@mutmutco/cli 4.6.6 → 4.6.8

package/dist/main.cjs

@@ -1636,11 +1636,13 @@ var init_cli_shared = __esm({
         const pool = appEnv ? "app" : !callerEnv ? ambientPool() : !callerEnv.GH_TOKEN ? "personal" : callerEnv.MMI_GH_POOL === "app" ? "app" : callerEnv.GH_TOKEN === process.env.GH_TOKEN ? ambientPool() : "caller";
         recordGhUsage("gh", pool, args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" "));
       }
-      if (!appEnv) return tag(run(), options.env?.MMI_GH_POOL === "app" ? "app_installation" : "user");
+      const ambientEnv = options.env ?? process.env;
+      const ambient = ambientEnv.MMI_GH_POOL === "app" || /^ghs_/.test(ambientEnv.GH_TOKEN || ambientEnv.GITHUB_TOKEN || "") ? "app_installation" : "user";
+      if (!appEnv) return tag(run(), ambient);
       try {
         return await tag(run(appEnv), "app_installation");
       } catch (e) {
-        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), "user");
+        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), ambient);
         throw e;
       }
     };
@@ -13871,6 +13873,45 @@ function boardClaimStatusFlagRecovery(flag, canonicalPath, argv) {
     corrected: `mmi-cli ${kept.join(" ")}`
   };
 }
+function issueCommentAppendOnlyRecovery(flag, canonicalPath, argv) {
+  if (canonicalPath !== "oracle issue comment") return void 0;
+  const hasEditVerb = argv.some((t, idx) => idx >= 3 && !t.startsWith("-") && /^(?:edit|update|patch|modify)$/i.test(t));
+  if (flag !== "--id" && !flag.startsWith("--id=") && !hasEditVerb) return void 0;
+  const valueFlags = /* @__PURE__ */ new Set(["--repo", "--body", "--body-file"]);
+  const kept = [];
+  let sawTarget = false;
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (i < 3) {
+      kept.push(tok);
+      continue;
+    }
+    if (tok.startsWith("--id=")) continue;
+    if (tok === "--id") {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) i++;
+      continue;
+    }
+    if (tok.startsWith("-")) {
+      kept.push(tok);
+      const name = tok.includes("=") ? tok.slice(0, tok.indexOf("=")) : tok;
+      if (!tok.includes("=") && valueFlags.has(name) && i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+        kept.push(argv[++i]);
+      }
+      continue;
+    }
+    if (/^(?:edit|update|patch|modify)$/i.test(tok)) continue;
+    sawTarget = true;
+    kept.push(tok);
+  }
+  if (!sawTarget) {
+    kept.splice(3, 0, "<ref>");
+  }
+  const corrected = `mmi-cli ${kept.join(" ")}`;
+  return {
+    message: `unknown option '${flag}' \u2014 \`oracle issue comment\` is append-only (no comment edit/update or \`--id\` route); post a new comment with \`${corrected}\` or read existing comments with \`mmi-cli oracle issue view <ref> --json comments\``,
+    corrected
+  };
+}
 var BOARD_CLAIM_OWN_FLAGS = ["--repo", "--for", "--force", "--check", "--allow-partial", "--json"];
 function splitInlineSelectors(argv, flags) {
   const out = [];
@@ -15016,6 +15057,15 @@ var GUIDES = /* @__PURE__ */ new Map([
       did_you_mean: "oracle issue edit"
     }
   ],
+  // #9574: `oracle issue comment` is append-only; callers guessing `oracle issue comment edit` get the append-only route.
+  [
+    "oracle issue comment:edit",
+    {
+      hint: "no `oracle issue comment edit` \u2014 issue comments are append-only; post a new comment with `mmi-cli oracle issue comment <ref> --body-file <path>` or read existing comments with `mmi-cli oracle issue view <ref> --json comments`",
+      expected: ["oracle issue comment", "oracle issue view"],
+      did_you_mean: "oracle issue comment"
+    }
+  ],
   // Worktree creation belongs to Git or the selected host, not an MMI command.
   [
     "worktree:create",
@@ -15315,7 +15365,7 @@ async function mintFilingWriteToken(deps) {
   try {
     return await mintFromMember(
       deps,
-      { metadata: "read", contents: "write", issues: "write", pull_requests: "write" },
+      { metadata: "read", contents: "write", issues: "write", pull_requests: "write", workflows: "write" },
       APP_VAULT_KEYS
     );
   } catch (e) {
@@ -17811,7 +17861,7 @@ var DECLARED_ENTRIES = [
   // #4118: Listening + systemd-active ≠ GitHub online after acquirejob 503. restart.conf cannot see
   // it; an Actions workflow on mmi-live cannot heal it when half the fleet is offline. Root cron.
   { name: "mmi-runner-online-reconcile (mmi-runner)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; API-offline + _diag acquirejob, max 2 restarts/tick (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
-  { name: "mmi-runner-online-reconcile (mmi-runner2)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; scripts/runner2-online-reconcile.cron selects lanes 15-16, disables credential files, _diag acquirejob only, max 2 restarts/tick; rollout #7859 (verify: mmi-cli devops runtime box get mmi-runner2 --ssh)" },
+  { name: "mmi-runner-online-reconcile (mmi-runner2)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; scripts/runner2-online-reconcile.cron selects lanes 13-16, disables credential files, _diag acquirejob only, max 2 restarts/tick; rollout #7859 (verify: mmi-cli devops runtime box get mmi-runner2 --ssh)" },
   // #5292: a lane that holds a dispatched JOB but produces zero output past the budget honestly
   // reports "busy", so the online reconcile never fires and GitHub will not re-dispatch while the
   // run holds the assignment. This tick cancels + re-triggers those runs (max 1/tick, debounced).
@@ -27456,10 +27506,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.6",
-    tag: "v4.6.6",
-    commit: "8431efc33b8c",
-    npm: "@mutmutco/cli@4.6.6"
+    version: "4.6.8",
+    tag: "v4.6.8",
+    commit: "0dd075a0d2c1",
+    npm: "@mutmutco/cli@4.6.8"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27476,14 +27526,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.6"
+          v3Target: "v4.6.8"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.6 and redeploy the Hub Lambda from tag v4.6.6 (8431efc33b8c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.6 (@mutmutco/cli@4.6.6, tag commit 8431efc33b8c \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.8 and redeploy the Hub Lambda from tag v4.6.8 (0dd075a0d2c1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.8 (@mutmutco/cli@4.6.8, tag commit 0dd075a0d2c1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -41374,6 +41424,20 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
         state: "queued",
         ...read.mergeQueueEntry ? { position: read.mergeQueueEntry.position, entryState: read.mergeQueueEntry.state } : {}
       };
+      const groupSha = read.mergeQueueEntry?.headCommit?.oid;
+      if (!options.enqueueOnly && groupSha && deps.findQueueStartupFailure) {
+        const startup = await deps.findQueueStartupFailure(base.repo, groupSha).catch(() => void 0);
+        if (startup) {
+          const detail = startup.annotation ? `: ${startup.annotation}` : startup.url ? ` (${startup.url})` : "";
+          const result2 = {
+            ...base,
+            queueRunStartupFailure: startup,
+            error: `queue-run-startup-failure: ${startup.workflow} run ${startup.runId} on ${startup.headSha}${detail}`
+          };
+          deps.queueProgress?.(result2);
+          return result2;
+        }
+      }
       deps.queueProgress?.(base);
       if (options.enqueueOnly) return { ...base, status: "queued" };
     } else if (read.state === "OPEN" && !read.autoMergeRequest) {
@@ -41678,6 +41742,17 @@ function readOverrideTrailer(trailer, body, cwd) {
   }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
   return { value, messageTransform: footer[1] ? "strip-squash-separator-coauthors" : "strip-terminal-coauthors" };
 }
+function readMessageOverride(message2, cwd) {
+  const prefix = `${TRAILER_KEY.toLowerCase()}:`;
+  const direct = (0, import_node_child_process10.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    windowsHide: true,
+    cwd,
+    input: message2,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024
+  }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
+  return readOverrideTrailer(direct, message2, cwd).value;
+}
 function readOverride(base, cwd, head = "HEAD") {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
   const refusals = [];
@@ -41706,6 +41781,9 @@ var HOTFIX_DIFF_BASE = "origin/main";
 var TEST_RE = TEST_FILE_RE;
 var PY_TEST_RE = PY_TEST_FILE_RE;
 var GO_TEST_RE = GO_TEST_FILE_RE;
+function readMessageOverride2(message2, cwd) {
+  return readMessageOverride(message2, cwd);
+}
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -42531,33 +42609,38 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
   });
   const rejected = (reason) => admissionRejected(reason, repo, pr);
   const reconcile = async (reason, recordEntry = false, resumingSaved = false) => {
-    try {
-      const observed = await readPrMergeQueue(pr, repo, read);
-      if (observed.state === "MERGED" && observed.headRefOid === head) return { mergeStatus: "merged" };
-      if (observed.isInMergeQueue && observed.headRefOid === head) {
-        const entry = observed.mergeQueueEntry;
-        if (recordEntry && receipt?.head === head && entry?.headCommit && entry.enqueuedAt) {
-          journal.save("enqueued", receipt?.uuid, { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt });
+    const maxReads = options.enqueueOnly ? 3 : 1;
+    const sleep3 = options.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+    for (let readAttempt = 0; readAttempt < maxReads; readAttempt++) {
+      if (readAttempt) await sleep3(readAttempt * 1e3);
+      try {
+        const observed = await readPrMergeQueue(pr, repo, read);
+        if (observed.state === "MERGED" && observed.headRefOid === head) return { mergeStatus: "merged" };
+        if (observed.isInMergeQueue && observed.headRefOid === head) {
+          const entry = observed.mergeQueueEntry;
+          if (recordEntry && receipt?.head === head && entry?.headCommit && entry.enqueuedAt) {
+            journal.save("enqueued", receipt?.uuid, { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt });
+          }
+          return { mergeStatus: "auto-merge-enqueued" };
         }
-        return { mergeStatus: "auto-merge-enqueued" };
-      }
-      const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
-      const boundMs = saved?.queueEntry ? Date.parse(saved.queueEntry.enqueuedAt) : resumingSaved && saved?.state === "enqueued" && saved.queueWitnessed === void 0 ? saved.observedAt : void 0;
-      if (saved && boundMs !== void 0 && Number.isFinite(boundMs) && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
-        const events = await readArrayPages(
-          `repos/${repo}/issues/${pr}/timeline?per_page=100`,
-          options.timelineRead ?? read,
-          "queue ejection timeline unreadable"
-        );
-        const times = (name) => events.filter((event) => event.event === name).map((event) => Date.parse(event.created_at));
-        const adds = times("added_to_merge_queue").filter((at) => at >= boundMs);
-        const removals = adds.length === 1 ? times("removed_from_merge_queue").filter((at) => at > adds[0]) : [];
-        if (removals.length === 1) {
-          journal.save("ejected");
-          return rejected("the previous admission was ejected by GitHub; rerun to submit a new intent");
+        const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
+        const boundMs = saved?.queueEntry ? Date.parse(saved.queueEntry.enqueuedAt) : resumingSaved && saved?.state === "enqueued" && saved.queueWitnessed === void 0 ? saved.observedAt : void 0;
+        if (saved && boundMs !== void 0 && Number.isFinite(boundMs) && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
+          const events = await readArrayPages(
+            `repos/${repo}/issues/${pr}/timeline?per_page=100`,
+            options.timelineRead ?? read,
+            "queue ejection timeline unreadable"
+          );
+          const times = (name) => events.filter((event) => event.event === name).map((event) => Date.parse(event.created_at));
+          const adds = times("added_to_merge_queue").filter((at) => at >= boundMs);
+          const removals = adds.length === 1 ? times("removed_from_merge_queue").filter((at) => at > adds[0]) : [];
+          if (removals.length === 1) {
+            journal.save("ejected");
+            return rejected("the previous admission was ejected by GitHub; rerun to submit a new intent");
+          }
         }
+      } catch {
       }
-    } catch {
     }
     return unknown(reason);
   };
@@ -42738,6 +42821,19 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     error: "GitHub accepted queue admission but has not confirmed queue membership. Rerun pr land to resume the saved operation read-only."
   };
 }
+function githubQueueSquashMessage(title, pr, commits) {
+  const list = commits.map((commit) => `* ${commit.headline}
+
+${commit.body}`.trim()).join("\n\n");
+  return `${title} (#${pr})
+
+${list}
+
+---------
+
+Co-authored-by: GitHub <noreply@github.com>
+`;
+}
 async function enqueuePrMergeQueue(pr, repo, options = {}) {
   if (!/^\d+$/.test(pr)) throw new Error("merge queue enqueue requires a PR number");
   pr = pr.replace(/^0+(?=\d)/, "");
@@ -42853,6 +42949,19 @@ ${pull.body}`;
     ])];
     return preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${verdict.message}`);
   }
+  if (method === "SQUASH" && policy.body === "COMMIT_MESSAGES" && messages.length > 1 && options.bodyText == null && messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
+${message2.body}`)) && !readMessageOverride2(githubQueueSquashMessage(pull.title, pr, messages), process.cwd())) {
+    return {
+      mergeStatus: "failed",
+      preparation: {
+        status: "preparation-needed",
+        reason: "queue-message-override",
+        issueTargets: [],
+        nextAction: "PR author: this repository squashes with COMMIT_MESSAGES, and GitHub composes a multi-commit squash as a list of every commit message followed by its own co-author block, so this Test-Policy-Override trailer would not be in the final trailer block the queue check reads. Put the change in ONE commit whose message ends with a trailer block carrying the waiver (no force-push: push a new branch whose single commit has the same tree, parented on the PR base; open it as a new PR and close this one), or make the waiver the final trailer block of the LAST commit, then rerun pr land. Keep repository settings unchanged."
+      },
+      error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
+    };
+  }
   const requiredBody = options.bodyText ?? composedBody;
   const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
   if (requiredBody && !prBodyPreservesOverrides && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
@@ -42904,6 +43013,54 @@ async function findPrMergeGroupRun(pr, repo, base, gh2 = readApi) {
   const run = pages.flatMap((page) => page.workflow_runs).filter((run2) => run2.head_branch?.startsWith(prefix)).sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id - a.id)[0];
   return run ? { id: run.id, url: run.html_url, conclusion: run.conclusion } : void 0;
 }
+async function findPrMergeQueueStartupFailure(repo, groupHeadSha, gh2 = readApi) {
+  if (!/^[a-f0-9]{40}$/i.test(groupHeadSha)) return void 0;
+  try {
+    const body = JSON.parse(await gh2([`repos/${repo}/actions/runs?head_sha=${groupHeadSha}&per_page=100`]));
+    const runs2 = (body.workflow_runs ?? []).filter((r) => r.head_sha?.toLowerCase() === groupHeadSha.toLowerCase() && r.status === "completed");
+    for (const run of runs2) {
+      let isStartupFailure = run.conclusion === "startup_failure";
+      if (!isStartupFailure && run.conclusion === "failure") {
+        const jobsBody = JSON.parse(await gh2([`repos/${repo}/actions/runs/${run.id}/jobs?per_page=1`]));
+        if (jobsBody.total_count === 0 && Array.isArray(jobsBody.jobs) && jobsBody.jobs.length === 0) {
+          isStartupFailure = true;
+        }
+      }
+      if (!isStartupFailure) continue;
+      const workflow = (run.path?.replace(/^\.github\/workflows\//, "") || run.name || "workflow").trim();
+      let annotation;
+      if (run.check_suite_id) {
+        try {
+          const checkRuns = JSON.parse(await gh2([`repos/${repo}/check-suites/${run.check_suite_id}/check-runs?per_page=20`]));
+          for (const cr of checkRuns.check_runs ?? []) {
+            const summary = [cr.output?.title, cr.output?.summary].filter(Boolean).join(" \u2014 ").trim();
+            if (summary) {
+              annotation = summary;
+              break;
+            }
+            const anns = JSON.parse(await gh2([`repos/${repo}/check-runs/${cr.id}/annotations?per_page=10`]));
+            const first = Array.isArray(anns) ? anns.find((a) => a?.message || a?.title) : void 0;
+            if (first) {
+              annotation = (first.message || first.title || "").trim();
+              break;
+            }
+          }
+        } catch {
+        }
+      }
+      return {
+        workflow,
+        runId: run.id,
+        headSha: groupHeadSha,
+        ...run.html_url ? { url: run.html_url } : {},
+        ...annotation ? { annotation } : {}
+      };
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
 function workflowNeeds(text) {
   const doc = (0, import_yaml3.parse)(text);
   const out = /* @__PURE__ */ new Map();
@@ -42999,6 +43156,9 @@ async function readBaseRedVerdict(result, gh2 = appOnlyReadApi) {
   return mine && base && failuresAllOnBase(mine, base) ? { baseRunId: String(baseRun.id) } : void 0;
 }
 function prMergeQueueLine(result) {
+  if (result.queueRunStartupFailure) {
+    return `pr land: PR #${result.pr} ${result.error ?? `queue-run-startup-failure: ${result.queueRunStartupFailure.workflow} run ${result.queueRunStartupFailure.runId} on ${result.queueRunStartupFailure.headSha}`}`;
+  }
   const queue = result.mergeQueue;
   if (!queue) return void 0;
   switch (queue.state) {
@@ -59501,6 +59661,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         readMergeQueue: readPrMergeQueue,
         observeQueued: (prNumber, repo, snapshot) => observeQueuedAdmission(repo, prNumber, snapshot),
         findMergeGroupRun: findPrMergeGroupRun,
+        findQueueStartupFailure: findPrMergeQueueStartupFailure,
         queueProgress: (receipt) => {
           const line = prMergeQueueLine(receipt);
           if (line) (o.json ? console.warn : printLine)(line);
@@ -65676,15 +65837,18 @@ function formatBrokerRunListRecovery(spec, jq) {
 }
 function brokerGhFailureHint(failureText, args, jq) {
   const target = args[0] === "pr" && args[1] === "view" ? args[2] : void 0;
+  const repoIdx = args.indexOf("--repo");
+  const repo = repoIdx >= 0 && args[repoIdx + 1] && !args[repoIdx + 1].startsWith("-") ? args[repoIdx + 1] : void 0;
   const unknownField = /Unknown JSON field: "([^"]+)"/.exec(failureText)?.[1] ?? /Unknown JSON field: ([A-Za-z][A-Za-z0-9]*)/.exec(failureText)?.[1];
   if (unknownField === "mergeQueueEntry" || unknownField === "isInMergeQueue") {
-    return `'${unknownField}' is not a gh pr view --json field \u2014 read the merge queue with \`mmi-cli devops read pr queue ${target ?? "<number>"} --repo <owner/repo> --json\` and drop it from --json; repeating this read cannot succeed`;
+    return `'${unknownField}' is not a gh pr view --json field \u2014 read the merge queue with \`mmi-cli devops read pr queue ${target ?? "<number>"} --repo ${repo ?? "<owner/repo>"} --json\` and drop it from --json; repeating this read cannot succeed`;
   }
   if (unknownField) {
     return `gh rejected --json field '${unknownField}' \u2014 drop it or use the typed read whose fields cover it (the "Available fields" list gh printed is its own vocabulary)`;
   }
   if (/Could not resolve to a PullRequest/i.test(failureText)) {
-    return `GitHub could not resolve the PR${target ? ` #${target}` : ""} \u2014 verify the number and that --repo names the repo that owns it before retrying; an identical re-run fails the same way`;
+    const slug = repo ?? "<owner/repo>";
+    return `GitHub could not resolve the PR${target ? ` #${target}` : ""}${repo ? ` in ${repo}` : ""} \u2014 verify the number and that --repo names the repo that owns it before retrying, or list PRs with \`mmi-cli devops read pr list --repo ${slug} --state all --json number,title,headRefName\`; an identical re-run fails the same way`;
   }
   if (args[0] === "run" && args[1] === "list") {
     return formatBrokerRunListRecovery({ program: "gh", args: [...args], timeoutMs: SINGLE_SHOT_TIMEOUT_MS }, jq);
@@ -66062,11 +66226,26 @@ function branchRulesReadHint(path2) {
   const slug = `${match[1]}/${match[2]}`;
   return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`.`;
 }
+function commitsReadHint(path2) {
+  const clean4 = path2.split("?")[0];
+  if (branchRulesReadHint(clean4) || checkRunsReadHint(clean4)) return "";
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:commits|branches)(?:[/?#]|$)`).exec(clean4);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` No raw commits or branches endpoint is on the App allowlist \u2014 to compare branch tips, ahead/behind counts, and commit SHAs/dates (e.g. whether main is current with development), use the allowlisted compare read \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/compare/main...development"\` (returns \`status\`, \`ahead_by\`, \`behind_by\`, \`base_commit\`, \`merge_base_commit\`, and \`commits\`), or inspect remote branch SHAs directly with \`git ls-remote --heads https://github.com/${slug}.git main development\`.`;
+}
+function checkRunsReadHint(path2) {
+  const clean4 = path2.split("?")[0];
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:check-suites(?:/|$)|check-runs(?:/|$)|commits/[^/?#]+/(?:check-runs|check-suites)(?:/|$))`).exec(clean4);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` Check-suite and check-run routes are deliberately outside the App allowlist \u2014 read per-check / per-job conclusions with the allowlisted \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs/<id>/jobs?per_page=100"\` or \`mmi-cli devops read run view <id> --repo ${slug} --json databaseId,workflowName,event,status,conclusion,jobs\`; check-run annotations and output text have no App-token read (ask a human token holder).`;
+}
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -69695,13 +69874,15 @@ function envelopeAwareWriteErr(str2) {
     const flag = match[1];
     const argv = process.argv.slice(2);
     const invoked = resolveCommandFromArgv(program2, argv);
-    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked), canonicalArgvFor(argv)) : void 0;
+    const invokedPath = invoked ? canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked) : void 0;
+    const canonicalArgv = canonicalArgvFor(argv);
+    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, invokedPath, canonicalArgv) ?? issueCommentAppendOnlyRecovery(flag, invokedPath, canonicalArgv) : void 0;
     if (claimStatus) {
       if (argvWantsJson3()) {
         process.stderr.write(
           formatErrorEnvelope(claimStatus.message, {
             code: ERROR_CODES.ERR_UNKNOWN_FLAG,
-            offending_flag: "--status",
+            offending_flag: flag.split("=")[0],
             corrected_command: claimStatus.corrected
           }) + "\n"
         );

package/dist/runbook-sweep.cjs

@@ -455,11 +455,13 @@ var init_cli_shared = __esm({
         const pool = appEnv ? "app" : !callerEnv ? ambientPool() : !callerEnv.GH_TOKEN ? "personal" : callerEnv.MMI_GH_POOL === "app" ? "app" : callerEnv.GH_TOKEN === process.env.GH_TOKEN ? ambientPool() : "caller";
         recordGhUsage("gh", pool, args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" "));
       }
-      if (!appEnv) return tag(run(), options.env?.MMI_GH_POOL === "app" ? "app_installation" : "user");
+      const ambientEnv = options.env ?? process.env;
+      const ambient = ambientEnv.MMI_GH_POOL === "app" || /^ghs_/.test(ambientEnv.GH_TOKEN || ambientEnv.GITHUB_TOKEN || "") ? "app_installation" : "user";
+      if (!appEnv) return tag(run(), ambient);
       try {
         return await tag(run(appEnv), "app_installation");
       } catch (e) {
-        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), "user");
+        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), ambient);
         throw e;
       }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.6",
+  "version": "4.6.8",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",