@mutmutco/cli 4.1.18 → 4.1.19

package/dist/main.cjs

@@ -13181,10 +13181,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.1.18",
-    tag: "v4.1.18",
-    commit: "6a8f41433f0f",
-    npm: "@mutmutco/cli@4.1.18"
+    version: "4.1.19",
+    tag: "v4.1.19",
+    commit: "fd396828846f",
+    npm: "@mutmutco/cli@4.1.19"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -13201,14 +13201,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.1.18"
+          v3Target: "v4.1.19"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.1.18 and redeploy the Hub Lambda from tag v4.1.18 (6a8f41433f0f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.1.18 (@mutmutco/cli@4.1.18, tag commit 6a8f41433f0f \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.1.19 and redeploy the Hub Lambda from tag v4.1.19 (fd396828846f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.1.19 (@mutmutco/cli@4.1.19, tag commit fd396828846f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -27035,12 +27035,10 @@ async function remoteHead(repo, token) {
         "credential.helper=",
         // #5750: actions/checkout persists its token as a URL-scoped extraheader in the checked-out
         // repo's .git/config — repo-local config that env sanitization cannot reach. Run from a
-        // neutral cwd so no repo config applies, and blank both extraheader scopes so the ONLY
-        // credential is the app token below. Credential values are never copied or logged.
-        "-c",
-        "http.extraheader=",
-        "-c",
-        "http.https://github.com/.extraheader=",
+        // neutral cwd so no repo config applies; the ONLY credential is the app token below.
+        // Do NOT blank extraheader scopes here: an empty URL-scoped extraheader emits an empty
+        // Authorization header that overrides the token entirely (16/16 unreadable on the runner,
+        // repo-index-reconcile run 33121106605).
         "-c",
         `http.extraHeader=Authorization: Basic ${basic}`,
         "ls-remote",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.1.18",
+  "version": "4.1.19",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",