@mutmutco/claude-plugin 4.5.152 → 4.5.154

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.152",
+  "version": "4.5.154",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -7081,6 +7081,12 @@ var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "read run watch",
   "read run log",
   // #8136: bounded jobs/logs REST read, same polling credential.
+  "read pr list",
+  // #8347: stored-field PR list; author/viewer-dependent filters refused.
+  "read pr diff",
+  // #8347: fixed PR diff read; no viewer fields.
+  "read pr queue",
+  // #8347: fixed mergeQueueEntry query; no generic GraphQL or viewer resolution.
   "read pr view",
   "read pr checks",
   "read issue view",
@@ -7157,6 +7163,27 @@ async function readAppVaultSecret(read) {
   }
 }
 async function mintInstallationToken(deps) {
+  return mintScopedInstallationToken(deps, APP_POLL_PERMISSIONS);
+}
+async function mintStatusWriteToken(deps) {
+  return mintScopedInstallationToken(deps, { metadata: "read", statuses: "write" });
+}
+var statusWriteTokenProvider;
+function setStatusWriteTokenProvider(provider) {
+  statusWriteTokenProvider = provider;
+}
+async function fleetStatusWriteEnv(args) {
+  if (args[0] !== "api" || args[1] !== "-X" || args[2] !== "POST" || !/^repos\/[^/]+\/[^/]+\/statuses\/[^/]+$/.test(args[3] ?? "") || !args.some((arg, i) => arg === "context=fleet-lockstep" && args[i - 1] === "-f")) return void 0;
+  if (!statusWriteTokenProvider) throw new AppActorError("app actor: status-write provider not installed");
+  try {
+    const { token } = await statusWriteTokenProvider();
+    return { ...process.env, GH_TOKEN: token };
+  } catch (e) {
+    if (e instanceof AppActorError && e.code === "vault-denied") return void 0;
+    throw e;
+  }
+}
+async function mintScopedInstallationToken(deps, permissions) {
   const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
     const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
@@ -7183,7 +7210,7 @@ async function mintInstallationToken(deps) {
         "content-type": "application/json",
         "user-agent": "mmi-cli-app-actor"
       },
-      body: JSON.stringify({ permissions: APP_POLL_PERMISSIONS })
+      body: JSON.stringify({ permissions })
     });
   } catch (e) {
     if (e instanceof AppActorError) throw e;
@@ -16415,6 +16442,33 @@ function defaultTrackedFirstSegments(root, firstSegments, exec3 = import_node_ch
     throw error;
   }
 }
+function mergeGroupRunbookMessages(root, deps, readFile10, warnings) {
+  const env = deps.env ?? process.env;
+  if (env.GITHUB_EVENT_NAME !== "merge_group") return "";
+  let source = "merge_group event payload";
+  try {
+    const event = JSON.parse(readFile10(env.GITHUB_EVENT_PATH ?? "") ?? "");
+    const match = /^refs\/heads\/gh-readonly-queue\/.+\/pr-([1-9]\d*)-[a-f0-9]+$/.exec(event.merge_group?.head_ref ?? "");
+    const repo = env.GITHUB_REPOSITORY;
+    if (!match || !repo || !/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error("invalid queue source");
+    source = `repos/${repo}/pulls/${match[1]}/commits`;
+    const gh2 = deps.gh ?? ((args) => (0, import_node_child_process6.execFileSync)("gh", args, {
+      cwd: root,
+      encoding: "utf8",
+      windowsHide: true,
+      timeout: 3e4,
+      maxBuffer: CHECK_IGNORE_MAX_BUFFER,
+      env: { ...env, GH_TOKEN: env.GH_TOKEN || env.GITHUB_TOKEN },
+      stdio: ["ignore", "pipe", "pipe"]
+    }));
+    const pages = JSON.parse(gh2(["api", source, "--paginate", "--slurp"]));
+    if (!Array.isArray(pages) || !pages.every((page) => Array.isArray(page) && page.every((commit) => typeof commit?.commit?.message === "string"))) throw new Error("invalid commit response");
+    return pages.flat().map((commit) => commit.commit.message).join("\n");
+  } catch {
+    warnings.push({ kind: "runbook-source-unverified", doc: source, line: 0, detail: `failed to read ${source}; using git-log Runbook-Unaffected declarations only` });
+    return "";
+  }
+}
 function runDocRefs(root, deps = {}) {
   const readFile10 = deps.readFile ?? readFileOrNull;
   const exists = deps.exists ?? import_node_fs17.existsSync;
@@ -16451,7 +16505,10 @@ function runDocRefs(root, deps = {}) {
   if (deps.base) {
     const git3 = deps.git ?? ((args) => (0, import_node_child_process6.execFileSync)("git", args, { cwd: root, encoding: "utf8", maxBuffer: CHECK_IGNORE_MAX_BUFFER, windowsHide: true }));
     const stale = checkRunbookCoverage(runbooks, deps.base, git3);
-    const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(git3(["log", "--format=%B", `${deps.base}..HEAD`]));
+    const messages = git3(["log", "--format=%B", `${deps.base}..HEAD`]);
+    const sourceMessages = stale.length ? mergeGroupRunbookMessages(root, deps, readFile10, warnings) : "";
+    const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(`${messages}
+${sourceMessages}`);
     (override ? warnings : findings).push(...stale);
   }
   return {
@@ -18684,10 +18741,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.152",
-    tag: "v4.5.152",
-    commit: "8437cd11d3f1",
-    npm: "@mutmutco/cli@4.5.152"
+    version: "4.5.154",
+    tag: "v4.5.154",
+    commit: "045e47363357",
+    npm: "@mutmutco/cli@4.5.154"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18704,14 +18761,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.152"
+          v3Target: "v4.5.154"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.152 and redeploy the Hub Lambda from tag v4.5.152 (8437cd11d3f1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.152 (@mutmutco/cli@4.5.152, tag commit 8437cd11d3f1 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.154 and redeploy the Hub Lambda from tag v4.5.154 (045e47363357); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.154 (@mutmutco/cli@4.5.154, tag commit 045e47363357 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19646,9 +19703,12 @@ async function resolveBoardProjectId(repoOption) {
     return void 0;
   }
 }
-function queryDeps() {
+function queryDeps(readEnv) {
   return {
-    ghJson: async (args, timeoutMs = GH_LIST_TIMEOUT_MS) => JSON.parse((await execFileP("gh", args, { timeout: timeoutMs })).stdout),
+    ghJson: async (args, timeoutMs = GH_LIST_TIMEOUT_MS) => {
+      const env = await readEnv?.();
+      return JSON.parse((await execFileP("gh", args, { timeout: timeoutMs, ...env ? { env } : {} })).stdout);
+    },
     viewer: () => githubLogin(),
     resolveRepo
   };
@@ -20034,7 +20094,8 @@ function defaultFleetTrackInventoryDeps(consistent = false) {
       if (!projects) throw new Error("live Hub registry roster is unavailable \u2014 a committed inventory is never current truth, so there is no fallback; retry when the Hub API is reachable");
       return projects;
     },
-    query: queryDeps(),
+    // #8350: gate inventory probes bypass the train runner, so supply its App read env here too.
+    query: queryDeps(ghReadEnv),
     now: () => /* @__PURE__ */ new Date()
   };
 }
@@ -48150,7 +48211,7 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      const readEnv = file === "gh" && isAppRoutableGhReadArgs(args) ? await ghReadEnv() : void 0;
+      const readEnv = file !== "gh" ? void 0 : isAppRoutableGhReadArgs(args) ? await ghReadEnv() : await fleetStatusWriteEnv(args);
       try {
         return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...readEnv ? { env: readEnv } : {} })).stdout;
       } catch (e) {
@@ -53140,6 +53201,46 @@ function parseBrokerAssignee(raw) {
   return v;
 }
 var SINGLE_SHOT_TIMEOUT_MS = 6e4;
+var BROKER_MAX_BUFFER = 64 * 1024 * 1024;
+var PR_QUEUE_QUERY = "query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){mergeQueueEntry{state position enqueuedAt estimatedTimeToMerge headCommit{oid}}}}}";
+function buildPrQueueSpec(number, o) {
+  const repo = parseBrokerRepo(o.repo, "--repo");
+  if (!repo) throw new Error("read pr queue: --repo is required");
+  const [owner, name] = repo.split("/");
+  return { program: "gh", args: ["api", "graphql", "-f", `query=${PR_QUEUE_QUERY}`, "-f", `owner=${owner}`, "-f", `name=${name}`, "-F", `number=${parseBrokerId(number, "PR number")}`], timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function buildPrDiffSpec(number, o) {
+  const args = withRepo(["pr", "diff", parseBrokerId(number, "PR number")], parseBrokerRepo(o.repo, "--repo"));
+  if (o.nameOnly) args.push("--name-only");
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function parseBrokerPrSearch(raw) {
+  const search = parseBrokerSearch(raw);
+  if (search && /@me/i.test(search)) throw new Error("read: --search resolves the viewer \u2014 viewer-scoped reads stay personal");
+  return search;
+}
+function parseBrokerPrState(raw) {
+  if (raw === void 0) return void 0;
+  if (!["open", "closed", "merged", "all"].includes(raw)) throw new Error("read: --state must be one of: open, closed, merged, all");
+  return raw;
+}
+function buildPrListSpec(o) {
+  const args = withJson(withRepo(["pr", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  const state = parseBrokerPrState(o.state);
+  if (state) args.push("--state", state);
+  for (const flag of ["base", "head"]) {
+    const branch = parseBrokerBranch(o[flag]);
+    if (branch) args.push(`--${flag}`, branch);
+  }
+  const label = parseBrokerLabel(o.label);
+  if (label !== void 0) args.push("--label", label);
+  const search = parseBrokerPrSearch(o.search);
+  if (search !== void 0) args.push("--search", search);
+  const assignee = parseBrokerAssignee(o.assignee);
+  if (assignee) args.push("--assignee", assignee);
+  if (o.limit !== void 0) args.push("--limit", String(parseBrokerInt(o.limit, "--limit", 1, 100)));
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
 function withRepo(args, repo) {
   return repo ? [...args, "--repo", repo] : args;
 }
@@ -53332,7 +53433,7 @@ async function dispatchRestChecksRead(deps, resolveRepo2, label, spec, json) {
   process.exitCode = result.exitCode;
 }
 function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
-  const ghRun = overrides?.ghRunner ?? (async (args, opts) => (await execFileP("gh", args, { timeout: opts.timeoutMs, env: opts.env })).stdout);
+  const ghRun = overrides?.ghRunner ?? (async (args, opts) => (await execFileP("gh", args, { timeout: opts.timeoutMs, env: opts.env, maxBuffer: BROKER_MAX_BUFFER })).stdout);
   const restGhApi = overrides?.restGhApi ?? ((env) => ghApiWithEnv(env));
   const deps = { readRequired: readRequiredCheckRows, fetchSnapshot: fetchRestPrSnapshot, fetchRows: fetchHeadCheckRows, restGhApi };
   const dispatchGh = (spec, label) => (async () => {
@@ -53385,7 +53486,28 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     }
     await dispatchGh(spec, "read run watch");
   });
-  const pr = read.command("pr").description("pull-request reads \u2014 view rides gh; checks is REST-backed (deterministic closed-custody adapter; native was EMPTY only on the historical #3035 fixture)");
+  const pr = read.command("pr").description("pull-request reads \u2014 view/list/diff ride gh; queue uses fixed GraphQL; checks is REST-backed (deterministic closed-custody adapter; native was EMPTY only on the historical #3035 fixture)");
+  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").requiredOption("--repo <owner/repo>", "target repo", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
+    await dispatchGh(buildPrListSpec(o), "read pr list");
+  });
+  pr.command("diff").description("read a bounded PR diff on the App pool").requiredOption("--repo <owner/repo>", "target repo", repoOpt).option("--name-only", "only changed file names").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    await dispatchGh(buildPrDiffSpec(number, o), "read pr diff");
+  });
+  pr.command("queue").description("read one PR mergeQueueEntry (fixed GraphQL query, no permission widening)").requiredOption("--repo <owner/repo>", "target repo", repoOpt).option("--json", "machine-readable mergeQueueEntry (null when not queued)").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    const spec = buildPrQueueSpec(number, o);
+    requireBrokerApp("read pr queue");
+    try {
+      process.exitCode = await runBrokerGh(async (args, opts) => {
+        const result = JSON.parse(await ghRun(args, opts));
+        if (result.errors?.length) throw new Error(JSON.stringify(result.errors));
+        const pr2 = result.data?.repository?.pullRequest;
+        if (!pr2) throw new Error("PR not found or not accessible on the App pool");
+        return JSON.stringify(pr2.mergeQueueEntry) + "\n";
+      }, spec);
+    } catch (e) {
+      return fail(`read pr queue: ${e.message}`);
+    }
+  });
   pr.command("view").description("read a PR as gh JSON (comments/json; --json supports statusCheckRollup selection; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--comments", "include PR comments").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
     let spec;
     try {
@@ -53456,14 +53578,14 @@ var RUNS_QUERY_VALUE = {
   created: /^[0-9:TZ.<>=-]+$/,
   actor: /^[A-Za-z0-9_.\[\]-]+$/
 };
-function validRunsQuery(query) {
+function validRunsQuery(query, allowed = RUNS_QUERY_VALUE) {
   const seen = /* @__PURE__ */ new Set();
   for (const pair of query.split("&")) {
     const eq = pair.indexOf("=");
     if (eq < 1) return false;
     const key = pair.slice(0, eq);
     const value = pair.slice(eq + 1);
-    const re = Object.prototype.hasOwnProperty.call(RUNS_QUERY_VALUE, key) ? RUNS_QUERY_VALUE[key] : void 0;
+    const re = Object.prototype.hasOwnProperty.call(allowed, key) ? allowed[key] : void 0;
     if (!re || seen.has(key) || !re.test(value)) return false;
     seen.add(key);
   }
@@ -53475,10 +53597,12 @@ var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/at
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
+var RELEASE_LIST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases$`);
+var RELEASE_LIST_QUERY_VALUE = { per_page: RUNS_QUERY_VALUE.per_page, page: RUNS_QUERY_VALUE.page };
 var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
 var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
 var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
@@ -53494,6 +53618,7 @@ function parseApiGetPath(rawPath) {
   if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
   if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
   if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
+  if (RELEASE_LIST_RE.test(base) && (q === -1 || validRunsQuery(query, RELEASE_LIST_QUERY_VALUE))) return { kind: "release-list", path: path2, paginate: false };
   if (RELEASE_LATEST_RE.test(path2)) return { kind: "release-latest", path: path2, paginate: false };
   const tag = RELEASE_TAG_RE.exec(path2)?.[1];
   if (tag && !tag.includes("..")) return { kind: "release-tag", path: path2, paginate: false };
@@ -56651,6 +56776,7 @@ function appActorDeps() {
   };
 }
 setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appActorDeps()));
+setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
   const commandPath3 = commandPathOf(actionCommand);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.152",
+  "version": "4.5.154",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.152",
+  "version": "4.5.154",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -54,6 +54,7 @@ concurrency:
 permissions:
   actions: read # #8206: exact-SHA development workflow verdict
   contents: read
+  pull-requests: read # #8343: source commit declarations omitted by queue squashes
   # MMI-Hub#7542: the product image build below reads org private packages with the workflow's
   # own ephemeral token (NODE_AUTH_TOKEN) — the same reader the central deploy uses.
   packages: read

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -12,6 +12,7 @@ concurrency:
 permissions:
   actions: read # #8206: exact-SHA development workflow verdict
   contents: read
+  pull-requests: read # #8343: source commit declarations omitted by queue squashes
   packages: read
 jobs:
   gate: