@mutmutco/cli 4.5.158 → 4.5.160

package/dist/runbook-sweep.cjs

@@ -190,6 +190,54 @@ var init_error_codes = __esm({
   }
 });
 
+// src/gh-read-route.ts
+function isViewerFreeGhRead(args) {
+  if (args.some((a) => VIEWER.test(a))) return false;
+  const [group, verb] = args;
+  if (group === "api") return isReadOnlyApi(args.slice(1));
+  return Boolean(group && verb && READ_VERBS.get(group)?.has(verb));
+}
+function isReadOnlyApi(rest) {
+  let path2;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "-X" || a === "--method") {
+      if ((rest[i + 1] ?? "").toUpperCase() !== "GET") return false;
+      i++;
+    } else if (/^--method=/.test(a)) {
+      if (a.slice(9).toUpperCase() !== "GET") return false;
+    } else if (a === "-f" || a === "-F" || a === "--field" || a === "--raw-field") {
+      const field = rest[i + 1] ?? "";
+      if (path2 !== "graphql" || !/^query=\s*(query\b|\{)/.test(field) || /projectV2|projectsV2/.test(field)) return false;
+      i++;
+    } else if (a === "--input" || a.startsWith("--input=")) {
+      return false;
+    } else if (a === "-H" || a === "--header" || a === "-q" || a === "--jq" || a === "-t" || a === "--template" || a === "--hostname" || a === "--cache") {
+      i++;
+    } else if (!a.startsWith("-") && path2 === void 0) {
+      path2 = a.replace(/^\//, "");
+    }
+  }
+  if (!path2) return false;
+  if (path2 === "graphql") return rest.some((a) => /^query=\s*(query\b|\{)/.test(a));
+  return !/^(user|users\/[^/]+\/|notifications|search\/|orgs\/[^/]+\/projectsV2|graphql)/.test(path2);
+}
+var READ_VERBS, VIEWER;
+var init_gh_read_route = __esm({
+  "src/gh-read-route.ts"() {
+    "use strict";
+    READ_VERBS = /* @__PURE__ */ new Map([
+      ["pr", /* @__PURE__ */ new Set(["view", "list", "checks", "diff"])],
+      ["issue", /* @__PURE__ */ new Set(["view", "list"])],
+      ["run", /* @__PURE__ */ new Set(["view", "list", "watch"])],
+      ["label", /* @__PURE__ */ new Set(["list"])],
+      ["release", /* @__PURE__ */ new Set(["view", "list"])],
+      ["repo", /* @__PURE__ */ new Set(["view"])]
+    ]);
+    VIEWER = /@me\b|viewer|project/i;
+  }
+});
+
 // src/github-quota.ts
 var init_github_quota = __esm({
   "src/github-quota.ts"() {
@@ -237,6 +285,12 @@ var init_stdin_inject = __esm({
 });
 
 // src/cli-shared.ts
+async function ghReadAppEnv(file, args) {
+  if (!ghReadTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
+  if (!isViewerFreeGhRead(args)) return void 0;
+  const token = await ghReadTokenProvider().catch(() => void 0);
+  return token ? { ...process.env, GH_TOKEN: token } : void 0;
+}
 function killProcessTree(pid) {
   try {
     if (process.platform === "win32") {
@@ -271,7 +325,7 @@ function execFileHard(file, args, options) {
     timer.unref?.();
   });
 }
-var import_node_child_process3, import_node_util2, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ExecDeadlineError;
+var import_node_child_process3, import_node_util2, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ghReadTokenProvider, ExecDeadlineError;
 var init_cli_shared = __esm({
   "src/cli-shared.ts"() {
     "use strict";
@@ -282,16 +336,27 @@ var init_cli_shared = __esm({
     init_clean_exit();
     init_error_codes();
     init_github_client();
+    init_gh_read_route();
     init_hub_auth();
     init_house_map();
     init_stdin_inject();
     rawExecFileP = (0, import_node_util2.promisify)(import_node_child_process3.execFile);
     DEFAULT_EXEC_TIMEOUT_MS = 1e4;
-    execFileP = (file, args, options = {}) => (
-      // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
-      // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
-      rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
-    );
+    execFileP = async (file, args, options = {}) => {
+      const run = (env) => (
+        // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
+        // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
+        rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options, ...env ? { env } : {} })
+      );
+      const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args);
+      if (!appEnv) return run();
+      try {
+        return await run(appEnv);
+      } catch (e) {
+        if (/Resource not accessible by integration/i.test(String(e.stderr ?? ""))) return run();
+        throw e;
+      }
+    };
     ExecDeadlineError = class extends Error {
       constructor(step, timeoutMs, elapsedMs, killed) {
         super(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.158",
+  "version": "4.5.160",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",