@mutmutco/cli 4.5.150 → 4.5.152

package/dist/main.cjs

@@ -7152,7 +7152,7 @@ async function readAppVaultSecret(read) {
     if (/^(Hub GitHub App allowance used up|rate limited)/.test(reason)) {
       throw new AppActorError(`app actor: the vault could not read the App credentials because GitHub is rate-limited, not a denial: ${reason}`, "mint-failed");
     }
-    if (/^authority refused|\(HTTP 404\b/.test(reason)) return null;
+    if (/^authority refused|\(HTTP 40[14]\b/.test(reason)) return null;
     throw new AppActorError(`app actor: the vault read of the App credentials failed, not a denial: ${reason}`, "mint-failed");
   }
 }
@@ -7203,7 +7203,8 @@ async function mintInstallationToken(deps) {
   }
   return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
 }
-async function pollTokenOrUndefined(deps) {
+async function pollTokenOrUndefined(deps, env = process.env) {
+  if (env[APP_ACTOR_ENV]?.trim() === "personal") return void 0;
   try {
     return (await mintInstallationToken(deps)).token;
   } catch (e) {
@@ -7212,25 +7213,42 @@ async function pollTokenOrUndefined(deps) {
   }
 }
 var notedIneligibleCommand = false;
+var notedVaultDenied = false;
 async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
   activeQuotaScope = void 0;
   activeToken = void 0;
   const requested = (env[APP_ACTOR_ENV] ?? "").trim();
-  if (!requested) return "personal";
-  if (requested !== "app") {
-    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' is supported; refusing to guess an identity`);
+  if (requested === "personal") return "personal";
+  if (requested && requested !== "app") {
+    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' and 'personal' are supported; refusing to guess an identity`);
   }
   if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
-    if (!notedIneligibleCommand) {
+    if (requested === "app" && !notedIneligibleCommand) {
       notedIneligibleCommand = true;
       note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
     }
     return "personal";
   }
+  const personalGh = env.GH_TOKEN;
+  const personalGithub = env.GITHUB_TOKEN;
   delete env.GH_TOKEN;
   delete env.GITHUB_TOKEN;
-  const minted = await mint();
+  let minted;
+  try {
+    minted = await mint();
+  } catch (e) {
+    if (!requested && e instanceof AppActorError && e.code === "vault-denied") {
+      if (personalGh !== void 0) env.GH_TOKEN = personalGh;
+      if (personalGithub !== void 0) env.GITHUB_TOKEN = personalGithub;
+      if (!notedVaultDenied) {
+        notedVaultDenied = true;
+        note("app actor: vault denied App credentials \u2014 running on the personal token on this host");
+      }
+      return "personal";
+    }
+    throw e;
+  }
   env.GH_TOKEN = minted.token;
   activeQuotaScope = minted.quotaScope;
   activeToken = minted.token;
@@ -7741,7 +7759,7 @@ function setPollTokenProvider(provider) {
   observedPool.clear();
 }
 async function pollToken() {
-  if (!pollTokenProvider) return void 0;
+  if (process.env.MMI_ACTOR?.trim() === "personal" || !pollTokenProvider) return void 0;
   pollTokenOnce ??= pollTokenProvider().catch((e) => {
     if (e instanceof AppActorError && e.code === "mint-failed") throw e;
     return void 0;
@@ -17125,9 +17143,6 @@ function suiteModuleSeeds(seeds, suite, deployModel) {
     "module/.npmrc": "suite-npmrc.template",
     "module/src/module.jsx": "suite-module.template.jsx",
     "module/vite.config.mjs": "suite-vite.template.mjs",
-    "module/screens/screens.json": "suite-screens.template.json",
-    "module/screens/files.json": "suite-files.template.json",
-    ".github/workflows/screens.yml": "suite-screens.template.yml",
     "docs/Guides/mm-work-module.md": "suite-guide.template.md"
   };
   return [
@@ -18669,10 +18684,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.150",
-    tag: "v4.5.150",
-    commit: "4dc71e3761ec",
-    npm: "@mutmutco/cli@4.5.150"
+    version: "4.5.152",
+    tag: "v4.5.152",
+    commit: "8437cd11d3f1",
+    npm: "@mutmutco/cli@4.5.152"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18689,14 +18704,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.150"
+          v3Target: "v4.5.152"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.150 and redeploy the Hub Lambda from tag v4.5.150 (4dc71e3761ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.150 (@mutmutco/cli@4.5.150, tag commit 4dc71e3761ec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.152 and redeploy the Hub Lambda from tag v4.5.152 (8437cd11d3f1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.152 (@mutmutco/cli@4.5.152, tag commit 8437cd11d3f1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22987,6 +23002,14 @@ async function runTenantControl(deps, options) {
       if (output) result.taskOutput = clampTaskOutput(output);
     }
   }
+  if (watch && runId != null && action === "run-task" && conclusion === "success") {
+    try {
+      const pages = JSON.parse(await deps.run("gh", ["api", `repos/${HUB_REPO2}/actions/runs/${runId}/artifacts`, "--paginate", "--slurp"]));
+      result.outputArtifacts = pages.flatMap((page) => page.artifacts ?? []).filter((a) => a.name.startsWith("task-output-") && Number.isSafeInteger(a.id) && a.id > 0).map((a) => ({ id: a.id, name: a.name, runId, downloadCommand: `MMI_ACTOR=app mmi-cli devops api get repos/${HUB_REPO2}/actions/artifacts/${a.id}/zip --out tmp/task-output-${runId}-${a.id}.zip` }));
+    } catch {
+      result.outputArtifactReadError = `Could not read output artifacts; retry with --resume ${runId} --watch (no re-dispatch)`;
+    }
+  }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
   if (conclusion === "pending" && runId != null && action === "run-task") {
     result.note += `; run ${runId} \u2014 resume without re-dispatching: mmi-cli devops runtime tenant control ${repo} ${stage} run-task --resume ${runId} --watch`;
@@ -23001,6 +23024,8 @@ function renderTenantControl(r) {
   if (r.secrets?.length) {
     for (const s of r.secrets) lines2.push(`  ${s.key}: ${s.status}`);
   }
+  for (const a of r.outputArtifacts ?? []) lines2.push(`  output artifact: ${a.name} (id ${a.id}, run ${a.runId})`, `  ${a.downloadCommand}`);
+  if (r.outputArtifactReadError) lines2.push(`  ${r.outputArtifactReadError}`);
   if (r.taskOutput) {
     lines2.push("  task output:");
     for (const l of r.taskOutput.split("\n")) lines2.push(`    ${l}`);
@@ -32901,7 +32926,7 @@ function parseTenantTasksVar(raw) {
     if (!nameRe.test(name)) throw new Error(`org project set: tenantTasks name ${JSON.stringify(name)} must be lowercase kebab-case`);
     if (!rawTask || typeof rawTask !== "object" || Array.isArray(rawTask)) throw new Error(`org project set: tenantTasks.${name} must be an object`);
     const task = rawTask;
-    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact", "secretOutput"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
+    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact", "output", "secretOutput"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
     if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
     if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
     if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
@@ -32911,12 +32936,16 @@ function parseTenantTasksVar(raw) {
     if (artifact !== "none" && artifact !== "required") throw new Error(`org project set: tenantTasks.${name}.artifact must be none or required`);
     const carriesPlaceholder = task.command.some((arg) => arg.includes("{artifact}"));
     if (artifact === "required" !== carriesPlaceholder) throw new Error(`org project set: tenantTasks.${name} must use {artifact} exactly when artifact is required`);
+    if (task.output !== void 0 && task.output !== "file") throw new Error(`org project set: tenantTasks.${name}.output must be file, use {output}, and cannot combine with secretOutput`);
+    const outputPlaceholder = task.command.some((arg) => arg.includes("{output}"));
+    if (task.output === "file" !== outputPlaceholder || task.output !== void 0 && task.secretOutput !== void 0) throw new Error(`org project set: tenantTasks.${name}.output must be file, use {output}, and cannot combine with secretOutput`);
     out[name] = {
       service: task.service,
       command: task.command,
       stages: task.stages,
       ...task.timeoutSeconds !== void 0 ? { timeoutSeconds: task.timeoutSeconds } : {},
       ...artifact !== "none" ? { artifact } : {},
+      ...task.output === "file" ? { output: "file" } : {},
       ...task.secretOutput !== void 0 ? { secretOutput: parseTenantTaskSecretOutput(task.secretOutput, `tenantTasks.${name}.secretOutput`) } : {}
     };
   }
@@ -32979,7 +33008,7 @@ var SETTABLE_VAR_HINTS = {
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
-  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
+  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",output?:"file",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
   internalPeers: "JSON {owner/repo:[dev|rc|main]} \u2014 same-box suite peers via the box Caddy; clear with --unset internalPeers (#7886)",
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
@@ -35655,8 +35684,8 @@ function suiteModulePackageAccessCheck(suite, deployModel) {
   if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
   return {
     ok: true,
-    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
-    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
+    label: "mmwork-ds package access (manual org-admin step; unverified)",
+    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build fails with 403 read_package."
   };
 }
 function attachTrainDoctorVerdicts(report, trainDoctors) {
@@ -40608,6 +40637,7 @@ var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
 var REC = "";
 var FLD = "";
+var GH_SQUASH_COAUTHORS_RE = /\r?\n(?:[ \t]*\r?\n)+---------\r?\n(?:[ \t]*\r?\n)+(?:Co-authored-by:[ \t]+\S[^\r\n]*(?:\r?\n|$))+[ \t\r\n]*$/i;
 var WAIVABLE_KINDS = [
   "mandatory-zone-untested",
   "unrequested-test-file",
@@ -40765,6 +40795,21 @@ function isShallowRepository(cwd) {
     return true;
   }
 }
+function readOverrideTrailer(trailer, body, cwd) {
+  const direct = (trailer ?? "").trim();
+  if (direct) return direct;
+  const raw = body ?? "";
+  const stripped = raw.replace(GH_SQUASH_COAUTHORS_RE, "\n");
+  if (stripped === raw) return "";
+  const prefix = `${TRAILER_KEY.toLowerCase()}:`;
+  return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    windowsHide: true,
+    cwd,
+    input: stripped,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024
+  }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
+}
 function readOverride(base, cwd) {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
   const refusals = [];
@@ -40773,7 +40818,7 @@ function readOverride(base, cwd) {
     const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
     if (!sha) continue;
     if (override) break;
-    const value = (trailer ?? "").trim();
+    const value = readOverrideTrailer(trailer, body, cwd);
     if (!value) {
       const shaped = OVERRIDE_RE.exec(body ?? "");
       if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
@@ -53243,8 +53288,9 @@ async function runBrokerRestChecks(deps, spec, resolveRepo2) {
   return { rows: read.rows, state: read.state, exitCode: checkRowsExitCode(read.state) };
 }
 function requireBrokerApp(label) {
-  if (process.env.MMI_ACTOR !== "app") {
-    fail(`${label}: App-only read \u2014 re-run with spawn-scoped MMI_ACTOR=app (reads never fall back to personal; interactive use keeps gh and the human commands)`);
+  const actor = (process.env.MMI_ACTOR ?? "").trim();
+  if (actor && actor !== "app") {
+    fail(`${label}: App-only read \u2014 re-run with spawn-scoped MMI_ACTOR=app (explicit personal opt-out uses gh and the human commands instead)`);
   }
 }
 function registerPrChecksRequiredCommand(prRoot, resolveRepo2, overrides) {
@@ -53400,27 +53446,58 @@ var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FR
 var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
+var RUNS_QUERY_VALUE = {
+  per_page: /^(?:[1-9]\d?|100)$/,
+  page: /^[1-9]\d{0,5}$/,
+  status: /^[A-Za-z_]+$/,
+  branch: /^[A-Za-z0-9_.\/-]+$/,
+  event: /^[A-Za-z_]+$/,
+  head_sha: /^[0-9a-fA-F]{40}$/,
+  created: /^[0-9:TZ.<>=-]+$/,
+  actor: /^[A-Za-z0-9_.\[\]-]+$/
+};
+function validRunsQuery(query) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) return false;
+    const key = pair.slice(0, eq);
+    const value = pair.slice(eq + 1);
+    const re = Object.prototype.hasOwnProperty.call(RUNS_QUERY_VALUE, key) ? RUNS_QUERY_VALUE[key] : void 0;
+    if (!re || seen.has(key) || !re.test(value)) return false;
+    seen.add(key);
+  }
+  return true;
+}
+var JSON_MAX_BUFFER = 64 * 1024 * 1024;
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
 var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/attempts/\\d+)?/jobs$`);
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
+var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
+var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
+var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
+  const q = path2.indexOf("?");
+  const base = q === -1 ? path2 : path2.slice(0, q);
+  const query = q === -1 ? "" : path2.slice(q + 1);
   if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
-  if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
+  if (ACTIONS_RUNS_RE.test(base) && (q === -1 || validRunsQuery(query))) return { kind: "actions-runs", path: path2, paginate: false };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
   if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
   if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
   if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
-  const q = path2.indexOf("?");
-  const base = q === -1 ? path2 : path2.slice(0, q);
-  const query = q === -1 ? "" : path2.slice(q + 1);
+  if (RELEASE_LATEST_RE.test(path2)) return { kind: "release-latest", path: path2, paginate: false };
+  const tag = RELEASE_TAG_RE.exec(path2)?.[1];
+  if (tag && !tag.includes("..")) return { kind: "release-tag", path: path2, paginate: false };
+  if (RELEASE_ASSET_RE.test(path2)) return { kind: "release-asset", path: path2, paginate: false };
   if (CONTENTS_BASE_RE.test(base) && (query === "" || CONTENTS_QUERY_RE.test(query))) {
     return { kind: "contents", path: path2, paginate: false };
   }
@@ -53432,14 +53509,15 @@ function buildApiGetArgs(path2, accept) {
   const req = parseApiGetPath(path2);
   const args = ["api", req.path];
   if (req.paginate) args.push("--paginate");
-  const header = acceptHeaderFor(accept);
+  const requestedHeader = acceptHeaderFor(accept);
+  const header = req.kind === "release-asset" ? "application/octet-stream" : requestedHeader;
   if (header !== API_ACCEPT_HEADERS.json) args.push("-H", `Accept: ${header}`);
   return args;
 }
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
-var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout;
+var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : { maxBuffer: JSON_MAX_BUFFER }, ...env ? { env } : {} })).stdout;
 async function readAppApi(path2, runner = apiReadRunner) {
   const req = parseApiGetPath(path2);
   requireBrokerApp("read run log");
@@ -53449,16 +53527,16 @@ async function readAppApi(path2, runner = apiReadRunner) {
 }
 function registerApiReadCommands(program3, overrides) {
   const spawn6 = overrides?.runner ?? apiReadRunner;
-  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts)");
+  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts, releases)");
   api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
     acceptHeaderFor(v);
     return v.trim().toLowerCase();
-  }, "json").option("--out <file>", "write the response bytes to this file instead of stdout (required for, and only valid with, actions/artifacts/{id}/zip)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
-    const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs";
-    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs`);
-    const actionsRoute = req.kind.startsWith("actions-");
-    if (actionsRoute) requireBrokerApp("api get");
-    const env = actionsRoute || process.env.MMI_ACTOR === "app" ? brokerChildEnv() : void 0;
+  }, "json").option("--out <file>", "write response bytes to a file (required for, and only valid with, actions artifact zips, job logs, and release assets)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+    const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs" || req.kind === "release-asset";
+    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}`);
+    const appRoute = req.kind.startsWith("actions-") || req.kind.startsWith("release-");
+    if (appRoute) requireBrokerApp("api get");
+    const env = appRoute || process.env.MMI_ACTOR?.trim() !== "personal" ? brokerChildEnv() : void 0;
     let body;
     try {
       body = await runApiGet(
@@ -57166,7 +57244,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..10800 (1..3600 with a secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description('register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?,output?:"file"}; required artifact tasks must carry {artifact} in the command argv.').option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..10800 (1..3600 with a secretOutput)").option("--output <file>", "return {output} as a private 1-day Actions artifact (cannot combine with secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", 'full task object {service,command[],stages[],timeoutSeconds?,artifact?,output?:"file"} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -57191,7 +57269,8 @@ projectTenantTasks.command("declare <name>").description("register a NEW tenant
       command: o.command,
       stages: o.stages.split(",").map((s) => s.trim()).filter(Boolean),
       ...o.timeoutSeconds !== void 0 ? { timeoutSeconds: Number(o.timeoutSeconds) } : {},
-      ...o.artifact !== void 0 ? { artifact: o.artifact } : {}
+      ...o.artifact !== void 0 ? { artifact: o.artifact } : {},
+      ...o.output !== void 0 ? { output: o.output } : {}
     };
   }
   if (task && typeof task === "object" && task.secretOutput !== void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.150",
+  "version": "4.5.152",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",