWITNESSED_EJECTION_GRACE_MS;
           const events = await readArrayPages(
@@ -44266,6 +44366,15 @@ ${list}
 Co-authored-by: GitHub <noreply@github.com>
 `;
 }
+var WAIVER_KEYS = /^(?:Test-Policy-Override|Runbook-Unaffected)\s*:/i;
+function clipTrailer(trailer) {
+  return trailer.length > 120 ? `${trailer.slice(0, 117)}...` : trailer;
+}
+function describeWaiverText(label, message2, cwd) {
+  const block = parseTrailers(message2, cwd).filter((trailer) => WAIVER_KEYS.test(trailer));
+  const found = block.length ? `final trailer block holds ${block.map((trailer) => `\`${clipTrailer(trailer)}\``).join(" and ")}` : "git parses no Test-Policy-Override or Runbook-Unaffected trailer there";
+  return `${label}: ${found}`;
+}
 function checkQueueSquashOverride(title, pr, messages, root) {
   if (messages.length <= 1 || !messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
 ${message2.body}`)) || readMessageOverride2(githubQueueSquashMessage(title, pr, messages), root)) return void 0;
@@ -44399,7 +44508,8 @@ ${pull.body}`;
   }
   const requiredBody = options.bodyText ?? composedBody;
   const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
-  if (requiredBody && !prBodyPreservesOverrides && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
+  const queueKeepsWaiver = options.bodyText == null && method !== "SQUASH" && Boolean(readMessageOverride2(actualMessage, process.cwd()));
+  if (requiredBody && !prBodyPreservesOverrides && !queueKeepsWaiver && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
     if (method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null) {
       return {
         kind: "refused",
@@ -44411,7 +44521,9 @@ ${pull.body}`;
             issueTargets: [],
             nextAction: `PR author: this repository squashes with PR_BODY, so place the required Test-Policy-Override trailer(s) in the PR body final trailer block (e.g. \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) without a body override, then rerun \`pr land\`. Keep repository settings unchanged.`
           },
-          error: "queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block"
+          error: `queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block \u2014 ${describeWaiverText("the PR body", pull.body, process.cwd())}; ${describeWaiverText("the source commit messages", messages.map((message2) => `${message2.headline}
+
+${message2.body}`).join("\n\n"), process.cwd())}`
         }
       };
     }
@@ -44420,9 +44532,12 @@ ${pull.body}`;
       return keys.length ? keys.join(", ") : "none";
     };
     const source = options.bodyText != null ? "the explicit body override" : "the body composed from the source commit messages";
+    const sentLabel = method === "SQUASH" ? `squash ${policy.body ?? "unknown"}, ${messages.length} commit message${messages.length === 1 ? "" : "s"}` : `${method}${repository.merge_commit_message === "PR_BODY" ? " + PR body" : ""}`;
     const detail = `the requested sanitized body or trailer arrangement cannot be sent to queue admission: queue merge method ${method}, squash body policy ${policy.body ?? "unknown"}; required body is ${source} (trailer keys: ${trailerKeys(`${headline}
 
-${requiredBody}`)}), but the message the queue would send carries trailer keys: ${trailerKeys(actualMessage)}`;
+${requiredBody}`)}), but the message the queue would send carries trailer keys: ${trailerKeys(actualMessage)}. ${describeWaiverText(`the message the queue sends (${sentLabel})`, actualMessage, process.cwd())}; ${describeWaiverText("the source commit messages", messages.map((message2) => `${message2.headline}
+
+${message2.body}`).join("\n\n"), process.cwd())}.`;
     const next = options.bodyText != null ? `PR author: a merge queue accepts no body override; drop --body/--squash-body-file and place the required trailer(s) where the queue's ${method}${method === "SQUASH" ? ` (${policy.body})` : ""} message reads them, then rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : method !== "SQUASH" ? `PR author: the queue's ${method} method keeps the original commit messages, so the required trailer(s) must sit in a source commit message's final trailer block; amend the commit, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : policy.body === "BLANK" ? `PR author: squash body policy BLANK sends an empty body, so no trailer from the commits or PR body reaches the queue commit; the waiver cannot survive queue admission with unchanged repository settings \u2014 remove the need for the override or ask a maintainer. Keep repository settings unchanged.` : `PR author: squash body policy ${policy.body} does not reproduce the composed body; consolidate the required trailer(s) into one source commit message's final trailer block, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.`;
     const caveat = " GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy; the combined queue candidate must pass with the shared trailer reader.";
     return { kind: "refused", result: preparation("queue-message-override", [], detail, next + caveat) };
@@ -44472,7 +44587,7 @@ async function abandonQueueAdmission(pr, repo, options = {}) {
   }
   let snapshot;
   try {
-    snapshot = await readPrMergeQueue(pr, repo, options.read ?? actorReadApi);
+    snapshot = await readPrMergeQueue(pr, repo, options.read ?? actorReadApi, options.sleep);
   } catch (error) {
     return refuse(`the PR and queue state could not be read (${error.message}); the admission is unchanged`);
   }
@@ -44497,13 +44612,19 @@ function decideQueueMergeRoute(hasQueue, method, headRef) {
   if (!hasQueue) return "normal";
   return method === "--merge" && /^(release-align|hotfix-fold)\//.test(headRef) ? "admin-true-merge" : "pr-land";
 }
-async function readPrMergeQueue(pr, repo, gh2 = actorReadApi) {
+async function readPrMergeQueue(pr, repo, gh2 = actorReadApi, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
   if (!/^\d+$/.test(pr)) throw new Error("merge queue read requires a PR number");
-  const result = await queueGraphql(
-    repo,
-    `pullRequest(number:${pr}) { state isInMergeQueue mergeQueueEntry { state position enqueuedAt headCommit { oid } } autoMergeRequest { enabledAt } headRefOid }`,
-    gh2
-  );
+  const fields = `pullRequest(number:${pr}) { state isInMergeQueue mergeQueueEntry { state position enqueuedAt headCommit { oid } } autoMergeRequest { enabledAt } headRefOid }`;
+  let result;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      result = await queueGraphql(repo, fields, gh2);
+      break;
+    } catch (error) {
+      if (attempt >= 2 || !isUpstreamGitHubFault(execErrorText(error))) throw error;
+      await sleep2(2e3 * (attempt + 1));
+    }
+  }
   if (!result.pullRequest) throw new Error(`merge queue PR #${pr} not found`);
   const entry = result.pullRequest.mergeQueueEntry;
   if (entry && (entry.enqueuedAt !== void 0 && !Number.isFinite(Date.parse(entry.enqueuedAt)) || entry.headCommit && !/^[a-f0-9]{40}$/i.test(entry.headCommit.oid))) throw new Error("queue entry identity is unreadable");
@@ -44932,7 +45053,7 @@ async function dispatchWorkflow(repo, workflow, ref, inputs, deps) {
   const fields = ["-f", `ref=${ref}`];
   const names = /* @__PURE__ */ new Set();
   for (const input of inputs) {
-    const match = /^([A-Za-z_][A-Za-z0-9_]{0,63})=([^\r\n]{0,2048})$/.exec(input);
+    const match = /^([A-Za-z_][A-Za-z0-9_-]{0,63})=([^\r\n]{0,2048})$/.exec(input);
     if (!match || names.has(match[1])) throw new Error("run dispatch: invalid or duplicate input");
     names.add(match[1]);
     fields.push("-f", `inputs[${match[1]}]=${match[2]}`);
@@ -47169,7 +47290,7 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 
 // src/box-commands.ts
 var import_node_fs39 = require("node:fs");
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_os20 = require("node:os");
 var import_node_path36 = require("node:path");
 
@@ -47397,6 +47518,7 @@ init_cli_shared();
 
 // src/secrets-commands.ts
 var import_node_fs37 = require("node:fs");
+var import_node_child_process12 = require("node:child_process");
 var import_node_path34 = require("node:path");
 var import_node_os19 = require("node:os");
 init_cli_shared();
@@ -48663,9 +48785,122 @@ function makeSecretsDeps(cfg) {
     slug: async () => (await repoProject(cfg)).toLowerCase(),
     readSecretValue: () => readSecretStdin(),
     log: (m) => console.log(m),
-    err: (m) => console.error(m)
+    err: (m) => console.error(m),
+    // #10056: the sanctioned clipboard handoff — read/write the OS clipboard directly, never through a
+    // shell, so a pasted value cannot be re-parsed by cmd.exe/PowerShell.
+    readClipboard: () => readClipboardText(),
+    writeClipboard: (value) => clearClipboard(value)
   };
 }
+var CLIPBOARD_TIMEOUT_MS = 1e4;
+function clipboardReadCommands(platform2) {
+  if (platform2 === "win32") return [{ cmd: "powershell", args: ["-NoProfile", "-Command", "Get-Clipboard -Raw"] }];
+  if (platform2 === "darwin") return [{ cmd: "pbpaste", args: [] }];
+  return [
+    { cmd: "wl-paste", args: ["-n"] },
+    { cmd: "xclip", args: ["-selection", "clipboard", "-o"] }
+  ];
+}
+function clipboardClearCommands(platform2) {
+  if (platform2 === "win32") return [{ cmd: "powershell", args: ["-NoProfile", "-Command", "Set-Clipboard -Value ' '"] }];
+  if (platform2 === "darwin") return [{ cmd: "pbcopy", args: [], input: "" }];
+  return [
+    { cmd: "wl-copy", args: ["--clear"] },
+    { cmd: "xclip", args: ["-selection", "clipboard"], input: "" }
+  ];
+}
+function clipboardFailure(command, error) {
+  const code = error.code;
+  if (code === "ENOENT") return `${command.cmd}: not found`;
+  if (typeof code === "number") return `${command.cmd}: exit ${code}`;
+  return `${command.cmd}: could not run`;
+}
+function runClipboardCommand(command) {
+  return new Promise((resolveRun, rejectRun) => {
+    const child2 = (0, import_node_child_process12.spawn)(command.cmd, command.args, {
+      shell: false,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const out = [];
+    let settled2 = false;
+    const settle = (error, value) => {
+      if (settled2) return;
+      settled2 = true;
+      clearTimeout(timer);
+      if (error) rejectRun(error);
+      else resolveRun(value ?? "");
+    };
+    const timer = setTimeout(() => {
+      child2.kill();
+      settle(new Error(`${command.cmd}: timed out`));
+    }, CLIPBOARD_TIMEOUT_MS);
+    timer.unref?.();
+    child2.stdout?.on("data", (chunk) => out.push(chunk));
+    child2.stderr?.on("data", () => {
+    });
+    child2.on("error", (e) => settle(e instanceof Error ? e : new Error(String(e))));
+    child2.on("close", (code) => {
+      if (code === 0) settle(void 0, Buffer.concat(out).toString("utf8"));
+      else settle(Object.assign(new Error(`${command.cmd}: exit ${code}`), { code }));
+    });
+    child2.stdin?.on("error", () => {
+    });
+    child2.stdin?.end(command.input ?? "");
+  });
+}
+async function readClipboardText(platform2 = process.platform) {
+  const failures = [];
+  for (const command of clipboardReadCommands(platform2)) {
+    try {
+      return await runClipboardCommand(command);
+    } catch (e) {
+      failures.push(clipboardFailure(command, e));
+    }
+  }
+  throw new Error(`could not read the clipboard (${failures.join(", ")})`);
+}
+async function clearClipboard(value, platform2 = process.platform) {
+  const failures = [];
+  for (const command of clipboardClearCommands(platform2)) {
+    try {
+      await runClipboardCommand({ ...command, ...command.input !== void 0 ? { input: value } : {} });
+      return;
+    } catch (e) {
+      failures.push(clipboardFailure(command, e));
+    }
+  }
+  throw new Error(`${failures.join(", ")}`);
+}
+function clipboardSourceRefusal(fromClipboard, stdinHasData) {
+  if (!fromClipboard || !stdinHasData) return null;
+  return "secrets set: --from-clipboard conflicts with piped stdin \u2014 remove the pipe (the value comes from the clipboard), or drop --from-clipboard and pipe it";
+}
+async function stdinCarriesData(timeoutMs = 50) {
+  const stdin = process.stdin;
+  if (stdin.isTTY) return false;
+  if (stdin.readableLength > 0) return true;
+  return new Promise((resolveProbe) => {
+    let settled2 = false;
+    const finish = (value) => {
+      if (settled2) return;
+      settled2 = true;
+      clearTimeout(timer);
+      stdin.off("readable", onReadable);
+      stdin.off("end", onEnd);
+      resolveProbe(value);
+    };
+    const onReadable = () => {
+      if (stdin.readableLength > 0) finish(true);
+    };
+    const onEnd = () => finish(false);
+    const timer = setTimeout(() => finish(stdin.readableLength > 0), timeoutMs);
+    timer.unref?.();
+    stdin.once("readable", onReadable);
+    stdin.once("end", onEnd);
+    stdin.once("error", () => finish(false));
+  });
+}
 async function withSecrets(run) {
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
@@ -48812,10 +49047,22 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   }));
   const setHandler = (key, o) => withSecrets(async (d) => {
+    if (o.fromClipboard) {
+      const refusal = clipboardSourceRefusal(true, await stdinCarriesData());
+      if (refusal) return fail(refusal);
+      const ok2 = await secretsSetFromClipboard(d, key, {
+        ...o.repo !== void 0 ? { repo: o.repo } : {},
+        ...o.slug !== void 0 ? { slug: o.slug } : {},
+        ...o.extract !== void 0 ? { extract: o.extract } : {}
+      });
+      if (!ok2) process.exitCode = 1;
+      return;
+    }
+    if (o.extract !== void 0) return fail("secrets set: --extract needs --from-clipboard (it isolates the value inside copied text)");
     const ok = await secretsSet(d, key, o);
     if (!ok) process.exitCode = 1;
   });
-  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix. --slug _org writes an org-infra <provider>/<KEY> coordinate (#3298) \u2014 master or an exact grant, declare-first enforced server-side").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value write \u2014 master or an exact grant (#3298)").action(setHandler);
+  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix. --slug _org writes an org-infra <provider>/<KEY> coordinate (#3298) \u2014 master or an exact grant, declare-first enforced server-side. --from-clipboard takes the value from the OS clipboard instead of stdin, extracts it with --extract, and CLEARS the clipboard afterwards \u2014 the sanctioned handoff for a secret embedded in copied text (#10056)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value write \u2014 master or an exact grant (#3298)").option("--from-clipboard", "read the value from the OS clipboard instead of stdin: powershell Get-Clipboard / pbpaste / wl-paste (xclip fallback). The clipboard is overwritten on EVERY path (success, no match, failed write). Conflicts with piped stdin").option("--extract <regex>", "with --from-clipboard: a regex with EXACTLY ONE capture group whose single match inside the copied text is the value, e.g. --extract '--token\\s+(\\S+)'. Zero or 2+ matches are refused (the count is reported, the text never is). Without --extract the whole clipboard, minus one trailing newline, is the value").action(setHandler);
   secrets.command("copy").description("copy provider keys between stages in your own project vault (audit-logged; encryption keys blocked)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.from) || !stages.includes(o.to)) {
@@ -49641,7 +49888,7 @@ var UsageError = class extends Error {
 var UnreadableError = class extends Error {
 };
 function hubGitShow(ref) {
-  const git3 = (args) => (0, import_node_child_process12.execFileSync)("git", args, { maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  const git3 = (args) => (0, import_node_child_process13.execFileSync)("git", args, { maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
   try {
     git3(["cat-file", "-e", `HEAD:${MANIFEST_PATH}`]);
   } catch {
@@ -49655,7 +49902,7 @@ function runOnBox(found, script) {
   try {
     const recipe = (0, import_node_path36.join)(dir, "recipe.sh");
     (0, import_node_fs39.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
-    const r = (0, import_node_child_process12.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
+    const r = (0, import_node_child_process13.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
@@ -54412,7 +54659,7 @@ async function runRcDataSwitch(deps, opts) {
 }
 
 // src/suite-train-io.ts
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 var import_node_path52 = require("node:path");
 var import_node_fs55 = require("node:fs");
 var import_node_path53 = require("node:path");
@@ -56001,13 +56248,13 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag, workflows = H
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 var GIT_MAX_BUFFER = 512 * 1024 * 1024;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process13.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process14.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
   const revList = (range) => {
     const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -56075,7 +56322,7 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process13.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process14.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
   const isAncestor = (sha, ref) => {
     try {
       git3(["merge-base", "--is-ancestor", sha, ref]);
@@ -57962,7 +58209,7 @@ function prTitleRefusal(title) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_fs54 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
 init_clean_exit();
@@ -59500,7 +59747,7 @@ async function readAppApi(path2, runner = apiReadRunner) {
   return log ? Buffer.from(body, "latin1").toString("utf8") : out;
 }
 function registerApiReadCommands(program3, overrides) {
-  const spawn7 = overrides?.runner ?? apiReadRunner;
+  const spawn8 = overrides?.runner ?? apiReadRunner;
   const jqRun = overrides?.jqRunner ?? systemJqRunner;
   let bindings = [];
   const runGet = async (req, o) => {
@@ -59520,7 +59767,7 @@ function registerApiReadCommands(program3, overrides) {
     let body;
     try {
       body = await runApiGet(
-        async (args, timeoutMs) => zip ? spawn7(args, ZIP_TIMEOUT_MS, env, true) : spawn7(args, timeoutMs, env),
+        async (args, timeoutMs) => zip ? spawn8(args, ZIP_TIMEOUT_MS, env, true) : spawn8(args, timeoutMs, env),
         req.path,
         o.accept
       );
@@ -59766,7 +60013,7 @@ function registerRunLogRead(run, runner) {
 
 // src/app-read-broker.ts
 init_cli_shared();
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 var JSON_FIELD_RE = /^[A-Za-z0-9_,]+$/;
 var ID_RE = /^\d+$/;
@@ -59852,7 +60099,7 @@ function formatJqFailureMessage(code, stderr) {
   return `${base} \u2014 the expression is handed to jq verbatim (mmi-cli never re-quotes it), so if a shell or seat layer collapsed a backslash, use an escape-free form such as \`test("bundle[.]css")\` or \`contains("bundle.css")\`, or drop --jq and filter the JSON locally`;
 }
 var systemJqRunner = (expr, input, env, bindings) => new Promise((resolveOut, reject2) => {
-  const child2 = (0, import_node_child_process14.spawn)("jq", [...process.platform === "win32" ? ["--binary"] : [], "-r", "-c", ...(bindings ?? []).flatMap((b) => [b.kind, b.name, b.value]), expr], { env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+  const child2 = (0, import_node_child_process15.spawn)("jq", [...process.platform === "win32" ? ["--binary"] : [], "-r", "-c", ...(bindings ?? []).flatMap((b) => [b.kind, b.name, b.value]), expr], { env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
   let stdout = "";
   let stderr = "";
   child2.stdout.setEncoding("utf8").on("data", (chunk) => {
@@ -61067,7 +61314,7 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/review-verdict.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_fs49 = require("node:fs");
 var import_node_os25 = require("node:os");
 var import_node_path46 = require("node:path");
@@ -61167,8 +61414,8 @@ async function checkPrReview(number, repo, head, deps = {
 }
 function computePrPatchId(number, repo) {
   return new Promise((resolve8, reject2) => {
-    const gh2 = (0, import_node_child_process15.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-    const git3 = (0, import_node_child_process15.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const gh2 = (0, import_node_child_process16.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const git3 = (0, import_node_child_process16.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
     let ghErr = "";
     let gitErr = "";
@@ -61393,7 +61640,7 @@ async function observePrCreateClaims(body, repoOption, deps = {}) {
 }
 
 // src/pr-create-docs-check.ts
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
@@ -61401,7 +61648,7 @@ function catFileBatch(root, ref, paths) {
   return new Promise((resolve8) => {
     const chunks = [];
     let settled2 = false;
-    const child2 = (0, import_node_child_process16.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
+    const child2 = (0, import_node_child_process17.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
     const finish = (ok = false) => {
       if (settled2) return;
       settled2 = true;
@@ -61740,7 +61987,7 @@ var import_node_path49 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
-var import_node_child_process17 = require("node:child_process");
+var import_node_child_process18 = require("node:child_process");
 var import_node_fs51 = require("node:fs");
 var import_node_path48 = require("node:path");
 var import_node_net = require("node:net");
@@ -61911,7 +62158,7 @@ function stageComposeFileEnv(files) {
 }
 
 // src/stage-runner.ts
-var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process17.execFile);
+var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process18.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
@@ -62555,7 +62802,7 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child2 = (0, import_node_child_process17.spawn)(bash, ["-c", up], {
+  const child2 = (0, import_node_child_process18.spawn)(bash, ["-c", up], {
     cwd,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
     // `taskkill /T /F` (no group needed), and detached+shell defeats windowsHide — every spawn would
@@ -63688,7 +63935,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process18.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -66672,7 +66919,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
     const target = await checkout(repo);
     return new Promise((resolveResult, reject2) => {
-      const child2 = (0, import_node_child_process19.fork)((0, import_node_path52.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+      const child2 = (0, import_node_child_process20.fork)((0, import_node_path52.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
         cwd: target,
         stdio: ["ignore", "inherit", "inherit", "ipc"],
         execArgv: []
@@ -67293,7 +67540,7 @@ function registerJevCommands(program3) {
 }
 
 // src/packages-adopt-export.ts
-var import_node_child_process20 = require("node:child_process");
+var import_node_child_process21 = require("node:child_process");
 var import_node_fs57 = require("node:fs");
 var import_node_os26 = require("node:os");
 var import_node_path54 = require("node:path");
@@ -67950,7 +68197,7 @@ async function adoptExport(opts, deps) {
     (0, import_node_fs57.rmSync)(work, { recursive: true, force: true });
   }
 }
-var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process20.execFile);
+var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process21.execFile);
 var MAX_OUTPUT = 200 * 1024 * 1024;
 async function findPython() {
   for (const bin of ["python3", "python"]) {
@@ -72516,7 +72763,7 @@ async function resolveWhoami(deps) {
 var import_node_path64 = require("node:path");
 
 // src/doc-refs-command-source.ts
-var import_node_child_process21 = require("node:child_process");
+var import_node_child_process22 = require("node:child_process");
 var import_node_fs62 = require("node:fs");
 var import_node_path58 = require("node:path");
 var IN_PROCESS_SOURCE = "in-process";
@@ -72537,7 +72784,7 @@ function inventoryFromManifest(manifest, source) {
   collect(body?.tree);
   return { commandPaths, commandOptions, source };
 }
-function readBundleManifest(bundle, exec3 = import_node_child_process21.execFileSync) {
+function readBundleManifest(bundle, exec3 = import_node_child_process22.execFileSync) {
   try {
     const text = exec3(process.execPath, [bundle, "commands", "--all", "--json"], {
       cwd: (0, import_node_path58.dirname)(bundle),
@@ -72706,7 +72953,7 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process22 = require("node:child_process");
+var import_node_child_process23 = require("node:child_process");
 var import_node_crypto26 = require("node:crypto");
 var import_node_fs64 = require("node:fs");
 var import_node_os28 = require("node:os");
@@ -72852,7 +73099,7 @@ function bomPathFor(root) {
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process22.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process23.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -72976,9 +73223,9 @@ async function runLiveDocRefs(root, deps, live) {
 }
 
 // src/doc-refs-live-io.ts
-var import_node_child_process23 = require("node:child_process");
+var import_node_child_process24 = require("node:child_process");
 var import_node_util7 = require("node:util");
-var exec2 = (0, import_node_util7.promisify)(import_node_child_process23.execFile);
+var exec2 = (0, import_node_util7.promisify)(import_node_child_process24.execFile);
 function createRunbookLiveDeps(cliBin) {
   const json = async (args) => {
     const { stdout } = await exec2(process.execPath, [cliBin, ...args, "--json"], { windowsHide: true, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 });
@@ -73289,7 +73536,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process24 = require("node:child_process");
+var import_node_child_process25 = require("node:child_process");
 var import_node_fs65 = require("node:fs");
 var import_node_path63 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
@@ -73360,7 +73607,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process24.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process25.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.38",
+  "version": "4.6.40",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",