fix(cli): mops outdated exit codes, and report GitHub deps

[Kamirus]

mops outdated exited 0 whether or not anything was outdated, so it could not gate CI. pnpm outdated exits 1; cargo outdated has --exit-code.

$ mops outdated
base 0.14.5 -> 0.14.14
Before: $? = 0
After:  $? = 1

Exit codes are now 0 up to date, 1 updates available, 2 the check could not be completed — missing mops.toml, unknown [pkg], or a registry/GitHub lookup failure. 2 wins when both apply, because a partial report must never read as a clean bill of health, and a failed lookup must never read as "outdated". 1 for "found something" and 2 for "failed to look" follows the grep/diff convention and matches npm outdated.

The exit code was only half the problem

getAvailableUpdates filtered to dependencies with a truthy version, which silently excludes GitHub (repo) dependencies — but mops update does update them, by re-resolving the branch head and rewriting the pin. So the two commands disagreed about what "outdated" means:

# mops.toml:  mydep = "https://github.com/org/repo#master@1111111"
#             (branch has since moved to 06d7c77)

$ mops outdated
Before: All dependencies are up to date!     # then `mops update` rewrites the pin
After:  mydep 1111111 -> 06d7c77 (github: org/repo#master)

That's the defect that made the exit code useless: a green mops outdated didn't mean a subsequent mops update would be a no-op. Both commands now apply the same rule — same helper shape, same [pkg] filter, same "sha differs from branch head" comparison — so they can't drift apart again.

A GitHub lookup that fails (rate limit, network) reports per-dependency and exits 2. It never degrades to a silent "up to date".

Cost

One GitHub API call per repo dependency, and most projects have none. They're issued concurrently, unlike mops update's serial loop. Against that, the registry round trip is now skipped entirely when a project has no registry dependencies, so a GitHub-only project makes strictly fewer calls than before.

No auth-token support and no --no-github escape hatch: neither npm nor cargo has an analogue, and inventing one before anyone hits the unauthenticated 60 req/h limit seemed premature.

What is unchanged

mops update's behaviour is byte-for-byte identical. getAvailableUpdates gained a fourth optional argument for opting into throwing instead of process.exit(1), and only outdated passes it, so update keeps its existing print-and-exit path.

getHighestSemverBatch's assert(list.size() < 100) is untouched and unaffected — repo deps were never in that batch, and passing [pkg] only shrinks it. It remains a live trap for projects with 100+ direct dependencies, tracked as item 26 in #723.

Follow-up worth flagging

mops update <not-installed-pkg> still exits 0 while mops outdated <not-installed-pkg> now exits 2. Worth aligning update to 2. And mops update still has its own inline GitHub resolution loop that duplicates the rule this PR extracted into a helper — a clean refactor now that the helper exists, but out of scope here since it would put update.ts in the diff.

Part of the GA follow-up work from the Cargo/pnpm audit (#723, item 17), which the triage there marks as pre-GA because exit codes are a contract.

🤖 Generated with Claude Code

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

Verified GitHub outdated logic against update.ts’s loop (parseGithubURL + getGithubCommit + sha compare), confirmed throwOnError leaves update on process.exit(1), and checked docs/changelog/skill/--help stay aligned.

Category	Assessment	Details
Summary	✅	Makes mops outdated a real CI gate (exit 0/1/2) and reports GitHub deps with the same branch-head rule as mops update, plus optional [pkg].
Code Quality	✅	Reuses getGithubCommit/parseGithubURL; GitHub filter mirrors update.ts lines 39–44; throwOnError is opt-in so update’s exit path is unchanged.
Consistency	✅	outdated [pkg] matches update [pkg]; --help, docs/docs/cli/1-deps/03-mops-outdated.md, cli/CHANGELOG.md ## Next, and .agents/skills/mops-cli/SKILL.md updated together.
Security	✅	No auth/integrity changes; GitHub calls are the same unauthenticated API already used by update.ts / getGithubCommit in cli/mops.ts.
Tests	✅	New cli/tests/outdated.test.ts covers exit 0/1/2, registry skip, GitHub move/up-to-date/unpinned/failure (incl. 2 over 1), and [pkg] filtering via targeted assertions.
Maintainability	✅	Shared getAvailableGithubUpdates prevents outdated/update drift; remaining inline loop in update.ts is explicitly deferred and not a defect here.

Verdict

Decision: APPROVE
Risk: Low
Reason: Contained, well-tested CLI contract fix outside registry/install/auth paths; exit-code and GitHub-reporting changes are intentional, documented, and aligned with mops update and npm/pnpm conventions.

---

Generated for commit 2f45573

[automation-sa-sre]

Automated approval: the AI review verdict for 2f45573 is APPROVE. See the "Cursor AI review" comment for details.