@mutmutco/claude-plugin 4.6.35 → 4.6.36

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.6.35",
+  "version": "4.6.36",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -15366,13 +15366,6 @@ async function fetchHubBoardSnapshot(request, deps) {
 // src/board-read.ts
 init_github_quota();
 
-// src/claim-marker-client.ts
-init_github_client();
-init_github_quota();
-
-// src/pr-checks-rest.ts
-init_cli_shared();
-
 // ../shared/github-quota-scope.ts
 var import_node_crypto4 = require("node:crypto");
 function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
@@ -15737,6 +15730,13 @@ async function activateAppActor(commandPath4, env, mint, note = (line) => proces
   return "app";
 }
 
+// src/claim-marker-client.ts
+init_github_client();
+init_github_quota();
+
+// src/pr-checks-rest.ts
+init_cli_shared();
+
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
   if (input.registryCi === "none") {
@@ -17174,9 +17174,11 @@ async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
 // src/claim-marker-client.ts
 var claimWriteTokenProvider;
 var claimWriteTokenOnce;
+var notedPersonalClaimWrite = false;
 function setClaimWriteTokenProvider(provider) {
   claimWriteTokenProvider = provider;
   claimWriteTokenOnce = void 0;
+  notedPersonalClaimWrite = false;
 }
 async function selectClaimWriteClient(client, appClient) {
   if (appClient) return appClient;
@@ -17187,15 +17189,26 @@ async function selectClaimWriteClient(client, appClient) {
     token = await claimWriteTokenOnce;
   } catch (e) {
     claimWriteTokenOnce = void 0;
+    if (e instanceof AppActorError && e.code === "vault-denied" && process.env.MMI_ACTOR?.trim() !== "app") return personalClaimWrite(client);
     const detail = e instanceof Error ? e.message : String(e);
     throw new Error(`${detail} \u2014 refusing personal-token fallback for claim write (#9511)`);
   }
   if (!token) {
     claimWriteTokenOnce = void 0;
-    throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+    if (process.env.MMI_ACTOR?.trim() === "app") {
+      throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+    }
+    return personalClaimWrite(client);
   }
   return createGitHubClient({ token: async () => token });
 }
+function personalClaimWrite(client) {
+  if (!notedPersonalClaimWrite) {
+    notedPersonalClaimWrite = true;
+    process.stderr.write("note: no App route on this host (no MMI-Hub vault access) \u2014 claim writes go as your own GitHub login\n");
+  }
+  return client;
+}
 async function selectLivenessClient(client, appClient) {
   if (appClient) return appClient;
   let token;
@@ -22745,6 +22758,7 @@ mutation($projectId: ID!, $itemId: ID!) {
     item { id }
   }
 }`;
+var BOARD_WRITE_REFUSAL_TYPES = /* @__PURE__ */ new Set(["INSUFFICIENT_SCOPES", "FORBIDDEN", "NOT_FOUND"]);
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
   if (process.env.MMI_ACTOR?.trim() === "app") {
     const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
@@ -22771,10 +22785,14 @@ async function updateItemSingleSelect(client, projectId, itemId, fieldId, option
     return { credential: "user" };
   } catch (error) {
     const errors = error.graphqlErrors;
-    if (errors?.length && errors.every((entry) => entry.type === "INSUFFICIENT_SCOPES")) {
+    if (errors?.length && errors.every((entry) => entry.type !== void 0 && BOARD_WRITE_REFUSAL_TYPES.has(entry.type))) {
       const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
-      await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
-      return { credential: "app_installation" };
+      try {
+        await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+        return { credential: "app_installation" };
+      } catch {
+        throw error;
+      }
     }
     if (isGitHubRateLimitError(error)) {
       const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
@@ -28367,10 +28385,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.35",
-    tag: "v4.6.35",
-    commit: "2a54cf011975",
-    npm: "@mutmutco/cli@4.6.35"
+    version: "4.6.36",
+    tag: "v4.6.36",
+    commit: "d1c15e58d6e5",
+    npm: "@mutmutco/cli@4.6.36"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28387,14 +28405,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.35"
+          v3Target: "v4.6.36"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.35 and redeploy the Hub Lambda from tag v4.6.35 (2a54cf011975); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.35 (@mutmutco/cli@4.6.35, tag commit 2a54cf011975 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.36 and redeploy the Hub Lambda from tag v4.6.36 (d1c15e58d6e5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.36 (@mutmutco/cli@4.6.36, tag commit d1c15e58d6e5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -46149,6 +46167,15 @@ async function attachOnIntegrationRefusal(detail, cfg, contentNodeId, attach = a
     return { warning: `board attach refused: the gh login is an App installation token without Projects access (${detail}) and the Hub App leg failed (${e.message}). If the Hub reports the same refusal, ${PROJECTS_PERMISSION_HINT}` };
   }
 }
+var ATTACH_AUTHORITY_REFUSAL = /FORBIDDEN|NOT_FOUND|Resource not accessible|missing required scopes|insufficient (?:permissions?|scope)|Could not resolve to a node|does not have (?:access|permission)/i;
+async function attachOnAuthorityRefusal(detail, cfg, contentNodeId, attach = attachViaHubApp) {
+  if (!ATTACH_AUTHORITY_REFUSAL.test(detail)) return void 0;
+  try {
+    return { projectItemId: await attach(cfg, contentNodeId) };
+  } catch (e) {
+    return { warning: `${detail}; the Hub attach also refused (${e.message}) \u2014 attach needs org-owner, repo-admin or repository write authority on the board's repository` };
+  }
+}
 async function issueNodeIdForAttach(repo, number, ghView, client) {
   try {
     return (await ghView()).trim();
@@ -63338,6 +63365,24 @@ async function attachToProject(issueNumber, repo, priority) {
       }
       return boardAttachRateLimitedReceipt(resetEpochSeconds);
     }
+    const authority = contentId ? await attachOnAuthorityRefusal(detail, cfg, contentId) : void 0;
+    if (authority && "projectItemId" in authority) {
+      if (priority) {
+        try {
+          await setBoardItemPriority(defaultGitHubClient(), cfg, authority.projectItemId, priority);
+        } catch (pe) {
+          const perr = pe;
+          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(perr.stderr || perr.message || String(pe)).trim()}
+`);
+        }
+      }
+      return { projectItemId: authority.projectItemId, onBoard: true, credential: "app_installation" };
+    }
+    if (authority) {
+      process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${authority.warning}
+`);
+      return { onBoard: false };
+    }
     process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${detail}
 `);
     return { onBoard: false };
@@ -73948,7 +73993,16 @@ setGhWriteTokenProvider(() => {
     throw e;
   });
 });
-setClaimWriteTokenProvider(() => mintFilingWriteToken(appActorDeps()).then((t) => t.token));
+var claimWriteToken;
+setClaimWriteTokenProvider(() => {
+  if (process.env.MMI_ACTOR?.trim() === "app") {
+    return mintFilingWriteToken(appActorDeps()).then((t) => t.token);
+  }
+  return claimWriteToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, (e) => {
+    if (e instanceof AppActorError && e.code === "vault-denied") return void 0;
+    throw e;
+  });
+});
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.35",
+  "version": "4.6.36",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.6.35",
+  "version": "4.6.36",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/readme-mmi-developer-environment.block.md

@@ -2,4 +2,7 @@
 ## MMI developer environment
 
 Use the [canonical MMI developer-environment guide](https://github.com/mutmutco/MMI-Hub/blob/main/docs/Architecture/agentic-dev-environment.md) for shared setup and daily agent work.
+
+Daily loop: `mmi-cli oracle issue create` → `mmi-cli oracle board claim <n>` (stamps the mmi-claim lease) → `mmi-cli devops pr create` → `mmi-cli devops pr land <pr>`.
+Any org member with repository write (developer) or repository admin (project admin) can run it, with no vault access; release trains stay org-owner only.
 <!-- mmi-developer-environment:end -->

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -6,5 +6,9 @@
   "scripts/next-version.mjs": {
     "blob": "2c1985b59edc779695479559074e7654c1574a11",
     "reason": "comment-only note that rc/release modes are unused in dev-only MM suite repos (#8282), no runtime or operator behaviour change"
+  },
+  "README.md": {
+    "blob": "768c5e35cdb48849c77bce6b334658adefe6a5d8",
+    "reason": "the developer-environment seed block now states the concrete mmi-cli loop (issue create, board claim, PR create, PR land) and who may run it — the README propagation is intended (#9987); no runbook step changes"
   }
 }

package/skills/org-guide/references/work-and-releases.md

@@ -13,6 +13,23 @@ our self-hosted runners, dispatched by an org owner, never on a workstation (#91
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is
 not a denial: wait for the reset time it names, then retry.
 
+## Developer and project-admin access
+
+A developer is an org member with GitHub write on a product repository. A project admin is that
+repository's admin. Both run the full loop with mmi-cli and need no MMI-Hub vault access:
+
+```sh
+mmi-cli oracle issue create --title "<title>" --body-file <path>   # files and attaches the board card
+mmi-cli oracle board claim <n>                                     # stamps the mmi-claim lease
+mmi-cli devops pr create --title "<title>" --base development
+mmi-cli devops pr land <pr-number>
+```
+
+Board writes (attach, claim stamp, status move) gate on org owner, repo admin or repository write, so
+these roles pass. Where the GitHub App route is absent the writes go as the person's own GitHub login
+(one note says so); an agent host with the App route writes as the App. MMI-Hub's own merges and all
+release trains stay org-owner only.
+
 Start with `mmi-cli onboard` and the [board skill](../../board/SKILL.md).
 Reading or discussing the board is read-only until the developer authorizes work.
 Claim approved work with `mmi-cli oracle board claim <issue>`, then prepare an isolated task