@mutmutco/codex-plugin 4.0.2 → 4.0.4

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
-  "version": "4.0.2",
-  "mmiCompat": "3.x",
+  "version": "4.0.4",
+  "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/pretooluse-shell-gates.mjs

@@ -4,7 +4,7 @@
 // then command-ladder. The broad shell-dialect advisory remains retired.
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { isAbsolute, resolve } from 'node:path';
 import { analyze as analyzeSecretEcho } from './secret-echo-lint.mjs';
 import { analyze as analyzeEnvWrite } from './env-write-lint.mjs';
 import { decide as decideCommandLadder, matchedVerb } from './command-ladder-gate.mjs';
@@ -43,9 +43,45 @@ function preToolUseDeny(reason) {
   });
 }
 
+/** Commands whose heredoc body IS executed, so its text must stay under analysis. Deliberately a
+ *  small allowlist matched by executable NAME: anything unrecognised counts as an interpreter and
+ *  keeps its body scanned, so an unknown consumer can never become a bypass (#5266). */
+const HEREDOC_DATA_CONSUMERS = new Set(['git', 'cat', 'tee', 'mmi-cli', 'jerv-cli', 'gh', 'jq', 'grep', 'sed', 'diff', 'sort', 'wc', 'head', 'tail']);
+
+/** Blank out heredoc BODIES that are data rather than script (#5266).
+ *
+ *  Segmentation splits on `;|&` and newlines, so a heredoc body — a commit message, a PR body, an
+ *  issue report — was chopped into pseudo-segments and analysed as if it were a command. Prose that
+ *  merely QUOTED a test runner was therefore refused as an attempt to run tests, which penalised
+ *  writing accurate evidence about test behaviour: the exact opposite of what #5264 was fixing.
+ *
+ *  Bodies are replaced with equal-length blanks, never deleted, so every offset the analysers and
+ *  the segment-ordinal reporting depend on is preserved. A body is only blanked when the command
+ *  introducing it is a known data consumer; `sh <<EOF … EOF` genuinely executes its body and stays
+ *  fully analysed. */
+function maskHeredocData(source) {
+  const lines = source.split('\n');
+  const out = [...lines];
+  for (let i = 0; i < lines.length; i += 1) {
+    const intro = /<<-?\s*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/.exec(lines[i]);
+    if (!intro) continue;
+    const delimiter = intro[1] ?? intro[2] ?? intro[3];
+    // The consumer is the command the redirection attaches to — the LAST one before `<<`, not the
+    // first on the line. `cd <dir> && git commit -F - <<EOF` is consumed by git, not by cd.
+    const consumer = /(?:^|[;|&])\s*([^\s;|&]+)[^;|&]*$/.exec(lines[i].slice(0, intro.index));
+    if (!HEREDOC_DATA_CONSUMERS.has(executableName(consumer?.[1]))) continue;
+    for (let j = i + 1; j < lines.length; j += 1) {
+      if (lines[j].trim() === delimiter) { i = j; break; }
+      out[j] = ' '.repeat(lines[j].length);
+      if (j === lines.length - 1) i = j;
+    }
+  }
+  return out.join('\n');
+}
+
 /** Split only on unquoted compound-command operators. Text is retained solely for analyzers and is never surfaced. */
 function boundedShellSegments(command) {
-  const source = String(command ?? '');
+  const source = maskHeredocData(String(command ?? ''));
   const segments = [];
   let start = 0;
   let quote = null;
@@ -293,8 +329,24 @@ function git(root, args) {
   });
 }
 
+/** The directory the COMMAND will run in, when it names one itself (#5264).
+ *
+ *  A compound command routinely opens with `cd <path> && …`, and the host's `cwd` is the session's,
+ *  not the command's. Judging `cd <other-repo-worktree> && npm test` by the session cwd evaluates a
+ *  DIFFERENT repository — its test-policy.json and its (typically clean) diff — and then states a
+ *  conclusion about the repo it never looked at. Reuses the same bounded segmentation the gate
+ *  already trusts, and only ever feeds a read-only `git -C` probe. */
+function commandWorkingDirectory(command, base) {
+  const [first] = boundedShellSegments(command);
+  const match = /^cd\s+(?!-)(?:"([^"]+)"|'([^']+)'|([^\s;&|]+))\s*$/.exec(first?.text ?? '');
+  const target = match?.[1] ?? match?.[2] ?? match?.[3];
+  if (!target || target.startsWith('~')) return null;
+  const resolved = isAbsolute(target) ? target : (typeof base === 'string' && base ? resolve(base, target) : null);
+  return resolved && existsSync(resolved) ? resolved : null;
+}
+
 function repositoryRoot(input) {
-  const candidates = [input?.cwd, process.cwd()]
+  const candidates = [commandWorkingDirectory(input?.tool_input?.command, input?.cwd), input?.cwd, process.cwd()]
     .filter((cwd, index, values) => typeof cwd === 'string' && cwd && values.indexOf(cwd) === index);
   for (const cwd of candidates) {
     try {
@@ -372,8 +424,14 @@ function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
     stdout.write(preToolUseDeny(reason) + '\n');
     return { denied: true };
   }
+  // #5264: name the repository this verdict was computed from. The refusal text is authoritative and
+  // gets pasted into PR bodies as verification, so a bare "the current diff" — with no statement of
+  // WHICH diff — reads as a claim about the repo the author is working in even when the gate resolved
+  // a different one. Naming the root makes a wrong resolution self-evident instead of quotable.
   const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-outside-mandatory-zone]: '
-    + 'the current diff does not touch any test-policy.json mandatory glob. Do not run tests; use policy-approved non-test verification, '
+    + `no path in ${root}'s task diff matches a mandatory glob in its test-policy.json. `
+    + 'Verify that is the repository you meant before quoting this: it is resolved from the command\'s own `cd`, then the host cwd. '
+    + 'Do not run tests; use policy-approved non-test verification, '
     + 'or touch and run mandatory-zone coverage only when the diff actually requires it.';
   appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-outside-mandatory-zone', tool: input?.tool_name });
   stdout.write(preToolUseDeny(reason) + '\n');

package/skills/hotfix/SKILL.md

@@ -37,8 +37,16 @@ version, BOM, and package pins. Step 3 opens that development-base fold PR autom
 
 ## Authority and preflight
 
-Production changes require the authorized human's explicit approval in the current turn. Verify authority
-and CLI health before starting:
+Production changes require the authorized human's explicit approval in the current turn. Before describing
+or executing any hotfix lane, read the project META and name the lane (#5244 — same gate as `/release`):
+```bash
+mmi-cli oracle org project get {owner}/{repo} --json
+```
+`releaseTrack: direct` means `development → main` only — **no `rc` branch** (MMI-Hub included via the
+Hub-control special case). Stop on an unreadable META record; never infer the lane from branch names or
+release history.
+
+Verify authority and CLI health before starting:
 
 ```bash
 mmi-cli oracle org access role <owner/repo> --json

package/skills/mmi/SKILL.md

@@ -299,6 +299,10 @@ something else* paths.)
   ```
   The command validates `Todo` + unassigned, assigns the viewer, and moves the Project v2 `Status` to
   `In Progress`. A partial claim exits nonzero unless the dev explicitly accepted `--allow-partial`.
+  Every claim also stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: … -->`,
+  surface/session@host) so other agents can attribute the hold (#3727): the session is the
+  host-exported id when the surface provides one, otherwise a per-process `synth-` fallback — a
+  claim is never anonymous (#5245).
   Claiming several items (batch/parallel act-paths) takes them in **one call** — `board claim <ref> <ref> …`
   — which shares the setup cost and reports per-item results (any per-item failure → nonzero exit).
 - **File a new item (guided by type → template):** don't free-type an issue. Walk the dev through it:
@@ -415,6 +419,11 @@ workspace mechanics:
 MMI owns the PR/CI/merge/board facts; the host agent owns local worktrees and branches. Neither `pr land`
 nor `pr merge` deletes a local worktree or local branch, and no MMI command should do so. The distinction:
 
+**Release-track before branch hygiene (#5244):** before hunting `rc` branches, rc worktrees, or retired rc refs
+for cleanup, read the repo's release track (`mmi-cli status`, or `mmi-cli oracle org project get` when
+status omits it). Direct-track repos have only `development` and `main` — an old rc promotion PR does not
+imply a live `rc` branch or worktree exists.
+
 - `mmi-cli devops pr land <pr>` is the normal agent path for a `development` PR: train-authority probe →
   checks wait → squash auto-merge/poll → board advance. GitHub may delete the **remote** feature branch.
 - `mmi-cli devops pr merge <pr>` is the lower-level merge primitive. It is not a shortcut around checks
@@ -451,18 +460,30 @@ Proceed only when `state` is `MERGED`, `headRefName` equals the local task branc
 local branch OID, the worktree is registered to that branch, and its status is empty. Branch name, missing
 remote ref, patch-id, or PR state **alone** is not proof. Then, from the main checkout:
 
+A clean `git status --porcelain` is **not** proof the physical directory is empty: gitignored payload such
+as `node_modules` (from `npm ci`) and this session's own scratch (e.g. `.jerv/tmp`) is invisible to it,
+and `git worktree remove` refuses a non-empty tree with `Directory not empty` (#5239). Once the receipt
+above proves delivery, delete `node_modules` and this session's own scratch first, then remove:
+
 ```bash
+rm -rf <task-worktree>/node_modules   # gitignored payload — porcelain never shows it
+rm -rf <task-worktree>/.jerv/tmp      # this session's own scratch, if this run created it
 git worktree remove <task-worktree>
 git branch -D <branch>       # deliberate: squash merge makes -d ancestry proof impossible
 git worktree prune
 ```
 
 `-D` is permitted only after the exact receipt above. Never use it for a mismatched OID, an open/unreadable
-PR, a dirty tree, another owner's tree, or an ambiguous branch.
-
-On Windows `Directory not empty`, `EBUSY`, `EPERM`, or WinError 32: re-check that every context has left the
-path and make **one bounded retry** of `git worktree remove` when it is still registered. If Git already
-unregistered the tree but a partial directory remains, or the retry is still locked, stop: do not kill
+PR, a dirty tree, another owner's tree, or an ambiguous branch. The pre-removal deletes follow the same
+rule: only artifacts this session created inside this task worktree.
+
+On Windows `Directory not empty` with a clean porcelain, suspect leftover gitignored payload: delete it as
+above and retry. On `EBUSY`, `EPERM`, or WinError 32: re-check that every context has left the path and
+make **one bounded retry** of `git worktree remove` when it is still registered. If the retry reports
+`is not a working tree`, the first failed remove already unregistered the tree; when the exact receipt
+above proves the leftover directory is this session's own merged branch, that leftover may be deleted
+(`rm -rf <task-worktree>`) — own-session artifacts only, never another session's tree, never on a
+mismatched OID or unreadable PR (#5239). Otherwise, or when the retry is still locked, stop: do not kill
 unrelated processes, recursively delete the directory, or guess. Report `deferred-lock` with the exact
 path, branch, local OID, PR, and whether the tree remains registered. Report any failed proof as
 `retained-ambiguous`. Only report `clean` after the path, registration, and local task branch are all gone.

package/skills/mmi-resume/SKILL.md

@@ -35,10 +35,20 @@ A clean self-check is silent-enough — move straight on. Do not block the snaps
 mmi-cli status
 ```
 
-`status` is the unified current-state read for **this** checkout: branch, linked worktrees, your open PRs,
-your claimed board items, and whether a local stage is running. It is the "where am I" line — render it,
-don't re-derive it from raw `git`/`gh`. Keep the case-preserving `repo` value it reports; that is the
-workspace identity the next step must use (for example `mutmutco/MMC-ZuberShade`).
+`status` is the unified current-state read for **this** checkout: branch, **release track** (when the repo is
+registered — `releaseTrack` + branch topology from Hub META), linked worktrees, your open PRs, your claimed
+board items, and whether a local stage is running. It is the "where am I" line — render it, don't re-derive
+it from raw `git`/`gh`. Keep the case-preserving `repo` value it reports; that is the workspace identity the
+next step must use (for example `mutmutco/MMC-ZuberShade`).
+
+**Release-track doctrine (#5244):** direct-track repos (`releaseTrack: direct`, plus MMI-Hub via the
+`isHubControlRepo` special case) have **only** `development` and `main` — no `rc` branch exists. Never hunt
+for, clean up, or run `/rcand` against an `rc` ref on direct-track. When `status` omits `releaseTrack`
+(unregistered repo or registry unavailable), resolve it before any train/rc/hotfix/release or branch-hygiene
+work:
+```bash
+mmi-cli oracle org project get {owner}/{repo} --json
+```
 
 ### Step 1a — report deferred host cleanup, never perform it here (#5182)
 

package/skills/rcand/SKILL.md

@@ -19,7 +19,18 @@ pushes to the protected `rc` branch, whose per-repo allowlist carries the same p
 project-admins). No `.env` role marker. Gate ordering: the tag lands the rc SHA
 for checks, and every deploy side-effect waits until the protected `rc` push accepts that checked SHA.
 
-## Step 0 — train-authority probe (server-side, D14)
+## Step 0 — confirm lane + train-authority probe (server-side, D14)
+
+Before describing or executing any rc promotion, read the project META and name the lane (#5244):
+```bash
+mmi-cli oracle org project get {owner}/{repo} --json
+```
+`releaseTrack: direct` (product repos with explicit META, plus MMI-Hub via the `isHubControlRepo`
+special-case) means **no `rc` branch** — stop here and run `/release` from `development` instead.
+`mmi-cli devops rcand --apply` refuses direct-track after its own preflight; do not reach Step 1 on direct.
+Stop on an unreadable META record; never infer the lane from branch names or the existence of a stale `rc` ref.
+
+Then probe train authority:
 
 ```bash
 mmi-cli oracle org access role {owner}/{repo} --json   # Hub-verified: { role, train }