@mutmutco/codex-plugin 4.5.145 → 4.5.147

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.145",
+  "version": "4.5.147",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -18277,10 +18277,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.145",
-    tag: "v4.5.145",
-    commit: "765f3b953988",
-    npm: "@mutmutco/cli@4.5.145"
+    version: "4.5.147",
+    tag: "v4.5.147",
+    commit: "c21970738b82",
+    npm: "@mutmutco/cli@4.5.147"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18297,14 +18297,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.145"
+          v3Target: "v4.5.147"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.145 and redeploy the Hub Lambda from tag v4.5.145 (765f3b953988); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.145 (@mutmutco/cli@4.5.145, tag commit 765f3b953988 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.147 and redeploy the Hub Lambda from tag v4.5.147 (c21970738b82); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.147 (@mutmutco/cli@4.5.147, tag commit c21970738b82 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -39981,6 +39981,7 @@ async function updatePrHeadFromBase(input) {
   throw new Error(`GitHub accepted the update of ${input.head} from ${input.base} but the head did not move \u2014 check the PR, then rerun`);
 }
 var PR_LAND_POLL_MS = 6e4;
+var PR_LAND_EJECT_CONFIRM_MS = 2e4;
 var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
 var PR_LAND_STATE_READ_RETRIES = 3;
 var PR_LAND_STATE_READ_DELAY_MS = 15e3;
@@ -40155,6 +40156,13 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
       deps.queueProgress?.(base);
       if (options.enqueueOnly) return { ...base, status: "queued" };
     } else if (read.state === "OPEN" && !read.autoMergeRequest) {
+      await sleep2(PR_LAND_EJECT_CONFIRM_MS);
+      const again = await deps.readMergeQueue(pr, base.repo);
+      if (again.state === "MERGED") return queueMerged(base, deps);
+      if (again.isInMergeQueue || again.autoMergeRequest) {
+        snapshot = again;
+        continue;
+      }
       const run = await deps.findMergeGroupRun(pr, base.repo, base.base);
       const result2 = {
         ...base,
@@ -41226,6 +41234,32 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh2, opts) {
     return void 0;
   }
 }
+async function ghAdminTrueMergeWhenClean(prNumber, repo, opts = {}) {
+  const io = opts.io ?? defaultGhMergeAutoIo;
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const pollMs = opts.pollMs ?? 15e3;
+  const deadline = Date.now() + (opts.timeoutMs ?? 20 * 6e4);
+  for (; ; ) {
+    const raw = await io.gh(["pr", "view", prNumber, "--repo", repo, "--json", "state,mergeStateStatus"], GC_GH_TIMEOUT_MS).catch(() => "");
+    let view = {};
+    try {
+      view = JSON.parse(raw);
+    } catch {
+    }
+    if (view.state === "MERGED") return { mergeStatus: "merged" };
+    if (view.state === "CLOSED") return { mergeStatus: "failed", error: `PR #${prNumber} was closed without a merge` };
+    if (view.mergeStateStatus === "CLEAN") break;
+    if (Date.now() >= deadline) return { mergeStatus: "failed", error: `PR #${prNumber} not CLEAN before the deadline (${view.mergeStateStatus ?? "unread"})` };
+    await sleep2(pollMs);
+  }
+  try {
+    await io.gh(["pr", "merge", prNumber, "--repo", repo, "--merge", "--admin"], GH_MUTATION_TIMEOUT_MS);
+  } catch (e) {
+    const message2 = String(e.message || "");
+    if (!/already been merged/i.test(message2)) return { mergeStatus: "failed", error: ghFailureReason(e) };
+  }
+  return { mergeStatus: "merged" };
+}
 async function ghMergeAutoEnqueue(prNumber, repo, method, extra) {
   const io = extra?.io ?? defaultGhMergeAutoIo;
   const args = repo ? ["--repo", repo] : [];
@@ -41414,6 +41448,69 @@ async function deleteMergedRemoteBranch(options) {
   };
 }
 
+// src/pr-merge-queue.ts
+init_cli_shared();
+var readApi = async (args) => {
+  const env = await ghReadEnv();
+  return (await execFileP("gh", ["api", ...args], {
+    timeout: 2e4,
+    ...env ? { env } : {}
+  })).stdout;
+};
+async function queueGraphql(repo, fields, gh2) {
+  const [owner, name] = repo.split("/");
+  const response = JSON.parse(await gh2(["graphql", "-f", `query=query { repository(owner:${JSON.stringify(owner)},name:${JSON.stringify(name)}) { ${fields} } }`]));
+  if (response.errors?.length) throw new Error(response.errors.map((e) => e.message).join("; "));
+  if (!response.data?.repository) throw new Error("merge queue repository read failed");
+  return response.data.repository;
+}
+async function hasPrMergeQueue(repo, base, gh2 = readApi) {
+  const result = await queueGraphql(repo, `mergeQueue(branch:${JSON.stringify(base)}) { id }`, gh2);
+  return result.mergeQueue !== null;
+}
+async function readPrMergeQueueMethod(repo, base, gh2 = readApi) {
+  const result = await queueGraphql(
+    repo,
+    `mergeQueue(branch:${JSON.stringify(base)}) { configuration { mergeMethod } }`,
+    gh2
+  );
+  return result.mergeQueue ? result.mergeQueue.configuration?.mergeMethod ?? "UNKNOWN" : void 0;
+}
+function decideQueueMergeRoute(queueMethod, method, headRef) {
+  if (!queueMethod || `--${queueMethod.toLowerCase()}` === method) return "normal";
+  return method === "--merge" && /^(release-align|hotfix-fold)\//.test(headRef) ? "admin-true-merge" : "refuse";
+}
+async function readPrMergeQueue(pr, repo, gh2 = readApi) {
+  if (!/^\d+$/.test(pr)) throw new Error("merge queue read requires a PR number");
+  const result = await queueGraphql(
+    repo,
+    `pullRequest(number:${pr}) { state isInMergeQueue mergeQueueEntry { state position } autoMergeRequest { enabledAt } }`,
+    gh2
+  );
+  if (!result.pullRequest) throw new Error(`merge queue PR #${pr} not found`);
+  return result.pullRequest;
+}
+async function findPrMergeGroupRun(pr, repo, base, gh2 = readApi) {
+  const pages = JSON.parse(await gh2([`repos/${repo}/actions/runs?event=merge_group&per_page=100`, "--paginate", "--slurp"]));
+  const prefix = `gh-readonly-queue/${base}/pr-${pr}-`;
+  const run = pages.flatMap((page) => page.workflow_runs).filter((run2) => run2.head_branch?.startsWith(prefix)).sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id - a.id)[0];
+  return run ? { id: run.id, url: run.html_url, conclusion: run.conclusion } : void 0;
+}
+function prMergeQueueLine(result) {
+  const queue = result.mergeQueue;
+  if (!queue) return void 0;
+  switch (queue.state) {
+    case "queued":
+      return `pr land: PR #${result.pr} queued on ${queue.base}${queue.position === void 0 ? "" : ` (position ${queue.position})`}`;
+    case "merged":
+      return `pr land: PR #${result.pr} merged via merge queue`;
+    case "ejected":
+      return `pr land: PR #${result.pr} ejected from merge queue \u2014 ${queue.ejectedRun ? `merge_group run ${queue.ejectedRun.id} ${queue.ejectedRun.conclusion} ${queue.ejectedRun.url}` : "merge_group run not found"}`;
+    case "timeout":
+      return `pr land: PR #${result.pr} merge queue timeout on ${queue.base}`;
+  }
+}
+
 // src/project-info-sync.ts
 var import_node_fs34 = require("node:fs");
 var import_node_path33 = require("node:path");
@@ -42022,57 +42119,6 @@ function applyChecklistCheck(body, query, checked) {
   return { ok: true, edit: setChecklistMarker(body, sel.item, checked), item: sel.item };
 }
 
-// src/pr-merge-queue.ts
-init_cli_shared();
-var readApi = async (args) => {
-  const env = await ghReadEnv();
-  return (await execFileP("gh", ["api", ...args], {
-    timeout: 2e4,
-    ...env ? { env } : {}
-  })).stdout;
-};
-async function queueGraphql(repo, fields, gh2) {
-  const [owner, name] = repo.split("/");
-  const response = JSON.parse(await gh2(["graphql", "-f", `query=query { repository(owner:${JSON.stringify(owner)},name:${JSON.stringify(name)}) { ${fields} } }`]));
-  if (response.errors?.length) throw new Error(response.errors.map((e) => e.message).join("; "));
-  if (!response.data?.repository) throw new Error("merge queue repository read failed");
-  return response.data.repository;
-}
-async function hasPrMergeQueue(repo, base, gh2 = readApi) {
-  const result = await queueGraphql(repo, `mergeQueue(branch:${JSON.stringify(base)}) { id }`, gh2);
-  return result.mergeQueue !== null;
-}
-async function readPrMergeQueue(pr, repo, gh2 = readApi) {
-  if (!/^\d+$/.test(pr)) throw new Error("merge queue read requires a PR number");
-  const result = await queueGraphql(
-    repo,
-    `pullRequest(number:${pr}) { state isInMergeQueue mergeQueueEntry { state position } autoMergeRequest { enabledAt } }`,
-    gh2
-  );
-  if (!result.pullRequest) throw new Error(`merge queue PR #${pr} not found`);
-  return result.pullRequest;
-}
-async function findPrMergeGroupRun(pr, repo, base, gh2 = readApi) {
-  const pages = JSON.parse(await gh2([`repos/${repo}/actions/runs?event=merge_group&per_page=100`, "--paginate", "--slurp"]));
-  const prefix = `gh-readonly-queue/${base}/pr-${pr}-`;
-  const run = pages.flatMap((page) => page.workflow_runs).filter((run2) => run2.head_branch?.startsWith(prefix)).sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id - a.id)[0];
-  return run ? { id: run.id, url: run.html_url, conclusion: run.conclusion } : void 0;
-}
-function prMergeQueueLine(result) {
-  const queue = result.mergeQueue;
-  if (!queue) return void 0;
-  switch (queue.state) {
-    case "queued":
-      return `pr land: PR #${result.pr} queued on ${queue.base}${queue.position === void 0 ? "" : ` (position ${queue.position})`}`;
-    case "merged":
-      return `pr land: PR #${result.pr} merged via merge queue`;
-    case "ejected":
-      return `pr land: PR #${result.pr} ejected from merge queue \u2014 ${queue.ejectedRun ? `merge_group run ${queue.ejectedRun.id} ${queue.ejectedRun.conclusion} ${queue.ejectedRun.url}` : "merge_group run not found"}`;
-    case "timeout":
-      return `pr land: PR #${result.pr} merge queue timeout on ${queue.base}`;
-  }
-}
-
 // src/command-register-collaboration.ts
 init_github_client();
 init_github_quota();
@@ -47351,6 +47397,25 @@ ${list}`);
       return true;
     };
     if (o.wait && !await runWaitGate()) return;
+    if (prMeta.state === "OPEN") {
+      const queueMethod = await readPrMergeQueueMethod(repoForPostCleanup, baseRef);
+      const route = decideQueueMergeRoute(queueMethod, method, headRef);
+      if (route === "refuse") {
+        throw new Error(`pr merge: ${baseRef} in ${repoForPostCleanup} merges through a ${queueMethod} merge queue, which would land ${method} as ${queueMethod}. Use --squash (or pr land); only release-align/ and hotfix-fold/ train PRs true-merge outside the queue (#8304).`);
+      }
+      if (route === "admin-true-merge") {
+        console.warn(`pr merge: ${baseRef} has a ${queueMethod} merge queue \u2014 landing train PR #${number} as a true merge through the ruleset bypass once it is CLEAN (#8296).`);
+        const res = await ghAdminTrueMergeWhenClean(number, repoForPostCleanup);
+        if (res.mergeStatus !== "merged") {
+          console.log(JSON.stringify({ mergeStatus: "not-merged", reason: "admin-true-merge-failed", pr: number, branch: headRef, error: res.error }));
+          console.error(`pr merge: train PR #${number} not merged \u2014 ${res.error}`);
+          process.exitCode = 1;
+          return;
+        }
+        console.log(JSON.stringify({ mergeStatus: "merged", method: "merge", via: "ruleset-bypass", pr: number, branch: headRef }));
+        return;
+      }
+    }
     if (ciPolicy.policy === "no-ci") {
       const guard = decidePrMergeNoCiGuard(await pollGhPrChecks(number, repoArgs), ciPolicy.reason);
       if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
@@ -47825,7 +47890,11 @@ function trainApplyDeps() {
     // #2737: enqueue GitHub auto-merge on the `main -> development` alignment PR the release opens, so the
     // train lands the back-merge itself instead of leaving a manual step. Same enqueue path `pr land` uses,
     // but method `--merge` (NOT squash): the misalignment guard needs the merge parentage to survive.
-    mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--merge"),
+    // #8296: a merge-queue base squashes, so there the train waits for green and true-merges via admin bypass.
+    mergeAuto: async (prNumber, repo) => {
+      const base = (await execFileP("gh", ["pr", "view", prNumber, "--repo", repo, "--json", "baseRefName", "--jq", ".baseRefName"], { timeout: GH_TRAIN_TIMEOUT_MS })).stdout.trim();
+      return base && await hasPrMergeQueue(repo, base) ? ghAdminTrueMergeWhenClean(prNumber, repo) : ghMergeAutoEnqueue(prNumber, repo, "--merge");
+    },
     // Slack release announcement (#883/#6521/#6523): the org alerts channel for the Hub, the project's own
     // registry releaseChannel META for a product repo — best-effort inside announceRelease itself.
     announce: (args) => announceRelease({

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.145",
+  "version": "4.5.147",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.145",
+  "version": "4.5.147",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -48,7 +48,7 @@ env:
 # innocent queued runs — MMC-ZuberShade#880). Pushes group by ref: each tag and the train
 # branch supersede only themselves.
 concurrency:
-  group: gate-${{ github.event.pull_request.number || github.ref }}
+  group: gate-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
   cancel-in-progress: true
 
 permissions:

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -7,7 +7,7 @@ on:
     branches: {{GATE_PUSH_BRANCHES_YAML}}
     tags: ['v*']
 concurrency:
-  group: gate-${{ github.event.pull_request.number || github.ref }}
+  group: gate-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
   cancel-in-progress: true
 permissions:
   actions: read # #8206: exact-SHA development workflow verdict

package/skills/bootstrap/seeds/suite-screens.template.yml

@@ -10,7 +10,7 @@ on:
     tags: ['v*']
 # Cancel superseded runs per PR, or per branch for pushes (MMI-Hub#7515, #3001; as MM-Strategy#415).
 concurrency:
-  group: screens-${{ github.event.pull_request.number || github.ref }}
+  group: screens-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
   cancel-in-progress: true
 permissions:
   contents: read