@mutmutco/cli 4.6.7 → 4.6.9

package/dist/main.cjs

@@ -1236,7 +1236,7 @@ var init_house_map = __esm({
       api: "devops",
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       run: "devops",
-      // #9479: one named workflow run — currently the bounded `run cancel <id>` write
+      // #9479: one named workflow run — the bounded `run cancel <id>` and `run rerun <id>` writes
       ci: "devops",
       // the CI/gate audit
       jev: "devops",
@@ -1636,11 +1636,13 @@ var init_cli_shared = __esm({
         const pool = appEnv ? "app" : !callerEnv ? ambientPool() : !callerEnv.GH_TOKEN ? "personal" : callerEnv.MMI_GH_POOL === "app" ? "app" : callerEnv.GH_TOKEN === process.env.GH_TOKEN ? ambientPool() : "caller";
         recordGhUsage("gh", pool, args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" "));
       }
-      if (!appEnv) return tag(run(), options.env?.MMI_GH_POOL === "app" ? "app_installation" : "user");
+      const ambientEnv = options.env ?? process.env;
+      const ambient = ambientEnv.MMI_GH_POOL === "app" || /^ghs_/.test(ambientEnv.GH_TOKEN || ambientEnv.GITHUB_TOKEN || "") ? "app_installation" : "user";
+      if (!appEnv) return tag(run(), ambient);
       try {
         return await tag(run(appEnv), "app_installation");
       } catch (e) {
-        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), "user");
+        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), ambient);
         throw e;
       }
     };
@@ -13871,6 +13873,45 @@ function boardClaimStatusFlagRecovery(flag, canonicalPath, argv) {
     corrected: `mmi-cli ${kept.join(" ")}`
   };
 }
+function issueCommentAppendOnlyRecovery(flag, canonicalPath, argv) {
+  if (canonicalPath !== "oracle issue comment") return void 0;
+  const hasEditVerb = argv.some((t, idx) => idx >= 3 && !t.startsWith("-") && /^(?:edit|update|patch|modify)$/i.test(t));
+  if (flag !== "--id" && !flag.startsWith("--id=") && !hasEditVerb) return void 0;
+  const valueFlags = /* @__PURE__ */ new Set(["--repo", "--body", "--body-file"]);
+  const kept = [];
+  let sawTarget = false;
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (i < 3) {
+      kept.push(tok);
+      continue;
+    }
+    if (tok.startsWith("--id=")) continue;
+    if (tok === "--id") {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) i++;
+      continue;
+    }
+    if (tok.startsWith("-")) {
+      kept.push(tok);
+      const name = tok.includes("=") ? tok.slice(0, tok.indexOf("=")) : tok;
+      if (!tok.includes("=") && valueFlags.has(name) && i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+        kept.push(argv[++i]);
+      }
+      continue;
+    }
+    if (/^(?:edit|update|patch|modify)$/i.test(tok)) continue;
+    sawTarget = true;
+    kept.push(tok);
+  }
+  if (!sawTarget) {
+    kept.splice(3, 0, "<ref>");
+  }
+  const corrected = `mmi-cli ${kept.join(" ")}`;
+  return {
+    message: `unknown option '${flag}' \u2014 \`oracle issue comment\` is append-only (no comment edit/update or \`--id\` route); post a new comment with \`${corrected}\` or read existing comments with \`mmi-cli oracle issue view <ref> --json comments\``,
+    corrected
+  };
+}
 var BOARD_CLAIM_OWN_FLAGS = ["--repo", "--for", "--force", "--check", "--allow-partial", "--json"];
 function splitInlineSelectors(argv, flags) {
   const out = [];
@@ -15016,6 +15057,15 @@ var GUIDES = /* @__PURE__ */ new Map([
       did_you_mean: "oracle issue edit"
     }
   ],
+  // #9574: `oracle issue comment` is append-only; callers guessing `oracle issue comment edit` get the append-only route.
+  [
+    "oracle issue comment:edit",
+    {
+      hint: "no `oracle issue comment edit` \u2014 issue comments are append-only; post a new comment with `mmi-cli oracle issue comment <ref> --body-file <path>` or read existing comments with `mmi-cli oracle issue view <ref> --json comments`",
+      expected: ["oracle issue comment", "oracle issue view"],
+      did_you_mean: "oracle issue comment"
+    }
+  ],
   // Worktree creation belongs to Git or the selected host, not an MMI command.
   [
     "worktree:create",
@@ -15297,6 +15347,8 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["ci cancel-orphans", { metadata: "read", actions: "write" }],
   // #9479: one named run cancelled under the same actions:write profile as the orphan sweep.
   ["run cancel", { metadata: "read", actions: "write" }],
+  // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
+  ["run rerun", { metadata: "read", actions: "write" }],
   ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
   // #8401: the detached related-issue lookup (issue list/view reads + one marker comment) — no identity contract.
   ["issue discover-related", { metadata: "read", issues: "write" }]
@@ -17811,7 +17863,7 @@ var DECLARED_ENTRIES = [
   // #4118: Listening + systemd-active ≠ GitHub online after acquirejob 503. restart.conf cannot see
   // it; an Actions workflow on mmi-live cannot heal it when half the fleet is offline. Root cron.
   { name: "mmi-runner-online-reconcile (mmi-runner)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; API-offline + _diag acquirejob, max 2 restarts/tick (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
-  { name: "mmi-runner-online-reconcile (mmi-runner2)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; scripts/runner2-online-reconcile.cron selects lanes 15-16, disables credential files, _diag acquirejob only, max 2 restarts/tick; rollout #7859 (verify: mmi-cli devops runtime box get mmi-runner2 --ssh)" },
+  { name: "mmi-runner-online-reconcile (mmi-runner2)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; scripts/runner2-online-reconcile.cron selects lanes 13-16, disables credential files, _diag acquirejob only, max 2 restarts/tick; rollout #7859 (verify: mmi-cli devops runtime box get mmi-runner2 --ssh)" },
   // #5292: a lane that holds a dispatched JOB but produces zero output past the budget honestly
   // reports "busy", so the online reconcile never fires and GitHub will not re-dispatch while the
   // run holds the assignment. This tick cancels + re-triggers those runs (max 1/tick, debounced).
@@ -24989,10 +25041,15 @@ function checkRunbookCoverage(docs, base, git3) {
       const heading = headings[i];
       const end = headings.slice(i + 1).find((h) => h.level <= heading.level)?.start ?? lines2.length + 1;
       const markerEnd = headings[i + 1]?.start ?? end;
-      const globs = lines2.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
+      const markers = lines2.slice(heading.start, markerEnd - 1).flatMap((text, j) => {
+        const found = /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim());
+        return found ? [{ line: heading.start + 1 + j, globs: found }] : [];
+      });
+      const globs = markers.flatMap((m) => m.globs);
       const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)) && !changesOnlyUses(path2));
       if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
-        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
+        const markerLine = markers.find((m) => m.globs.some((glob) => affected.some((path2) => matches(glob, path2)))).line;
+        findings.push({ kind: "runbook-section-stale", doc, line: markerLine, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}, covers marker at line ${markerLine}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
       }
     }
   }
@@ -27456,10 +27513,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.7",
-    tag: "v4.6.7",
-    commit: "c78249dd0d9d",
-    npm: "@mutmutco/cli@4.6.7"
+    version: "4.6.9",
+    tag: "v4.6.9",
+    commit: "7cbf84926132",
+    npm: "@mutmutco/cli@4.6.9"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27476,14 +27533,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.7"
+          v3Target: "v4.6.9"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.7 and redeploy the Hub Lambda from tag v4.6.7 (c78249dd0d9d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.7 (@mutmutco/cli@4.6.7, tag commit c78249dd0d9d \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.9 and redeploy the Hub Lambda from tag v4.6.9 (7cbf84926132); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.9 (@mutmutco/cli@4.6.9, tag commit 7cbf84926132 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -32056,8 +32113,11 @@ function classifyRunnerCost(selector) {
 }
 var STANDARD_HOSTED_ALLOWLIST = [
   ["mutmutco/MMI-Hub", ".github/workflows/launcher-build.yml", "build", "windows-latest"],
-  ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"]
+  ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"],
+  // #9571 (MM-Work#8894 chooser): owned mmi-heavy first, included ubuntu-latest only on a deep backlog.
+  ["mutmutco/MMI-Hub", ".github/workflows/gate.yml", "cli-part", "hosted-spill"]
 ];
+var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*'([^']+)'\s*\|\|\s*)?fromJSON\(needs\.[\w-]+\.outputs\.heavy_runs_on\s*\|\|\s*('[^']+')\)\s*\}\}$/;
 function standardHostedLabelFor(repo, path2, jobId) {
   if (repo === "mutmutco/Jerv-Hub") return ["ubuntu-latest", "windows-latest", "macos-14"];
   return STANDARD_HOSTED_ALLOWLIST.find(([r, p, j]) => r === repo && p === path2 && j === jobId)?.[3];
@@ -32072,6 +32132,8 @@ function classifyJobRunnerCost(job, allowance2) {
   if (approved(raw) || allowance2 === "windows-11-arm" && raw === allowance2) return "standard-hosted";
   const fallback = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'([^']+)'\s*\|\|\s*(fromJSON\('[^']+'\))\s*\}\}$/.exec(raw);
   if (fallback && approved(fallback[1]) && classifyRunnerCost("${{ " + fallback[2] + " }}") === "self-hosted") return "standard-hosted";
+  const spill = allowance2 === "hosted-spill" ? HOSTED_SPILL_RE.exec(raw) : null;
+  if (spill) return (!spill[1] || spill[1] === "ubuntu-latest") && classifyRunnerCost(`\${{ fromJSON(${spill[2]}) }}`) === "self-hosted" ? "standard-hosted" : "unknown";
   const direct = classifyRunnerCost(raw);
   const matrix = /^\$\{\{\s*matrix\.([\w-]+)(?:\.([\w-]+))?\s*\}\}$/.exec(raw);
   if (!matrix || direct === "hosted") return direct;
@@ -38593,7 +38655,7 @@ function runsOnLabelSets(job) {
   if (plainRecord(selector)) selector = selector.labels;
   if (typeof selector !== "string" || !selector.includes("${{")) return [toSet(selector)].filter((s) => Boolean(s));
   const sets = [];
-  for (const m of selector.matchAll(/fromJSON\('([^']+)'\)/g)) {
+  for (const m of selector.matchAll(/fromJSON\((?:needs\.[\w-]+\.outputs\.[\w-]+\s*\|\|\s*)?'([^']+)'\)/g)) {
     try {
       const parsed = toSet(JSON.parse(m[1]));
       if (parsed) sets.push(parsed);
@@ -41374,6 +41436,20 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
         state: "queued",
         ...read.mergeQueueEntry ? { position: read.mergeQueueEntry.position, entryState: read.mergeQueueEntry.state } : {}
       };
+      const groupSha = read.mergeQueueEntry?.headCommit?.oid;
+      if (!options.enqueueOnly && groupSha && deps.findQueueStartupFailure) {
+        const startup = await deps.findQueueStartupFailure(base.repo, groupSha).catch(() => void 0);
+        if (startup) {
+          const detail = startup.annotation ? `: ${startup.annotation}` : startup.url ? ` (${startup.url})` : "";
+          const result2 = {
+            ...base,
+            queueRunStartupFailure: startup,
+            error: `queue-run-startup-failure: ${startup.workflow} run ${startup.runId} on ${startup.headSha}${detail}`
+          };
+          deps.queueProgress?.(result2);
+          return result2;
+        }
+      }
       deps.queueProgress?.(base);
       if (options.enqueueOnly) return { ...base, status: "queued" };
     } else if (read.state === "OPEN" && !read.autoMergeRequest) {
@@ -41678,6 +41754,17 @@ function readOverrideTrailer(trailer, body, cwd) {
   }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
   return { value, messageTransform: footer[1] ? "strip-squash-separator-coauthors" : "strip-terminal-coauthors" };
 }
+function readMessageOverride(message2, cwd) {
+  const prefix = `${TRAILER_KEY.toLowerCase()}:`;
+  const direct = (0, import_node_child_process10.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    windowsHide: true,
+    cwd,
+    input: message2,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024
+  }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
+  return readOverrideTrailer(direct, message2, cwd).value;
+}
 function readOverride(base, cwd, head = "HEAD") {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
   const refusals = [];
@@ -41706,6 +41793,9 @@ var HOTFIX_DIFF_BASE = "origin/main";
 var TEST_RE = TEST_FILE_RE;
 var PY_TEST_RE = PY_TEST_FILE_RE;
 var GO_TEST_RE = GO_TEST_FILE_RE;
+function readMessageOverride2(message2, cwd) {
+  return readMessageOverride(message2, cwd);
+}
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -42531,33 +42621,38 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
   });
   const rejected = (reason) => admissionRejected(reason, repo, pr);
   const reconcile = async (reason, recordEntry = false, resumingSaved = false) => {
-    try {
-      const observed = await readPrMergeQueue(pr, repo, read);
-      if (observed.state === "MERGED" && observed.headRefOid === head) return { mergeStatus: "merged" };
-      if (observed.isInMergeQueue && observed.headRefOid === head) {
-        const entry = observed.mergeQueueEntry;
-        if (recordEntry && receipt?.head === head && entry?.headCommit && entry.enqueuedAt) {
-          journal.save("enqueued", receipt?.uuid, { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt });
+    const maxReads = options.enqueueOnly ? 3 : 1;
+    const sleep3 = options.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+    for (let readAttempt = 0; readAttempt < maxReads; readAttempt++) {
+      if (readAttempt) await sleep3(readAttempt * 1e3);
+      try {
+        const observed = await readPrMergeQueue(pr, repo, read);
+        if (observed.state === "MERGED" && observed.headRefOid === head) return { mergeStatus: "merged" };
+        if (observed.isInMergeQueue && observed.headRefOid === head) {
+          const entry = observed.mergeQueueEntry;
+          if (recordEntry && receipt?.head === head && entry?.headCommit && entry.enqueuedAt) {
+            journal.save("enqueued", receipt?.uuid, { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt });
+          }
+          return { mergeStatus: "auto-merge-enqueued" };
         }
-        return { mergeStatus: "auto-merge-enqueued" };
-      }
-      const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
-      const boundMs = saved?.queueEntry ? Date.parse(saved.queueEntry.enqueuedAt) : resumingSaved && saved?.state === "enqueued" && saved.queueWitnessed === void 0 ? saved.observedAt : void 0;
-      if (saved && boundMs !== void 0 && Number.isFinite(boundMs) && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
-        const events = await readArrayPages(
-          `repos/${repo}/issues/${pr}/timeline?per_page=100`,
-          options.timelineRead ?? read,
-          "queue ejection timeline unreadable"
-        );
-        const times = (name) => events.filter((event) => event.event === name).map((event) => Date.parse(event.created_at));
-        const adds = times("added_to_merge_queue").filter((at) => at >= boundMs);
-        const removals = adds.length === 1 ? times("removed_from_merge_queue").filter((at) => at > adds[0]) : [];
-        if (removals.length === 1) {
-          journal.save("ejected");
-          return rejected("the previous admission was ejected by GitHub; rerun to submit a new intent");
+        const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
+        const boundMs = saved?.queueEntry ? Date.parse(saved.queueEntry.enqueuedAt) : resumingSaved && saved?.state === "enqueued" && saved.queueWitnessed === void 0 ? saved.observedAt : void 0;
+        if (saved && boundMs !== void 0 && Number.isFinite(boundMs) && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
+          const events = await readArrayPages(
+            `repos/${repo}/issues/${pr}/timeline?per_page=100`,
+            options.timelineRead ?? read,
+            "queue ejection timeline unreadable"
+          );
+          const times = (name) => events.filter((event) => event.event === name).map((event) => Date.parse(event.created_at));
+          const adds = times("added_to_merge_queue").filter((at) => at >= boundMs);
+          const removals = adds.length === 1 ? times("removed_from_merge_queue").filter((at) => at > adds[0]) : [];
+          if (removals.length === 1) {
+            journal.save("ejected");
+            return rejected("the previous admission was ejected by GitHub; rerun to submit a new intent");
+          }
         }
+      } catch {
       }
-    } catch {
     }
     return unknown(reason);
   };
@@ -42738,6 +42833,19 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     error: "GitHub accepted queue admission but has not confirmed queue membership. Rerun pr land to resume the saved operation read-only."
   };
 }
+function githubQueueSquashMessage(title, pr, commits) {
+  const list = commits.map((commit) => `* ${commit.headline}
+
+${commit.body}`.trim()).join("\n\n");
+  return `${title} (#${pr})
+
+${list}
+
+---------
+
+Co-authored-by: GitHub <noreply@github.com>
+`;
+}
 async function enqueuePrMergeQueue(pr, repo, options = {}) {
   if (!/^\d+$/.test(pr)) throw new Error("merge queue enqueue requires a PR number");
   pr = pr.replace(/^0+(?=\d)/, "");
@@ -42853,6 +42961,19 @@ ${pull.body}`;
     ])];
     return preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${verdict.message}`);
   }
+  if (method === "SQUASH" && policy.body === "COMMIT_MESSAGES" && messages.length > 1 && options.bodyText == null && messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
+${message2.body}`)) && !readMessageOverride2(githubQueueSquashMessage(pull.title, pr, messages), process.cwd())) {
+    return {
+      mergeStatus: "failed",
+      preparation: {
+        status: "preparation-needed",
+        reason: "queue-message-override",
+        issueTargets: [],
+        nextAction: "PR author: this repository squashes with COMMIT_MESSAGES, and GitHub composes a multi-commit squash as a list of every commit message followed by its own co-author block, so this Test-Policy-Override trailer would not be in the final trailer block the queue check reads. Put the change in ONE commit whose message ends with a trailer block carrying the waiver (no force-push: push a new branch whose single commit has the same tree, parented on the PR base; open it as a new PR and close this one), or make the waiver the final trailer block of the LAST commit, then rerun pr land. Keep repository settings unchanged."
+      },
+      error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
+    };
+  }
   const requiredBody = options.bodyText ?? composedBody;
   const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
   if (requiredBody && !prBodyPreservesOverrides && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
@@ -42904,6 +43025,54 @@ async function findPrMergeGroupRun(pr, repo, base, gh2 = readApi) {
   const run = pages.flatMap((page) => page.workflow_runs).filter((run2) => run2.head_branch?.startsWith(prefix)).sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id - a.id)[0];
   return run ? { id: run.id, url: run.html_url, conclusion: run.conclusion } : void 0;
 }
+async function findPrMergeQueueStartupFailure(repo, groupHeadSha, gh2 = readApi) {
+  if (!/^[a-f0-9]{40}$/i.test(groupHeadSha)) return void 0;
+  try {
+    const body = JSON.parse(await gh2([`repos/${repo}/actions/runs?head_sha=${groupHeadSha}&per_page=100`]));
+    const runs2 = (body.workflow_runs ?? []).filter((r) => r.head_sha?.toLowerCase() === groupHeadSha.toLowerCase() && r.status === "completed");
+    for (const run of runs2) {
+      let isStartupFailure = run.conclusion === "startup_failure";
+      if (!isStartupFailure && run.conclusion === "failure") {
+        const jobsBody = JSON.parse(await gh2([`repos/${repo}/actions/runs/${run.id}/jobs?per_page=1`]));
+        if (jobsBody.total_count === 0 && Array.isArray(jobsBody.jobs) && jobsBody.jobs.length === 0) {
+          isStartupFailure = true;
+        }
+      }
+      if (!isStartupFailure) continue;
+      const workflow = (run.path?.replace(/^\.github\/workflows\//, "") || run.name || "workflow").trim();
+      let annotation;
+      if (run.check_suite_id) {
+        try {
+          const checkRuns = JSON.parse(await gh2([`repos/${repo}/check-suites/${run.check_suite_id}/check-runs?per_page=20`]));
+          for (const cr of checkRuns.check_runs ?? []) {
+            const summary = [cr.output?.title, cr.output?.summary].filter(Boolean).join(" \u2014 ").trim();
+            if (summary) {
+              annotation = summary;
+              break;
+            }
+            const anns = JSON.parse(await gh2([`repos/${repo}/check-runs/${cr.id}/annotations?per_page=10`]));
+            const first = Array.isArray(anns) ? anns.find((a) => a?.message || a?.title) : void 0;
+            if (first) {
+              annotation = (first.message || first.title || "").trim();
+              break;
+            }
+          }
+        } catch {
+        }
+      }
+      return {
+        workflow,
+        runId: run.id,
+        headSha: groupHeadSha,
+        ...run.html_url ? { url: run.html_url } : {},
+        ...annotation ? { annotation } : {}
+      };
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
 function workflowNeeds(text) {
   const doc = (0, import_yaml3.parse)(text);
   const out = /* @__PURE__ */ new Map();
@@ -42999,6 +43168,9 @@ async function readBaseRedVerdict(result, gh2 = appOnlyReadApi) {
   return mine && base && failuresAllOnBase(mine, base) ? { baseRunId: String(baseRun.id) } : void 0;
 }
 function prMergeQueueLine(result) {
+  if (result.queueRunStartupFailure) {
+    return `pr land: PR #${result.pr} ${result.error ?? `queue-run-startup-failure: ${result.queueRunStartupFailure.workflow} run ${result.queueRunStartupFailure.runId} on ${result.queueRunStartupFailure.headSha}`}`;
+  }
   const queue = result.mergeQueue;
   if (!queue) return void 0;
   switch (queue.state) {
@@ -43206,6 +43378,57 @@ function registerRunCancel(run, writeToken) {
     else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status}${receipt.runStatus ? `, runStatus: ${receipt.runStatus}` : ""})`);
   });
 }
+var RUN_RERUN_STATUS = "rerun-requested";
+async function rerunWorkflowRun(repo, id, deps, failed2 = false) {
+  const raw = String(id).trim();
+  if (!/^[1-9]\d*$/.test(raw)) throw new Error(`run rerun: <id> must be a positive workflow run id (received '${String(id)}')`);
+  const runId = Number(raw);
+  if (!Number.isSafeInteger(runId)) throw new Error(`run rerun: <id> ${raw} is beyond the safe integer range; refusing to address a different run`);
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`run rerun: --repo must be owner/repo (received '${repo}')`);
+  const projects = await deps.projects();
+  if (!projects) throw new Error("run rerun: the Hub project registry is unreadable; refusing to rerun on a repo this command cannot prove registered");
+  const key = registryRepoKey(repo);
+  if (!projects.some((p) => (p.repos ?? []).some((r) => typeof r === "string" && registryRepoKey(qualifyRegistryRepo(r)) === key))) {
+    throw new Error(`run rerun: ${repo} is not a registered org repo; App writes are limited to repos in the Hub registry`);
+  }
+  const mode = failed2 ? "failed" : "all";
+  let httpStatus;
+  try {
+    httpStatus = await deps.post(`repos/${repo}/actions/runs/${runId}/${failed2 ? "rerun-failed-jobs" : "rerun"}`);
+  } catch (error) {
+    const e = error;
+    const detail = String(e.stderr ?? error);
+    const code = /\bHTTP(?:\/[\d.]+)? (\d{3})\b/.exec(`${detail} ${e.stdout ?? ""}`)?.[1];
+    if (code === "403") throw new Error(`run rerun: GitHub App denied (HTTP 403) on ${repo}; actions:write permission is required; no personal-token fallback`);
+    if (code === "404") throw new Error(`run rerun: run ${runId} not found on ${repo} (HTTP 404), or the App cannot see that repo`);
+    if (code === "409" || code === "422") throw new Error(`run rerun: run ${runId} is not rerunnable (HTTP ${code}); it may still be in progress, or be past GitHub's rerun window`);
+    throw new Error(`run rerun: ${detail}`);
+  }
+  return { ok: true, repo, runId, mode, httpStatus, credential: "app_installation", status: RUN_RERUN_STATUS };
+}
+function appRunPost(writeToken, exec3 = execFileP) {
+  let token;
+  return async (path2) => {
+    token ??= await writeToken();
+    const { stdout } = await exec3("gh", ["api", "--include", "--method", "POST", path2], {
+      timeout: 2e4,
+      env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" }
+    });
+    return Number(/^HTTP\/[\d.]+ (\d{3})/.exec(stdout)?.[1] ?? 0);
+  };
+}
+function registerRunRerun(run, writeToken, projects) {
+  run.command("rerun <id>").description("rerun one workflow run on the org App (actions:write), registered repos only; --failed reruns only the failed jobs; prints a receipt").requiredOption("--repo <owner/repo>", "registered repository that owns the run").option("--failed", "rerun only the failed jobs (POST .../rerun-failed-jobs)").option("--json", "machine-readable receipt").action(async (id, options) => {
+    let receipt;
+    try {
+      receipt = await rerunWorkflowRun(options.repo, id, { projects, post: appRunPost(writeToken) }, options.failed === true);
+    } catch (error) {
+      return fail(error.message);
+    }
+    if (options.json) console.log(JSON.stringify(receipt));
+    else console.log(`run rerun: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.mode === "failed" ? "failed jobs" : "all jobs"} rerun requested (HTTP ${receipt.httpStatus}, credential: ${receipt.credential})`);
+  });
+}
 
 // src/board-commands.ts
 init_cli_shared();
@@ -59501,6 +59724,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         readMergeQueue: readPrMergeQueue,
         observeQueued: (prNumber, repo, snapshot) => observeQueuedAdmission(repo, prNumber, snapshot),
         findMergeGroupRun: findPrMergeGroupRun,
+        findQueueStartupFailure: findPrMergeQueueStartupFailure,
         queueProgress: (receipt) => {
           const line = prMergeQueueLine(receipt);
           if (line) (o.json ? console.warn : printLine)(line);
@@ -65676,15 +65900,18 @@ function formatBrokerRunListRecovery(spec, jq) {
 }
 function brokerGhFailureHint(failureText, args, jq) {
   const target = args[0] === "pr" && args[1] === "view" ? args[2] : void 0;
+  const repoIdx = args.indexOf("--repo");
+  const repo = repoIdx >= 0 && args[repoIdx + 1] && !args[repoIdx + 1].startsWith("-") ? args[repoIdx + 1] : void 0;
   const unknownField = /Unknown JSON field: "([^"]+)"/.exec(failureText)?.[1] ?? /Unknown JSON field: ([A-Za-z][A-Za-z0-9]*)/.exec(failureText)?.[1];
   if (unknownField === "mergeQueueEntry" || unknownField === "isInMergeQueue") {
-    return `'${unknownField}' is not a gh pr view --json field \u2014 read the merge queue with \`mmi-cli devops read pr queue ${target ?? "<number>"} --repo <owner/repo> --json\` and drop it from --json; repeating this read cannot succeed`;
+    return `'${unknownField}' is not a gh pr view --json field \u2014 read the merge queue with \`mmi-cli devops read pr queue ${target ?? "<number>"} --repo ${repo ?? "<owner/repo>"} --json\` and drop it from --json; repeating this read cannot succeed`;
   }
   if (unknownField) {
     return `gh rejected --json field '${unknownField}' \u2014 drop it or use the typed read whose fields cover it (the "Available fields" list gh printed is its own vocabulary)`;
   }
   if (/Could not resolve to a PullRequest/i.test(failureText)) {
-    return `GitHub could not resolve the PR${target ? ` #${target}` : ""} \u2014 verify the number and that --repo names the repo that owns it before retrying; an identical re-run fails the same way`;
+    const slug = repo ?? "<owner/repo>";
+    return `GitHub could not resolve the PR${target ? ` #${target}` : ""}${repo ? ` in ${repo}` : ""} \u2014 verify the number and that --repo names the repo that owns it before retrying, or list PRs with \`mmi-cli devops read pr list --repo ${slug} --state all --json number,title,headRefName\`; an identical re-run fails the same way`;
   }
   if (args[0] === "run" && args[1] === "list") {
     return formatBrokerRunListRecovery({ program: "gh", args: [...args], timeoutMs: SINGLE_SHOT_TIMEOUT_MS }, jq);
@@ -66062,11 +66289,26 @@ function branchRulesReadHint(path2) {
   const slug = `${match[1]}/${match[2]}`;
   return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`.`;
 }
+function commitsReadHint(path2) {
+  const clean4 = path2.split("?")[0];
+  if (branchRulesReadHint(clean4) || checkRunsReadHint(clean4)) return "";
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:commits|branches)(?:[/?#]|$)`).exec(clean4);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` No raw commits or branches endpoint is on the App allowlist \u2014 to compare branch tips, ahead/behind counts, and commit SHAs/dates (e.g. whether main is current with development), use the allowlisted compare read \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/compare/main...development"\` (returns \`status\`, \`ahead_by\`, \`behind_by\`, \`base_commit\`, \`merge_base_commit\`, and \`commits\`), or inspect remote branch SHAs directly with \`git ls-remote --heads https://github.com/${slug}.git main development\`.`;
+}
+function checkRunsReadHint(path2) {
+  const clean4 = path2.split("?")[0];
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:check-suites(?:/|$)|check-runs(?:/|$)|commits/[^/?#]+/(?:check-runs|check-suites)(?:/|$))`).exec(clean4);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` Check-suite and check-run routes are deliberately outside the App allowlist \u2014 read per-check / per-job conclusions with the allowlisted \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs/<id>/jobs?per_page=100"\` or \`mmi-cli devops read run view <id> --repo ${slug} --json databaseId,workflowName,event,status,conclusion,jobs\`; check-run annotations and output text have no App-token read (ask a human token holder).`;
+}
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -69695,13 +69937,15 @@ function envelopeAwareWriteErr(str2) {
     const flag = match[1];
     const argv = process.argv.slice(2);
     const invoked = resolveCommandFromArgv(program2, argv);
-    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked), canonicalArgvFor(argv)) : void 0;
+    const invokedPath = invoked ? canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked) : void 0;
+    const canonicalArgv = canonicalArgvFor(argv);
+    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, invokedPath, canonicalArgv) ?? issueCommentAppendOnlyRecovery(flag, invokedPath, canonicalArgv) : void 0;
     if (claimStatus) {
       if (argvWantsJson3()) {
         process.stderr.write(
           formatErrorEnvelope(claimStatus.message, {
             code: ERROR_CODES.ERR_UNKNOWN_FLAG,
-            offending_flag: "--status",
+            offending_flag: flag.split("=")[0],
             corrected_command: claimStatus.corrected
           }) + "\n"
         );
@@ -69784,7 +70028,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel") return;
+  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel" || commandPath4 === "run rerun") return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -70619,9 +70863,12 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
 });
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
-registerRunCancel(
-  program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` is the only one, and it rides the org App actions:write profile"),
-  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token
+var runRoot = program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` and `run rerun <id> [--failed]`, both on the org App actions:write profile");
+registerRunCancel(runRoot, async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token);
+registerRunRerun(
+  runRoot,
+  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run rerun")).token,
+  async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {

package/dist/runbook-sweep.cjs

@@ -455,11 +455,13 @@ var init_cli_shared = __esm({
         const pool = appEnv ? "app" : !callerEnv ? ambientPool() : !callerEnv.GH_TOKEN ? "personal" : callerEnv.MMI_GH_POOL === "app" ? "app" : callerEnv.GH_TOKEN === process.env.GH_TOKEN ? ambientPool() : "caller";
         recordGhUsage("gh", pool, args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" "));
       }
-      if (!appEnv) return tag(run(), options.env?.MMI_GH_POOL === "app" ? "app_installation" : "user");
+      const ambientEnv = options.env ?? process.env;
+      const ambient = ambientEnv.MMI_GH_POOL === "app" || /^ghs_/.test(ambientEnv.GH_TOKEN || ambientEnv.GITHUB_TOKEN || "") ? "app_installation" : "user";
+      if (!appEnv) return tag(run(), ambient);
       try {
         return await tag(run(appEnv), "app_installation");
       } catch (e) {
-        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), "user");
+        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), ambient);
         throw e;
       }
     };
@@ -8224,10 +8226,15 @@ function checkRunbookCoverage(docs, base, git) {
       const heading = headings[i];
       const end = headings.slice(i + 1).find((h) => h.level <= heading.level)?.start ?? lines.length + 1;
       const markerEnd = headings[i + 1]?.start ?? end;
-      const globs = lines.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
+      const markers = lines.slice(heading.start, markerEnd - 1).flatMap((text, j) => {
+        const found = /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim());
+        return found ? [{ line: heading.start + 1 + j, globs: found }] : [];
+      });
+      const globs = markers.flatMap((m) => m.globs);
       const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)) && !changesOnlyUses(path2));
       if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
-        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
+        const markerLine = markers.find((m) => m.globs.some((glob) => affected.some((path2) => matches(glob, path2)))).line;
+        findings.push({ kind: "runbook-section-stale", doc, line: markerLine, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}, covers marker at line ${markerLine}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.7",
+  "version": "4.6.9",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",