@mutmutco/codex-plugin 4.5.105 → 4.5.107

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.105",
+  "version": "4.5.107",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -384,6 +384,8 @@ function classifyGhTokenExecFailure(e) {
   return { state: "failed", detail };
 }
 async function githubTokenRead() {
+  const mmiPat = process.env.MMI_GH_PAT?.trim();
+  if (mmiPat) return { state: "ok", token: mmiPat };
   if (process.env.GH_TOKEN) return { state: "ok", token: process.env.GH_TOKEN };
   if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
   cachedGhCliTokenRead ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => {
@@ -13392,6 +13394,7 @@ function asBoardStatus(value) {
   return BOARD_STATUSES.includes(value) ? value : void 0;
 }
 function describeTokenSource() {
+  if (process.env.MMI_GH_PAT?.trim()) return "env MMI_GH_PAT";
   if (process.env.GH_TOKEN) return "env GH_TOKEN";
   if (process.env.GITHUB_TOKEN) return "env GITHUB_TOKEN";
   return "`gh auth token` (the gh CLI login)";
@@ -17699,10 +17702,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.105",
-    tag: "v4.5.105",
-    commit: "2edfdb644608",
-    npm: "@mutmutco/cli@4.5.105"
+    version: "4.5.107",
+    tag: "v4.5.107",
+    commit: "a14b5368bc55",
+    npm: "@mutmutco/cli@4.5.107"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17719,14 +17722,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.105"
+          v3Target: "v4.5.107"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.105 and redeploy the Hub Lambda from tag v4.5.105 (2edfdb644608); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.105 (@mutmutco/cli@4.5.105, tag commit 2edfdb644608 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.107 and redeploy the Hub Lambda from tag v4.5.107 (a14b5368bc55); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.107 (@mutmutco/cli@4.5.107, tag commit a14b5368bc55 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.105",
+  "version": "4.5.107",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.105",
+  "version": "4.5.107",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/stage/SKILL.md

@@ -50,7 +50,7 @@ BuildKit ids into the **`docker compose build`** process env only — not into t
 deploy mints the packages sentinel from Actions `GITHUB_TOKEN`; a laptop cannot. Resolution order: existing
 process env → stageless project vault secret under the BuildKit id → existing GitHub sign-in
 (`GH_TOKEN`, `GITHUB_TOKEN`, or `gh auth token`). Package read access is still required and is enforced
-by GitHub Packages during the build. If every source is missing, `/stage` fails before the build.
+by GitHub Packages during the build. Cloud containers whose GH_TOKEN is a proxy placeholder set MMI_GH_PAT to a fine-grained PAT (resource owner mutmutco, Organization → Members: read); mmi-cli prefers it. If every source is missing, `/stage` fails before the build.
 Setup: [`docs/Guides/tenant-runtime.md`](../../docs/Guides/tenant-runtime.md) § Local `/stage`. Never commit
 or print the PAT.