@mutmutco/cli 4.5.150 → 4.5.151

package/dist/main.cjs

@@ -17125,9 +17125,6 @@ function suiteModuleSeeds(seeds, suite, deployModel) {
     "module/.npmrc": "suite-npmrc.template",
     "module/src/module.jsx": "suite-module.template.jsx",
     "module/vite.config.mjs": "suite-vite.template.mjs",
-    "module/screens/screens.json": "suite-screens.template.json",
-    "module/screens/files.json": "suite-files.template.json",
-    ".github/workflows/screens.yml": "suite-screens.template.yml",
     "docs/Guides/mm-work-module.md": "suite-guide.template.md"
   };
   return [
@@ -18669,10 +18666,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.150",
-    tag: "v4.5.150",
-    commit: "4dc71e3761ec",
-    npm: "@mutmutco/cli@4.5.150"
+    version: "4.5.151",
+    tag: "v4.5.151",
+    commit: "c80d8f0f8b26",
+    npm: "@mutmutco/cli@4.5.151"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18689,14 +18686,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.150"
+          v3Target: "v4.5.151"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.150 and redeploy the Hub Lambda from tag v4.5.150 (4dc71e3761ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.150 (@mutmutco/cli@4.5.150, tag commit 4dc71e3761ec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.151 and redeploy the Hub Lambda from tag v4.5.151 (c80d8f0f8b26); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.151 (@mutmutco/cli@4.5.151, tag commit c80d8f0f8b26 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -35655,8 +35652,8 @@ function suiteModulePackageAccessCheck(suite, deployModel) {
   if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
   return {
     ok: true,
-    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
-    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
+    label: "mmwork-ds package access (manual org-admin step; unverified)",
+    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build fails with 403 read_package."
   };
 }
 function attachTrainDoctorVerdicts(report, trainDoctors) {
@@ -40608,6 +40605,7 @@ var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
 var REC = "";
 var FLD = "";
+var GH_SQUASH_COAUTHORS_RE = /\r?\n(?:[ \t]*\r?\n)+---------\r?\n(?:[ \t]*\r?\n)+(?:Co-authored-by:[ \t]+\S[^\r\n]*(?:\r?\n|$))+[ \t\r\n]*$/i;
 var WAIVABLE_KINDS = [
   "mandatory-zone-untested",
   "unrequested-test-file",
@@ -40765,6 +40763,21 @@ function isShallowRepository(cwd) {
     return true;
   }
 }
+function readOverrideTrailer(trailer, body, cwd) {
+  const direct = (trailer ?? "").trim();
+  if (direct) return direct;
+  const raw = body ?? "";
+  const stripped = raw.replace(GH_SQUASH_COAUTHORS_RE, "\n");
+  if (stripped === raw) return "";
+  const prefix = `${TRAILER_KEY.toLowerCase()}:`;
+  return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    windowsHide: true,
+    cwd,
+    input: stripped,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024
+  }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
+}
 function readOverride(base, cwd) {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
   const refusals = [];
@@ -40773,7 +40786,7 @@ function readOverride(base, cwd) {
     const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
     if (!sha) continue;
     if (override) break;
-    const value = (trailer ?? "").trim();
+    const value = readOverrideTrailer(trailer, body, cwd);
     if (!value) {
       const shaped = OVERRIDE_RE.exec(body ?? "");
       if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
@@ -53400,27 +53413,51 @@ var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FR
 var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
+var RUNS_QUERY_VALUE = {
+  per_page: /^(?:[1-9]\d?|100)$/,
+  page: /^[1-9]\d{0,5}$/,
+  status: /^[A-Za-z_]+$/,
+  branch: /^[A-Za-z0-9_.\/-]+$/,
+  event: /^[A-Za-z_]+$/,
+  head_sha: /^[0-9a-fA-F]{40}$/,
+  created: /^[0-9:TZ.<>=-]+$/,
+  actor: /^[A-Za-z0-9_.\[\]-]+$/
+};
+function validRunsQuery(query) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) return false;
+    const key = pair.slice(0, eq);
+    const value = pair.slice(eq + 1);
+    const re = Object.prototype.hasOwnProperty.call(RUNS_QUERY_VALUE, key) ? RUNS_QUERY_VALUE[key] : void 0;
+    if (!re || seen.has(key) || !re.test(value)) return false;
+    seen.add(key);
+  }
+  return true;
+}
+var JSON_MAX_BUFFER = 64 * 1024 * 1024;
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
 var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/attempts/\\d+)?/jobs$`);
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
+  const q = path2.indexOf("?");
+  const base = q === -1 ? path2 : path2.slice(0, q);
+  const query = q === -1 ? "" : path2.slice(q + 1);
   if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
-  if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
+  if (ACTIONS_RUNS_RE.test(base) && (q === -1 || validRunsQuery(query))) return { kind: "actions-runs", path: path2, paginate: false };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
   if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
   if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
   if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
-  const q = path2.indexOf("?");
-  const base = q === -1 ? path2 : path2.slice(0, q);
-  const query = q === -1 ? "" : path2.slice(q + 1);
   if (CONTENTS_BASE_RE.test(base) && (query === "" || CONTENTS_QUERY_RE.test(query))) {
     return { kind: "contents", path: path2, paginate: false };
   }
@@ -53439,7 +53476,7 @@ function buildApiGetArgs(path2, accept) {
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
-var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout;
+var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : { maxBuffer: JSON_MAX_BUFFER }, ...env ? { env } : {} })).stdout;
 async function readAppApi(path2, runner = apiReadRunner) {
   const req = parseApiGetPath(path2);
   requireBrokerApp("read run log");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.150",
+  "version": "4.5.151",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",