@mutmutco/claude-plugin 4.5.150 → 4.5.151

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.150",
+  "version": "4.5.151",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -17125,9 +17125,6 @@ function suiteModuleSeeds(seeds, suite, deployModel) {
     "module/.npmrc": "suite-npmrc.template",
     "module/src/module.jsx": "suite-module.template.jsx",
     "module/vite.config.mjs": "suite-vite.template.mjs",
-    "module/screens/screens.json": "suite-screens.template.json",
-    "module/screens/files.json": "suite-files.template.json",
-    ".github/workflows/screens.yml": "suite-screens.template.yml",
     "docs/Guides/mm-work-module.md": "suite-guide.template.md"
   };
   return [
@@ -18669,10 +18666,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.150",
-    tag: "v4.5.150",
-    commit: "4dc71e3761ec",
-    npm: "@mutmutco/cli@4.5.150"
+    version: "4.5.151",
+    tag: "v4.5.151",
+    commit: "c80d8f0f8b26",
+    npm: "@mutmutco/cli@4.5.151"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18689,14 +18686,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.150"
+          v3Target: "v4.5.151"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.150 and redeploy the Hub Lambda from tag v4.5.150 (4dc71e3761ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.150 (@mutmutco/cli@4.5.150, tag commit 4dc71e3761ec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.151 and redeploy the Hub Lambda from tag v4.5.151 (c80d8f0f8b26); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.151 (@mutmutco/cli@4.5.151, tag commit c80d8f0f8b26 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -35655,8 +35652,8 @@ function suiteModulePackageAccessCheck(suite, deployModel) {
   if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
   return {
     ok: true,
-    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
-    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
+    label: "mmwork-ds package access (manual org-admin step; unverified)",
+    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build fails with 403 read_package."
   };
 }
 function attachTrainDoctorVerdicts(report, trainDoctors) {
@@ -40608,6 +40605,7 @@ var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
 var REC = "";
 var FLD = "";
+var GH_SQUASH_COAUTHORS_RE = /\r?\n(?:[ \t]*\r?\n)+---------\r?\n(?:[ \t]*\r?\n)+(?:Co-authored-by:[ \t]+\S[^\r\n]*(?:\r?\n|$))+[ \t\r\n]*$/i;
 var WAIVABLE_KINDS = [
   "mandatory-zone-untested",
   "unrequested-test-file",
@@ -40765,6 +40763,21 @@ function isShallowRepository(cwd) {
     return true;
   }
 }
+function readOverrideTrailer(trailer, body, cwd) {
+  const direct = (trailer ?? "").trim();
+  if (direct) return direct;
+  const raw = body ?? "";
+  const stripped = raw.replace(GH_SQUASH_COAUTHORS_RE, "\n");
+  if (stripped === raw) return "";
+  const prefix = `${TRAILER_KEY.toLowerCase()}:`;
+  return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    windowsHide: true,
+    cwd,
+    input: stripped,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024
+  }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
+}
 function readOverride(base, cwd) {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
   const refusals = [];
@@ -40773,7 +40786,7 @@ function readOverride(base, cwd) {
     const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
     if (!sha) continue;
     if (override) break;
-    const value = (trailer ?? "").trim();
+    const value = readOverrideTrailer(trailer, body, cwd);
     if (!value) {
       const shaped = OVERRIDE_RE.exec(body ?? "");
       if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
@@ -53400,27 +53413,51 @@ var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FR
 var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
+var RUNS_QUERY_VALUE = {
+  per_page: /^(?:[1-9]\d?|100)$/,
+  page: /^[1-9]\d{0,5}$/,
+  status: /^[A-Za-z_]+$/,
+  branch: /^[A-Za-z0-9_.\/-]+$/,
+  event: /^[A-Za-z_]+$/,
+  head_sha: /^[0-9a-fA-F]{40}$/,
+  created: /^[0-9:TZ.<>=-]+$/,
+  actor: /^[A-Za-z0-9_.\[\]-]+$/
+};
+function validRunsQuery(query) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) return false;
+    const key = pair.slice(0, eq);
+    const value = pair.slice(eq + 1);
+    const re = Object.prototype.hasOwnProperty.call(RUNS_QUERY_VALUE, key) ? RUNS_QUERY_VALUE[key] : void 0;
+    if (!re || seen.has(key) || !re.test(value)) return false;
+    seen.add(key);
+  }
+  return true;
+}
+var JSON_MAX_BUFFER = 64 * 1024 * 1024;
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
 var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/attempts/\\d+)?/jobs$`);
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
+  const q = path2.indexOf("?");
+  const base = q === -1 ? path2 : path2.slice(0, q);
+  const query = q === -1 ? "" : path2.slice(q + 1);
   if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
-  if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
+  if (ACTIONS_RUNS_RE.test(base) && (q === -1 || validRunsQuery(query))) return { kind: "actions-runs", path: path2, paginate: false };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
   if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
   if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
   if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
-  const q = path2.indexOf("?");
-  const base = q === -1 ? path2 : path2.slice(0, q);
-  const query = q === -1 ? "" : path2.slice(q + 1);
   if (CONTENTS_BASE_RE.test(base) && (query === "" || CONTENTS_QUERY_RE.test(query))) {
     return { kind: "contents", path: path2, paginate: false };
   }
@@ -53439,7 +53476,7 @@ function buildApiGetArgs(path2, accept) {
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
-var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout;
+var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : { maxBuffer: JSON_MAX_BUFFER }, ...env ? { env } : {} })).stdout;
 async function readAppApi(path2, runner = apiReadRunner) {
   const req = parseApiGetPath(path2);
   requireBrokerApp("read run log");

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.150",
+  "version": "4.5.151",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.150",
+  "version": "4.5.151",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -8,4 +8,4 @@ Before the first CI/deploy, an org admin must grant this repo **Read** on `@mutm
 
 The server exposes `/health` and `/module.js`. Register the module's bundle URL, id, name and capabilities with MM-Work following the GUIDE. The seed deliberately exposes no authenticated product API yet.
 
-`gate` installs and checks the backend and module. `screens / screens` follows MM-PM's non-blocking PR/push/tag shape, using MM-Work's reusable runner with `run: false` (browser audits are not merge gates). Configure scheduled/on-demand screen audits separately when the product has screens to audit.
+`gate` installs and checks the backend and module. Product repos carry no screenshot or browser tests (owner ruling 2026-10-15, MM-Work#5388).

package/skills/bootstrap/seeds/suite-module-package.template.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
-  "description": "MM-Work module screens",
+  "description": "MM-Work module",
   "scripts": {
     "lint": "mmwork-check-ui src",
     "build": "vite build",

package/skills/bootstrap/seeds/suite-files.template.json

@@ -1 +0,0 @@
-{ "result": { "items": [{ "id": "sample", "name": "Sample brief" }] } }

package/skills/bootstrap/seeds/suite-screens.template.json

@@ -1,170 +0,0 @@
-{
-  "module": {
-    "id": "{{REPO_SLUG}}",
-    "name": "{{REPO_NAME}}",
-    "glyph": "grid",
-    "tone": "blue",
-    "description": "Offline module screen check",
-    "sections": [
-      {
-        "label": "Home",
-        "path": "/"
-      },
-      {
-        "label": "Details",
-        "path": "/details"
-      }
-    ],
-    "help": {
-      "home": {
-        "name": "Example home",
-        "howTos": [
-          {
-            "id": "recent",
-            "title": "See recent files",
-            "intro": "The module counts the files you opened lately in Google Drive.",
-            "steps": [
-              {
-                "title": "Connect Drive",
-                "text": "Connect your Google account in Files to see your recent files.",
-                "scene": "connect"
-              },
-              {
-                "title": "Come back here",
-                "text": "The overview shows how many recent files MM-Work found."
-              }
-            ]
-          },
-          {
-            "id": "details",
-            "title": "Open the details page",
-            "steps": [
-              {
-                "title": "Press Open a page inside the module",
-                "text": "It is under the overview. Details is also in the section row.",
-                "scene": "screen"
-              },
-              {
-                "title": "Go back",
-                "text": "Press Home in the section row."
-              }
-            ]
-          }
-        ],
-        "faq": [
-          {
-            "id": "drive",
-            "question": "Where are my files?",
-            "answer": "Recent files come from your connected Google Drive."
-          },
-          {
-            "id": "job",
-            "question": "What is the Review files job?",
-            "answer": "A job your admin can give you. The overview says whether you hold it."
-          },
-          {
-            "id": "access",
-            "question": "Does this module get my Google password?",
-            "answer": "No. It asks MM-Work for your files, and MM-Work uses the access you granted it."
-          }
-        ],
-        "tour": [
-          {
-            "anchor": "example-intro",
-            "title": "What this is",
-            "text": "A module's own screen, drawn with MM-Work's design system."
-          },
-          {
-            "anchor": "example-overview",
-            "title": "Your overview",
-            "text": "See your workspace and recent Drive files here."
-          },
-          {
-            "anchor": "example-actions",
-            "title": "Where to go next",
-            "text": "Open the details page, or go to Files."
-          }
-        ]
-      }
-    },
-    "privacy": [
-      {
-        "class": "company-visible",
-        "what": {
-          "en": "The example reads recent Google Drive file metadata through MM-Work after the person connects Files.",
-          "tr": "Örnek modül, kişi Files bağlantısını kurduktan sonra MM-Work üzerinden son Google Drive dosyalarının meta verilerini okur."
-        },
-        "who": {
-          "en": "The signed-in person sees the count on this example screen; no file content is saved by the example.",
-          "tr": "Oturum açmış kişi örnek ekranda sayıyı görür; örnek modül dosya içeriğini kaydetmez."
-        },
-        "evidence": [
-          "repo:MM-Work:examples/example-module/src/module.jsx"
-        ]
-      }
-    ]
-  },
-  "screens": [
-    {
-      "name": "home",
-      "path": "/m/example",
-      "jobs": [
-        "files.review"
-      ],
-      "routes": {
-        "POST /api/actions/files.list": "files.json"
-      }
-    },
-    {
-      "name": "open details journey",
-      "path": "/m/example",
-      "steps": [
-        {
-          "assert": {
-            "selector": "[data-tour=example-actions] button",
-            "count": 2
-          }
-        },
-        {
-          "click": "[data-tour=example-actions] button:first-child"
-        },
-        {
-          "assert": {
-            "url": "/m/example/details"
-          }
-        }
-      ],
-      "routes": {
-        "POST /api/actions/files.list": "files.json"
-      }
-    },
-    {
-      "name": "details",
-      "path": "/m/example/details",
-      "routes": {
-        "POST /api/actions/files.list": "files.json"
-      }
-    },
-    {
-      "name": "loading",
-      "path": "/m/example",
-      "query": "state=loading",
-      "routes": {
-        "POST /api/actions/files.list": "pending"
-      }
-    },
-    {
-      "name": "error",
-      "path": "/m/example",
-      "query": "state=error",
-      "routes": {
-        "POST /api/actions/files.list": {
-          "status": 500,
-          "body": {
-            "error": "offline failure"
-          }
-        }
-      }
-    }
-  ]
-}

package/skills/bootstrap/seeds/suite-screens.template.yml

@@ -1,63 +0,0 @@
-name: screens
-# A required check (#250): it runs wherever gate runs, so no PR into development, rc or main and no train tag
-# waits on a context that never reports.
-on:
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  push:
-    branches: {{GATE_PUSH_BRANCHES_YAML}}
-    tags: ['v*']
-# Cancel superseded runs per PR, or per branch for pushes (MMI-Hub#7515, #3001; as MM-Strategy#415).
-concurrency:
-  group: screens-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-  packages: read
-  pull-requests: read
-jobs:
-  # Owner ruling (#474, 6 Oct 2026): browser checks block nothing, releases included. Every PR, push and tag
-  # reports this required context without a browser audit (run: false); screens-sweep.yml audits nightly and
-  # on demand (issue-on-red). A development push still reports
-  # the required "screens / screens" on the SHA, which the dev deploy needs (MMI-Hub dev-auto-deploy).
-  changes:
-    runs-on: [self-hosted, linux, x64, mmi-live]
-    outputs:
-      run: ${{ steps.pick.outputs.run }}
-      full: ${{ steps.pick.outputs.full }}
-    steps:
-      - id: pick
-        env:
-          GH_TOKEN: ${{ github.token }}
-          EVENT: ${{ github.event_name }}
-          BASE: ${{ github.base_ref }}
-          REF: ${{ github.ref_name }}
-          REF_TYPE: ${{ github.ref_type }}
-          PR: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          # #474: no browser audit on any PR, push or tag; screens-sweep.yml runs it nightly.
-          run=false; full=false
-          echo "run=$run full=$full"
-          { echo "run=$run"; echo "full=$full"; } >> "$GITHUB_OUTPUT"
-  screens:
-    needs: changes
-    # Fail closed (MMI-Hub, 6 Oct): a SKIPPED required check counts as passing, so this job runs even when
-    # `changes` failed, and a missing answer means the full audit, never a skip.
-    if: ${{ !cancelled() }}
-    uses: mutmutco/MM-Work/.github/workflows/module-screens.yml@development
-    with:
-      run: ${{ needs.changes.outputs.run != 'false' }}
-      audit-sizes: ${{ needs.changes.outputs.full != 'false' && '["phone","768","1024","1280"]' || '["phone"]' }}
-      # Pinned to the shell built from the kit this module ships (ds-v0.71.42): the runner MM-Work
-      # published with that kit; bump with the kit.
-      # 0.1.55+ checks MM-Work #1575: selectedStyle, pageBackground, noJump (#418).
-      screens-version: '0.1.113'
-      working-directory: 'module'
-      build-command: 'npm run build'
-      bundle-path: 'dist/module.js'
-      fixtures-path: 'screens/screens.json'
-      # Every screen in English and Turkish (#369): Turkish words run longer, so they get their own audit.
-      languages: 'en,tr'