@mutmutco/codex-plugin 4.3.2 → 4.3.4

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/release/SKILL.md

@@ -525,8 +525,29 @@ For `tenant-container` repos, publish the GitHub Release and dispatch the centra
 gh release create "vX.Y.0" --target main --generate-notes --latest
 gh workflow run tenant-deploy.yml --repo mutmutco/MMI-Hub \
   -f slug={slug} -f repo={owner}/{repo} -f ref=main -f stage=main
-gh run watch "$(gh run list --workflow tenant-deploy.yml --limit 1 --json databaseId -q '.[0].databaseId')" \
-  --exit-status   # the central prod-deploy run — run this in the BACKGROUND (Bash run_in_background)
+```
+
+On PowerShell, read the run as a structured receipt and filter it natively; do not nest a
+`gh run list` query inside `gh run watch`:
+```powershell
+$runs = gh run list --workflow tenant-deploy.yml --limit 10 --json databaseId,createdAt,url,status,conclusion | ConvertFrom-Json
+$run = $runs |
+  Where-Object { $_.databaseId -and $_.createdAt } |
+  Sort-Object { [DateTimeOffset]$_.createdAt } -Descending |
+  Select-Object -First 1
+if (-not $run) { throw 'tenant-deploy workflow run was not found' }
+$run | Select-Object databaseId,createdAt,url,status,conclusion | ConvertTo-Json -Compress
+# Run this in the BACKGROUND (PowerShell Start-Job / task runner).
+gh run watch $run.databaseId --exit-status
+```
+
+When several run receipts need collecting, assign the loop output before serializing it; a top-level
+`foreach (...) { ... } | ConvertTo-Json` is a PowerShell parser trap:
+```powershell
+$out = foreach ($run in $runs) {
+  gh run view $run.databaseId --json databaseId,url,status,conclusion,createdAt | ConvertFrom-Json
+}
+$out | ConvertTo-Json -Compress
 ```
 
 For `hub-serverless` (MMI-Hub), publish the GitHub Release but do **not** dispatch `tenant-deploy.yml`:
@@ -731,6 +752,12 @@ gh api repos/{owner}/{repo}/releases/latest --jq '{tagName:.tag_name,targetCommi
 Require its `tagName` to equal the expected `$TAG`; a mismatch means Latest does not identify this
 release and is unverified.
 
+**`gh release view` has no `isLatest` field (#6019).** Never request Latest status through
+`gh release view`: the field is not in its JSON schema, so gh rejects the whole read and lists its
+supported fields — the check errors instead of answering, and Latest stays unverified. This bounded
+read is the supported Latest probe; `gh release list --json <fields>,isLatest` is the supported form
+only when a list receipt is genuinely the right shape.
+
 Collect the backgrounded prod-deploy watch from Step 4 (it has typically finished by now). Confirm prod is
 healthy (the central deploy workflow smoke step / a health check); **red** → report the failure prominently and flag
 that the release shipped on a failed deploy (re-run just the deploy — `main` is already correct).
@@ -750,9 +777,17 @@ verify`: use their own release-workflow evidence and the publish-visibility cont
 Hub releases always carry a distribution bump (the Step 1b fold), so the **publish workflow**
 (`publish.yml`) ships every registry-declared public npm artifact on the GitHub Release from Step 4 —
 don't publish by hand.
-Watch it, then confirm npm caught up:
-```bash
-gh run watch "$(gh run list --workflow publish.yml --event release --limit 1 --json databaseId -q '.[0].databaseId')" --exit-status
+Watch the release-triggered `publish.yml` receipt with the same structured PowerShell probe above
+(`--workflow publish.yml --event release`), then confirm npm caught up:
+```powershell
+$runs = gh run list --workflow publish.yml --event release --limit 10 --json databaseId,createdAt,url,status,conclusion | ConvertFrom-Json
+$run = $runs |
+  Where-Object { $_.databaseId -and $_.createdAt } |
+  Sort-Object { [DateTimeOffset]$_.createdAt } -Descending |
+  Select-Object -First 1
+if (-not $run) { throw 'release-triggered publish workflow run was not found' }
+$run | Select-Object databaseId,createdAt,url,status,conclusion | ConvertTo-Json -Compress
+gh run watch $run.databaseId --exit-status
 node scripts/release-distribution.mjs verify "X.Y.0"   # bare semver — asserts registry versions, BOM identities, and published npm artifacts
 ```
 **verify takes bare semver (#5379).** Pass `X.Y.Z`, not the git-tag form `vX.Y.Z`. Checkout still

package/skills/secrets/SKILL.md

@@ -86,6 +86,15 @@ mmi-cli vault secrets rm SCRAPER_API_KEY
 **Never** pass a value as an argument (`secrets set KEY thevalue` is wrong — there is no value arg). The
 confirmation prints the **name and tier only**, never the value.
 
+**Windows: a multiline wrapped command must be file-backed (#6048).** `cmd.exe` truncates at the first
+newline, so an inline `node -e "<multiline script>"` after `--` reaches the child truncated and fails
+before your code runs. Write the script to a **project-local ignored file** (e.g. `tmp/fetch-models.mjs`
+— git-ignored, never tracked) and wrap the file instead; the key is still injected into the child's env:
+
+```bash
+mmi-cli vault secrets use GEMINI_API_KEY -- node tmp/fetch-models.mjs
+```
+
 ## Rotation checklist
 
 Before rotating, enumerate every copy of the key so no tier stays stale: