@mutmutco/codex-plugin 4.5.106 → 4.5.108

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.106",
+  "version": "4.5.108",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -384,6 +384,8 @@ function classifyGhTokenExecFailure(e) {
   return { state: "failed", detail };
 }
 async function githubTokenRead() {
+  const mmiPat = process.env.MMI_GH_PAT?.trim();
+  if (mmiPat) return { state: "ok", token: mmiPat };
   if (process.env.GH_TOKEN) return { state: "ok", token: process.env.GH_TOKEN };
   if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
   cachedGhCliTokenRead ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => {
@@ -5757,7 +5759,9 @@ var APP_POLL_PERMISSIONS = {
   issues: "read",
   checks: "read",
   statuses: "read",
-  actions: "read"
+  actions: "read",
+  // #7978: GET branches/{b}/protection/required_status_checks needs Administration: read; read-only.
+  administration: "read"
 };
 var APP_JWT_BACKDATE_S = 60;
 var APP_JWT_TTL_S = 9 * 60;
@@ -6413,6 +6417,18 @@ async function defaultGhApi(args) {
         lastPollSource = source;
         return cached.body;
       }
+      if (source === "app" && appToken && status === 403 && /Resource not accessible by integration/i.test(describeRefusal(errOut))) {
+        console.warn(`poll credential: App token lacks permission for this read (HTTP 403, response: ${describeRefusal(errOut)}) \u2014 this read uses the ambient user token; the App pool stays in use (#7978)`);
+        try {
+          const { stdout: userOut } = await execFileP("gh", ["api", "--include", ...args], { timeout: REST_GH_TIMEOUT_MS });
+          notePoolHeaders("user", userOut, Date.now());
+          return parseIncludedOutput(userOut).body;
+        } catch (userErr) {
+          const uo = userErr.stdout;
+          if (typeof uo === "string") notePoolHeaders("user", uo, Date.now());
+          throw userErr;
+        }
+      }
       if (source === "app" && appToken && (status === 403 || status === 429)) {
         noteAppPollResponse(parseRateLimitHeaders(errOut), true, Date.now());
         console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}; response: ${describeRefusal(errOut)}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
@@ -13392,6 +13408,7 @@ function asBoardStatus(value) {
   return BOARD_STATUSES.includes(value) ? value : void 0;
 }
 function describeTokenSource() {
+  if (process.env.MMI_GH_PAT?.trim()) return "env MMI_GH_PAT";
   if (process.env.GH_TOKEN) return "env GH_TOKEN";
   if (process.env.GITHUB_TOKEN) return "env GITHUB_TOKEN";
   return "`gh auth token` (the gh CLI login)";
@@ -17699,10 +17716,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.106",
-    tag: "v4.5.106",
-    commit: "0bc277b6a60e",
-    npm: "@mutmutco/cli@4.5.106"
+    version: "4.5.108",
+    tag: "v4.5.108",
+    commit: "35c9217e8f1c",
+    npm: "@mutmutco/cli@4.5.108"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17719,14 +17736,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.106"
+          v3Target: "v4.5.108"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.106 and redeploy the Hub Lambda from tag v4.5.106 (0bc277b6a60e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.106 (@mutmutco/cli@4.5.106, tag commit 0bc277b6a60e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.108 and redeploy the Hub Lambda from tag v4.5.108 (35c9217e8f1c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.108 (@mutmutco/cli@4.5.108, tag commit 35c9217e8f1c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.106",
+  "version": "4.5.108",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.106",
+  "version": "4.5.108",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/stage/SKILL.md

@@ -50,7 +50,7 @@ BuildKit ids into the **`docker compose build`** process env only — not into t
 deploy mints the packages sentinel from Actions `GITHUB_TOKEN`; a laptop cannot. Resolution order: existing
 process env → stageless project vault secret under the BuildKit id → existing GitHub sign-in
 (`GH_TOKEN`, `GITHUB_TOKEN`, or `gh auth token`). Package read access is still required and is enforced
-by GitHub Packages during the build. If every source is missing, `/stage` fails before the build.
+by GitHub Packages during the build. Cloud containers whose GH_TOKEN is a proxy placeholder set MMI_GH_PAT to a fine-grained PAT (resource owner mutmutco, Organization → Members: read); mmi-cli prefers it. If every source is missing, `/stage` fails before the build.
 Setup: [`docs/Guides/tenant-runtime.md`](../../docs/Guides/tenant-runtime.md) § Local `/stage`. Never commit
 or print the PAT.