@mutmutco/codex-plugin 4.5.110 → 4.5.112

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.110",
+  "version": "4.5.112",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -5851,42 +5851,11 @@ async function mintInstallationToken(deps) {
 async function pollTokenOrUndefined(deps) {
   try {
     return (await mintInstallationToken(deps)).token;
-  } catch {
+  } catch (e) {
+    if (e instanceof AppActorError && e.code === "mint-failed") throw e;
     return void 0;
   }
 }
-var APP_POLL_HEADROOM_FRACTION = 0.4;
-var APP_POLL_RESET_DEFAULT_MS = 36e5;
-var appPollGuardState = {};
-function appPollGuardSnapshot() {
-  return { ...appPollGuardState };
-}
-function appPollAllowsApp(nowMs) {
-  if (appPollGuardState.fallbackUntilMs !== void 0) {
-    if (nowMs < appPollGuardState.fallbackUntilMs) return false;
-    appPollGuardState = {};
-  }
-  const { remaining, limit } = appPollGuardState;
-  if (remaining === void 0 || limit === void 0 || limit <= 0) return true;
-  return remaining / limit >= APP_POLL_HEADROOM_FRACTION;
-}
-function latchAppPollFallback(nowMs) {
-  appPollGuardState.fallbackUntilMs = appPollGuardState.resetAtMs ?? nowMs + APP_POLL_RESET_DEFAULT_MS;
-}
-function noteAppPollResponse(headers, rateLimited, nowMs) {
-  if (headers.remaining !== void 0) appPollGuardState.remaining = headers.remaining;
-  if (headers.limit !== void 0) appPollGuardState.limit = headers.limit;
-  if (headers.resetSec !== void 0 && headers.resetSec > 0) appPollGuardState.resetAtMs = headers.resetSec * 1e3;
-  const { remaining, limit } = appPollGuardState;
-  const belowFloor = !rateLimited && remaining !== void 0 && limit !== void 0 && limit > 0 && remaining / limit < APP_POLL_HEADROOM_FRACTION;
-  const headroomUnverifiable = !rateLimited && (headers.remaining === void 0 || headers.limit === void 0);
-  if (rateLimited || belowFloor || headroomUnverifiable && appPollGuardState.resetAtMs !== void 0) {
-    latchAppPollFallback(nowMs);
-  }
-}
-function resetAppPollGuard() {
-  appPollGuardState = {};
-}
 var notedIneligibleCommand = false;
 async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
@@ -6072,7 +6041,7 @@ function waitReadFailureMessage(e) {
   const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
   return (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 300);
 }
-var PR_CHECKS_POLL_MS = 3e4;
+var PR_CHECKS_POLL_MS = 6e4;
 function pollIntervalMs(elapsedMs) {
   return Math.min(4 * PR_CHECKS_POLL_MS, PR_CHECKS_POLL_MS * 2 ** Math.floor(Math.max(0, elapsedMs) / 3e5));
 }
@@ -6324,15 +6293,21 @@ function lastRestPollSource() {
 function setPollTokenProvider(provider) {
   pollTokenProvider = provider;
   pollTokenOnce = void 0;
-  resetAppPollGuard();
   lastPollSource = void 0;
   observedPool.clear();
 }
 async function pollToken() {
   if (!pollTokenProvider) return void 0;
-  pollTokenOnce ??= pollTokenProvider().catch(() => void 0);
+  pollTokenOnce ??= pollTokenProvider().catch((e) => {
+    if (e instanceof AppActorError && e.code === "mint-failed") throw e;
+    return void 0;
+  });
   return pollTokenOnce;
 }
+async function ghReadEnv() {
+  const appToken = await pollToken();
+  return appToken ? { ...process.env, GH_TOKEN: appToken } : void 0;
+}
 var INCLUDED_HEADER_BLOCK = /^(?:\r?\n)?HTTP\/\d(?:\.\d)? (\d{3})[^\n]*\n(?:[^\n]+\n)*?\r?\n/gm;
 function parseIncludedOutput(out) {
   let status;
@@ -6373,11 +6348,6 @@ function describeRefusal(out) {
   return [parts.join(" "), text ? `"${text}"` : ""].filter(Boolean).join(" ") || "no rate-limit headers or message";
 }
 var etagCache = /* @__PURE__ */ new Map();
-function appPoolDetail() {
-  const guard = appPollGuardSnapshot();
-  const counts = guard.remaining !== void 0 && guard.limit !== void 0 ? `App pool at ${guard.remaining}/${guard.limit}` : "App pool headroom unverified";
-  return guard.resetAtMs !== void 0 ? `${counts}, resets ${new Date(guard.resetAtMs).toISOString()}` : counts;
-}
 var observedPool = /* @__PURE__ */ new Map();
 var OBSERVED_POOL_MAX_AGE_MS = 3 * 6e4;
 function notePoolHeaders(source, out, nowMs) {
@@ -6393,59 +6363,46 @@ function observedCorePool(source, nowMs) {
 }
 async function defaultGhApi(args) {
   const appToken = await pollToken();
-  let source = appToken && appPollAllowsApp(Date.now()) ? "app" : "user";
-  if (lastPollSource !== void 0 && lastPollSource !== source) {
-    console.warn(source === "user" ? `poll credential: ${appPoolDetail()} \u2014 below the ${APP_POLL_HEADROOM_FRACTION * 100}% App-poll headroom floor (#7843); REST poll reads switch to the ambient user token until the App pool resets` : "poll credential: App pool reset passed \u2014 REST poll reads return to the App installation token (#7843)");
-  }
-  for (; ; ) {
-    const key = `${source}\0${args.join("\0")}`;
-    const cached = etagCache.get(key);
-    let stdout;
-    try {
-      ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
-        timeout: REST_GH_TIMEOUT_MS,
-        // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
-        // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
-        ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
-      }));
-    } catch (e) {
-      const out = e.stdout;
-      const errOut = typeof out === "string" ? out : void 0;
-      const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
-      if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
-      if (cached && status === 304) {
-        lastPollSource = source;
-        return cached.body;
-      }
-      if (source === "app" && appToken && status === 403 && /Resource not accessible by integration/i.test(describeRefusal(errOut))) {
-        console.warn(`poll credential: App token lacks permission for this read (HTTP 403, response: ${describeRefusal(errOut)}) \u2014 this read uses the ambient user token; the App pool stays in use (#7978)`);
-        try {
-          const { stdout: userOut } = await execFileP("gh", ["api", "--include", ...args], { timeout: REST_GH_TIMEOUT_MS });
-          notePoolHeaders("user", userOut, Date.now());
-          return parseIncludedOutput(userOut).body;
-        } catch (userErr) {
-          const uo = userErr.stdout;
-          if (typeof uo === "string") notePoolHeaders("user", uo, Date.now());
-          throw userErr;
-        }
-      }
-      if (source === "app" && appToken && (status === 403 || status === 429)) {
-        noteAppPollResponse(parseRateLimitHeaders(errOut), true, Date.now());
-        console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}; response: ${describeRefusal(errOut)}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
-        lastPollSource = "user";
-        source = "user";
-        continue;
+  const source = appToken ? "app" : "user";
+  const key = `${source}\0${args.join("\0")}`;
+  const cached = etagCache.get(key);
+  let stdout;
+  try {
+    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+      timeout: REST_GH_TIMEOUT_MS,
+      // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
+      // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
+      ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
+    }));
+  } catch (e) {
+    const out = e.stdout;
+    const errOut = typeof out === "string" ? out : void 0;
+    const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+    if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
+    if (cached && status === 304) {
+      lastPollSource = source;
+      return cached.body;
+    }
+    if (status === 403 || status === 429) {
+      const path2 = args.filter((a) => !a.startsWith("-")).join(" ") || args.join(" ");
+      const refusal = errOut !== void 0 ? describeRefusal(errOut) : "no rate-limit headers or message";
+      if (status === 403 && /Resource not accessible by integration/i.test(refusal)) {
+        throw new Error(
+          `poll read refused: App token lacks permission for ${path2} (HTTP 403, response: ${refusal}) \u2014 reads never fall back to the owner's token (#8030); add the permission to APP_POLL_PERMISSIONS / the App installation`
+        );
       }
-      throw e;
+      throw Object.assign(new Error(
+        `poll read refused on the ${source} pool (HTTP ${status}, response: ${refusal}) \u2014 reads stay on the ${source === "app" ? "App" : "ambient identity"} (#8030); the wait re-arms after reset`
+      ), { status, stdout: errOut, stderr: e.stderr });
     }
-    const { body, etag, pages } = parseIncludedOutput(stdout);
-    notePoolHeaders(source, stdout, Date.now());
-    if (source === "app") noteAppPollResponse(parseRateLimitHeaders(stdout), false, Date.now());
-    lastPollSource = source;
-    if (etag && pages === 1) etagCache.set(key, { etag, body });
-    else etagCache.delete(key);
-    return body;
+    throw e;
   }
+  const { body, etag, pages } = parseIncludedOutput(stdout);
+  notePoolHeaders(source, stdout, Date.now());
+  lastPollSource = source;
+  if (etag && pages === 1) etagCache.set(key, { etag, body });
+  else etagCache.delete(key);
+  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -6913,7 +6870,7 @@ async function fetchRequiredCheckContexts(repo, branch, gh2 = defaultGhApi) {
   return contexts;
 }
 async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
-  const seen = gh2 === defaultGhApi ? observedCorePool(await pollToken() && appPollAllowsApp(nowMs) ? "app" : "user", nowMs) : void 0;
+  const seen = gh2 === defaultGhApi ? observedCorePool(await pollToken() ? "app" : "user", nowMs) : void 0;
   if (seen) return { state: "ok", ...seen };
   let core;
   try {
@@ -6939,7 +6896,12 @@ function withAppClaimMarkerRead(client, appClient) {
         return await client.restPaginate(path2, init);
       } catch (e) {
         if (!commentsPath.test(path2) || !(e instanceof GitHubApiError) || e.status !== 429 && (e.status !== 403 || !isRateLimitRefusal(e))) throw e;
-        const token = appClient ? void 0 : await pollToken();
+        let token;
+        try {
+          token = appClient ? void 0 : await pollToken();
+        } catch {
+          throw e;
+        }
         if (!appClient && !token) throw e;
         return (appClient ?? createGitHubClient({ token: async () => token })).restPaginate(path2, init);
       }
@@ -16926,10 +16888,24 @@ function foldPortManualCommand(model, version) {
   return model === "hub-serverless" ? `node scripts/release-distribution.mjs prepare ${version}` : `npm version ${version} --no-git-tag-version --allow-same-version`;
 }
 var HUB_REPO2 = "mutmutco/MMI-Hub";
-var GH_RUN_WATCH_INTERVAL_S = 30;
+var GH_RUN_WATCH_INTERVAL_S = 60;
 function ghRunWatchArgs(runId, repo) {
   return ["run", "watch", String(runId), "--repo", repo, "--exit-status", "--interval", String(GH_RUN_WATCH_INTERVAL_S)];
 }
+function isAppRoutableGhReadArgs(args) {
+  if (args.some((a) => a === "--mine" || a === "viewer" || a.includes("@me"))) return false;
+  const [cmd, sub] = args;
+  if (cmd === "run" && (sub === "view" || sub === "list" || sub === "watch")) return true;
+  if (cmd === "pr" && sub === "view") return true;
+  if (cmd === "api") {
+    const rest = args.slice(1);
+    if (rest.some((a) => /^(-X|--method|-f|--field|-F|--raw-field|--input)/.test(a))) return false;
+    const path2 = rest.find((a) => !a.startsWith("-"));
+    if (path2 === "user" || path2?.startsWith("user/") || path2?.startsWith("user?")) return false;
+    return true;
+  }
+  return false;
+}
 var JERV_HUB_REPO = "mutmutco/Jerv-Hub";
 function isHubControlRepo(repo) {
   return repo.toLowerCase() === HUB_REPO2.toLowerCase();
@@ -17716,10 +17692,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.110",
-    tag: "v4.5.110",
-    commit: "b27eb42f5d5e",
-    npm: "@mutmutco/cli@4.5.110"
+    version: "4.5.112",
+    tag: "v4.5.112",
+    commit: "45f0c868cba4",
+    npm: "@mutmutco/cli@4.5.112"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17736,14 +17712,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.110"
+          v3Target: "v4.5.112"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.110 and redeploy the Hub Lambda from tag v4.5.110 (b27eb42f5d5e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.110 (@mutmutco/cli@4.5.110, tag commit b27eb42f5d5e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.112 and redeploy the Hub Lambda from tag v4.5.112 (45f0c868cba4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.112 (@mutmutco/cli@4.5.112, tag commit 45f0c868cba4 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -23731,7 +23707,7 @@ function deriveReleasePhaseStatus(ledger) {
   return { phaseStatus: worst === 0 ? "phases-failed" : worst === 1 ? "phases-pending" : "phases-green", legs };
 }
 function safeRunAction(runId, runRepo, state) {
-  return state === "failed" ? `next: diagnose with gh run view ${runId} --repo ${runRepo} --log-failed; rerun by hand only when the cause is fixed: gh run rerun ${runId} --repo ${runRepo} --failed (never re-tag)` : `next: gh run watch ${runId} --repo ${runRepo} --exit-status --interval 30`;
+  return state === "failed" ? `next: diagnose with gh run view ${runId} --repo ${runRepo} --log-failed; rerun by hand only when the cause is fixed: gh run rerun ${runId} --repo ${runRepo} --failed (never re-tag)` : `next: gh run watch ${runId} --repo ${runRepo} --exit-status --interval 60`;
 }
 function formatReleaseLedgerReport(report) {
   const lines2 = [`release phase ledger${report.lane ? ` [${report.lane}]` : ""}: ${report.phaseStatus.toUpperCase()} (${report.path}) \u2014 phase status of the recorded boundaries, NOT the release verdict`];
@@ -24029,7 +24005,7 @@ async function transientRecoveryForFailedPhase(deps, input) {
     recovered: false,
     runId: candidate.runId,
     runRepo,
-    note: `the automatic rerun of ${failedRunIdentity(candidate, runRepo)} did not resolve within the bounded watch \u2014 typed PENDING (the one automatic rerun is spent); safe next action: gh run watch ${candidate.runId} --repo ${runRepo} --exit-status --interval 30`
+    note: `the automatic rerun of ${failedRunIdentity(candidate, runRepo)} did not resolve within the bounded watch \u2014 typed PENDING (the one automatic rerun is spent); safe next action: gh run watch ${candidate.runId} --repo ${runRepo} --exit-status --interval 60`
   };
 }
 async function transientRecoveryEnumerate(deps, repo, sha) {
@@ -31748,7 +31724,8 @@ function parseTenantTasksVar(raw) {
     if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
     if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
     if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
-    if (task.timeoutSeconds !== void 0 && (!Number.isInteger(task.timeoutSeconds) || task.timeoutSeconds < 1 || task.timeoutSeconds > 3600)) throw new Error(`org project set: tenantTasks.${name}.timeoutSeconds must be an integer 1..3600`);
+    const maxTimeout = task.secretOutput !== void 0 ? 3600 : 7200;
+    if (task.timeoutSeconds !== void 0 && (!Number.isInteger(task.timeoutSeconds) || task.timeoutSeconds < 1 || task.timeoutSeconds > maxTimeout)) throw new Error(`org project set: tenantTasks.${name}.timeoutSeconds must be an integer 1..${maxTimeout}`);
     const artifact = task.artifact ?? "none";
     if (artifact !== "none" && artifact !== "required") throw new Error(`org project set: tenantTasks.${name}.artifact must be none or required`);
     const carriesPlaceholder = task.command.some((arg) => arg.includes("{artifact}"));
@@ -39148,7 +39125,7 @@ async function updatePrHeadFromBase(input) {
   }
   throw new Error(`GitHub accepted the update of ${input.head} from ${input.base} but the head did not move \u2014 check the PR, then rerun`);
 }
-var PR_LAND_POLL_MS = 3e4;
+var PR_LAND_POLL_MS = 6e4;
 var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
 var PR_LAND_STATE_READ_RETRIES = 3;
 var PR_LAND_STATE_READ_DELAY_MS = 2e3;
@@ -46094,7 +46071,8 @@ ${list}`);
         }
         if (!repoFromGh || !base) {
           const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
-          const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
+          const readEnv = await ghReadEnv();
+          const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout.trim();
           [repoFromGh, base] = viewed.split(/\s+/);
         }
         const repo = repoOpt ?? repoFromGh;
@@ -46158,7 +46136,8 @@ ${list}`);
       },
       readPrState: async (prNumber, repo) => {
         const args = repo ? ["--repo", repo] : [];
-        const result2 = await readGhPrStateWithRetry(async () => (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS })).stdout);
+        const readEnv = await ghReadEnv();
+        const result2 = await readGhPrStateWithRetry(async () => (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout);
         if (!result2.ok) {
           if (isGitHubRateLimitError(result2.error)) return fetchRestPrLandState(prNumber, repo);
           throw new Error(`could not read PR state: ${result2.error}`);
@@ -46776,8 +46755,9 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      const readEnv = file === "gh" && isAppRoutableGhReadArgs(args) ? await ghReadEnv() : void 0;
       try {
-        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...readEnv ? { env: readEnv } : {} })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -46896,7 +46876,7 @@ function renderDeployLine(d) {
   else if (d.runUrl) parts.push(`run ${d.runUrl}`);
   if (d.deployStatus === "success") parts.push("deploy: SUCCEEDED");
   else if (d.deployStatus === "failure") parts.push(`deploy: FAILED (${TRAIN_DEPLOY_FAILED_NOTE})`);
-  else if (d.runId != null) parts.push(`deploy: UNVERIFIED \u2014 dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status --interval 30)`);
+  else if (d.runId != null) parts.push(`deploy: UNVERIFIED \u2014 dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status --interval 60)`);
   else if (d.workflowRuns?.length) parts.push("deploy: UNVERIFIED \u2014 the runs above are enumerated, not resolved; watch each to conclusion before calling this release healthy (#3322)");
   else parts.push("deploy: UNVERIFIED \u2014 no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
   return parts.join("; ");
@@ -47702,11 +47682,12 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
 init_github_client();
 var GH_TIMEOUT = 3e4;
 var WATCH_TIMEOUT = 25 * 6e4;
-async function exec(file, args, cwd, timeout = GH_TIMEOUT) {
-  return (await execFileP(file, args, { ...cwd ? { cwd } : {}, timeout })).stdout.trim();
+async function exec(file, args, cwd, timeout = GH_TIMEOUT, env) {
+  return (await execFileP(file, args, { ...cwd ? { cwd } : {}, timeout, ...env ? { env } : {} })).stdout.trim();
 }
 async function gh(args) {
-  return exec("gh", args);
+  const readEnv = isAppRoutableGhReadArgs(args) ? await ghReadEnv() : void 0;
+  return exec("gh", args, void 0, GH_TIMEOUT, readEnv ?? void 0);
 }
 function isMissingRef(message2) {
   return /404|Not Found|No commit found for SHA/.test(message2);
@@ -47930,7 +47911,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     }
     if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
     try {
-      await exec("gh", ["run", "watch", String(candidate.databaseId), "--repo", "mutmutco/MMI-Hub", "--exit-status"], void 0, WATCH_TIMEOUT);
+      await exec("gh", ghRunWatchArgs(candidate.databaseId, "mutmutco/MMI-Hub"), void 0, WATCH_TIMEOUT, await ghReadEnv() ?? void 0);
     } catch {
     }
     const verdict = JSON.parse(await gh(["run", "view", String(candidate.databaseId), "--repo", "mutmutco/MMI-Hub", "--json", "conclusion"]));
@@ -47962,7 +47943,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   };
   const rcRunCause = async (id) => {
     try {
-      return rcRunCauseFromLog(await exec("gh", ["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
+      return rcRunCauseFromLog(await gh(["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
     } catch {
       return "";
     }
@@ -55166,7 +55147,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..7200 (1..3600 with a secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.110",
+  "version": "4.5.112",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.110",
+  "version": "4.5.112",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",