@mutmutco/codex-plugin 4.5.111 → 4.5.112

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.111",
+  "version": "4.5.112",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -5851,42 +5851,11 @@ async function mintInstallationToken(deps) {
 async function pollTokenOrUndefined(deps) {
   try {
     return (await mintInstallationToken(deps)).token;
-  } catch {
+  } catch (e) {
+    if (e instanceof AppActorError && e.code === "mint-failed") throw e;
     return void 0;
   }
 }
-var APP_POLL_HEADROOM_FRACTION = 0.4;
-var APP_POLL_RESET_DEFAULT_MS = 36e5;
-var appPollGuardState = {};
-function appPollGuardSnapshot() {
-  return { ...appPollGuardState };
-}
-function appPollAllowsApp(nowMs) {
-  if (appPollGuardState.fallbackUntilMs !== void 0) {
-    if (nowMs < appPollGuardState.fallbackUntilMs) return false;
-    appPollGuardState = {};
-  }
-  const { remaining, limit } = appPollGuardState;
-  if (remaining === void 0 || limit === void 0 || limit <= 0) return true;
-  return remaining / limit >= APP_POLL_HEADROOM_FRACTION;
-}
-function latchAppPollFallback(nowMs) {
-  appPollGuardState.fallbackUntilMs = appPollGuardState.resetAtMs ?? nowMs + APP_POLL_RESET_DEFAULT_MS;
-}
-function noteAppPollResponse(headers, rateLimited, nowMs) {
-  if (headers.remaining !== void 0) appPollGuardState.remaining = headers.remaining;
-  if (headers.limit !== void 0) appPollGuardState.limit = headers.limit;
-  if (headers.resetSec !== void 0 && headers.resetSec > 0) appPollGuardState.resetAtMs = headers.resetSec * 1e3;
-  const { remaining, limit } = appPollGuardState;
-  const belowFloor = !rateLimited && remaining !== void 0 && limit !== void 0 && limit > 0 && remaining / limit < APP_POLL_HEADROOM_FRACTION;
-  const headroomUnverifiable = !rateLimited && (headers.remaining === void 0 || headers.limit === void 0);
-  if (rateLimited || belowFloor || headroomUnverifiable && appPollGuardState.resetAtMs !== void 0) {
-    latchAppPollFallback(nowMs);
-  }
-}
-function resetAppPollGuard() {
-  appPollGuardState = {};
-}
 var notedIneligibleCommand = false;
 async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
@@ -6324,15 +6293,21 @@ function lastRestPollSource() {
 function setPollTokenProvider(provider) {
   pollTokenProvider = provider;
   pollTokenOnce = void 0;
-  resetAppPollGuard();
   lastPollSource = void 0;
   observedPool.clear();
 }
 async function pollToken() {
   if (!pollTokenProvider) return void 0;
-  pollTokenOnce ??= pollTokenProvider().catch(() => void 0);
+  pollTokenOnce ??= pollTokenProvider().catch((e) => {
+    if (e instanceof AppActorError && e.code === "mint-failed") throw e;
+    return void 0;
+  });
   return pollTokenOnce;
 }
+async function ghReadEnv() {
+  const appToken = await pollToken();
+  return appToken ? { ...process.env, GH_TOKEN: appToken } : void 0;
+}
 var INCLUDED_HEADER_BLOCK = /^(?:\r?\n)?HTTP\/\d(?:\.\d)? (\d{3})[^\n]*\n(?:[^\n]+\n)*?\r?\n/gm;
 function parseIncludedOutput(out) {
   let status;
@@ -6373,11 +6348,6 @@ function describeRefusal(out) {
   return [parts.join(" "), text ? `"${text}"` : ""].filter(Boolean).join(" ") || "no rate-limit headers or message";
 }
 var etagCache = /* @__PURE__ */ new Map();
-function appPoolDetail() {
-  const guard = appPollGuardSnapshot();
-  const counts = guard.remaining !== void 0 && guard.limit !== void 0 ? `App pool at ${guard.remaining}/${guard.limit}` : "App pool headroom unverified";
-  return guard.resetAtMs !== void 0 ? `${counts}, resets ${new Date(guard.resetAtMs).toISOString()}` : counts;
-}
 var observedPool = /* @__PURE__ */ new Map();
 var OBSERVED_POOL_MAX_AGE_MS = 3 * 6e4;
 function notePoolHeaders(source, out, nowMs) {
@@ -6393,59 +6363,46 @@ function observedCorePool(source, nowMs) {
 }
 async function defaultGhApi(args) {
   const appToken = await pollToken();
-  let source = appToken && appPollAllowsApp(Date.now()) ? "app" : "user";
-  if (lastPollSource !== void 0 && lastPollSource !== source) {
-    console.warn(source === "user" ? `poll credential: ${appPoolDetail()} \u2014 below the ${APP_POLL_HEADROOM_FRACTION * 100}% App-poll headroom floor (#7843); REST poll reads switch to the ambient user token until the App pool resets` : "poll credential: App pool reset passed \u2014 REST poll reads return to the App installation token (#7843)");
-  }
-  for (; ; ) {
-    const key = `${source}\0${args.join("\0")}`;
-    const cached = etagCache.get(key);
-    let stdout;
-    try {
-      ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
-        timeout: REST_GH_TIMEOUT_MS,
-        // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
-        // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
-        ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
-      }));
-    } catch (e) {
-      const out = e.stdout;
-      const errOut = typeof out === "string" ? out : void 0;
-      const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
-      if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
-      if (cached && status === 304) {
-        lastPollSource = source;
-        return cached.body;
-      }
-      if (source === "app" && appToken && status === 403 && /Resource not accessible by integration/i.test(describeRefusal(errOut))) {
-        console.warn(`poll credential: App token lacks permission for this read (HTTP 403, response: ${describeRefusal(errOut)}) \u2014 this read uses the ambient user token; the App pool stays in use (#7978)`);
-        try {
-          const { stdout: userOut } = await execFileP("gh", ["api", "--include", ...args], { timeout: REST_GH_TIMEOUT_MS });
-          notePoolHeaders("user", userOut, Date.now());
-          return parseIncludedOutput(userOut).body;
-        } catch (userErr) {
-          const uo = userErr.stdout;
-          if (typeof uo === "string") notePoolHeaders("user", uo, Date.now());
-          throw userErr;
-        }
-      }
-      if (source === "app" && appToken && (status === 403 || status === 429)) {
-        noteAppPollResponse(parseRateLimitHeaders(errOut), true, Date.now());
-        console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}; response: ${describeRefusal(errOut)}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
-        lastPollSource = "user";
-        source = "user";
-        continue;
+  const source = appToken ? "app" : "user";
+  const key = `${source}\0${args.join("\0")}`;
+  const cached = etagCache.get(key);
+  let stdout;
+  try {
+    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+      timeout: REST_GH_TIMEOUT_MS,
+      // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
+      // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
+      ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
+    }));
+  } catch (e) {
+    const out = e.stdout;
+    const errOut = typeof out === "string" ? out : void 0;
+    const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+    if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
+    if (cached && status === 304) {
+      lastPollSource = source;
+      return cached.body;
+    }
+    if (status === 403 || status === 429) {
+      const path2 = args.filter((a) => !a.startsWith("-")).join(" ") || args.join(" ");
+      const refusal = errOut !== void 0 ? describeRefusal(errOut) : "no rate-limit headers or message";
+      if (status === 403 && /Resource not accessible by integration/i.test(refusal)) {
+        throw new Error(
+          `poll read refused: App token lacks permission for ${path2} (HTTP 403, response: ${refusal}) \u2014 reads never fall back to the owner's token (#8030); add the permission to APP_POLL_PERMISSIONS / the App installation`
+        );
       }
-      throw e;
+      throw Object.assign(new Error(
+        `poll read refused on the ${source} pool (HTTP ${status}, response: ${refusal}) \u2014 reads stay on the ${source === "app" ? "App" : "ambient identity"} (#8030); the wait re-arms after reset`
+      ), { status, stdout: errOut, stderr: e.stderr });
     }
-    const { body, etag, pages } = parseIncludedOutput(stdout);
-    notePoolHeaders(source, stdout, Date.now());
-    if (source === "app") noteAppPollResponse(parseRateLimitHeaders(stdout), false, Date.now());
-    lastPollSource = source;
-    if (etag && pages === 1) etagCache.set(key, { etag, body });
-    else etagCache.delete(key);
-    return body;
+    throw e;
   }
+  const { body, etag, pages } = parseIncludedOutput(stdout);
+  notePoolHeaders(source, stdout, Date.now());
+  lastPollSource = source;
+  if (etag && pages === 1) etagCache.set(key, { etag, body });
+  else etagCache.delete(key);
+  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -6913,7 +6870,7 @@ async function fetchRequiredCheckContexts(repo, branch, gh2 = defaultGhApi) {
   return contexts;
 }
 async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
-  const seen = gh2 === defaultGhApi ? observedCorePool(await pollToken() && appPollAllowsApp(nowMs) ? "app" : "user", nowMs) : void 0;
+  const seen = gh2 === defaultGhApi ? observedCorePool(await pollToken() ? "app" : "user", nowMs) : void 0;
   if (seen) return { state: "ok", ...seen };
   let core;
   try {
@@ -6939,7 +6896,12 @@ function withAppClaimMarkerRead(client, appClient) {
         return await client.restPaginate(path2, init);
       } catch (e) {
         if (!commentsPath.test(path2) || !(e instanceof GitHubApiError) || e.status !== 429 && (e.status !== 403 || !isRateLimitRefusal(e))) throw e;
-        const token = appClient ? void 0 : await pollToken();
+        let token;
+        try {
+          token = appClient ? void 0 : await pollToken();
+        } catch {
+          throw e;
+        }
         if (!appClient && !token) throw e;
         return (appClient ?? createGitHubClient({ token: async () => token })).restPaginate(path2, init);
       }
@@ -16930,6 +16892,20 @@ var GH_RUN_WATCH_INTERVAL_S = 60;
 function ghRunWatchArgs(runId, repo) {
   return ["run", "watch", String(runId), "--repo", repo, "--exit-status", "--interval", String(GH_RUN_WATCH_INTERVAL_S)];
 }
+function isAppRoutableGhReadArgs(args) {
+  if (args.some((a) => a === "--mine" || a === "viewer" || a.includes("@me"))) return false;
+  const [cmd, sub] = args;
+  if (cmd === "run" && (sub === "view" || sub === "list" || sub === "watch")) return true;
+  if (cmd === "pr" && sub === "view") return true;
+  if (cmd === "api") {
+    const rest = args.slice(1);
+    if (rest.some((a) => /^(-X|--method|-f|--field|-F|--raw-field|--input)/.test(a))) return false;
+    const path2 = rest.find((a) => !a.startsWith("-"));
+    if (path2 === "user" || path2?.startsWith("user/") || path2?.startsWith("user?")) return false;
+    return true;
+  }
+  return false;
+}
 var JERV_HUB_REPO = "mutmutco/Jerv-Hub";
 function isHubControlRepo(repo) {
   return repo.toLowerCase() === HUB_REPO2.toLowerCase();
@@ -17716,10 +17692,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.111",
-    tag: "v4.5.111",
-    commit: "7794d236f8bd",
-    npm: "@mutmutco/cli@4.5.111"
+    version: "4.5.112",
+    tag: "v4.5.112",
+    commit: "45f0c868cba4",
+    npm: "@mutmutco/cli@4.5.112"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17736,14 +17712,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.111"
+          v3Target: "v4.5.112"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.111 and redeploy the Hub Lambda from tag v4.5.111 (7794d236f8bd); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.111 (@mutmutco/cli@4.5.111, tag commit 7794d236f8bd \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.112 and redeploy the Hub Lambda from tag v4.5.112 (45f0c868cba4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.112 (@mutmutco/cli@4.5.112, tag commit 45f0c868cba4 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -46095,7 +46071,8 @@ ${list}`);
         }
         if (!repoFromGh || !base) {
           const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
-          const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
+          const readEnv = await ghReadEnv();
+          const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout.trim();
           [repoFromGh, base] = viewed.split(/\s+/);
         }
         const repo = repoOpt ?? repoFromGh;
@@ -46159,7 +46136,8 @@ ${list}`);
       },
       readPrState: async (prNumber, repo) => {
         const args = repo ? ["--repo", repo] : [];
-        const result2 = await readGhPrStateWithRetry(async () => (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS })).stdout);
+        const readEnv = await ghReadEnv();
+        const result2 = await readGhPrStateWithRetry(async () => (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout);
         if (!result2.ok) {
           if (isGitHubRateLimitError(result2.error)) return fetchRestPrLandState(prNumber, repo);
           throw new Error(`could not read PR state: ${result2.error}`);
@@ -46777,8 +46755,9 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      const readEnv = file === "gh" && isAppRoutableGhReadArgs(args) ? await ghReadEnv() : void 0;
       try {
-        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...readEnv ? { env: readEnv } : {} })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -47703,11 +47682,12 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
 init_github_client();
 var GH_TIMEOUT = 3e4;
 var WATCH_TIMEOUT = 25 * 6e4;
-async function exec(file, args, cwd, timeout = GH_TIMEOUT) {
-  return (await execFileP(file, args, { ...cwd ? { cwd } : {}, timeout })).stdout.trim();
+async function exec(file, args, cwd, timeout = GH_TIMEOUT, env) {
+  return (await execFileP(file, args, { ...cwd ? { cwd } : {}, timeout, ...env ? { env } : {} })).stdout.trim();
 }
 async function gh(args) {
-  return exec("gh", args);
+  const readEnv = isAppRoutableGhReadArgs(args) ? await ghReadEnv() : void 0;
+  return exec("gh", args, void 0, GH_TIMEOUT, readEnv ?? void 0);
 }
 function isMissingRef(message2) {
   return /404|Not Found|No commit found for SHA/.test(message2);
@@ -47931,7 +47911,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     }
     if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
     try {
-      await exec("gh", ghRunWatchArgs(candidate.databaseId, "mutmutco/MMI-Hub"), void 0, WATCH_TIMEOUT);
+      await exec("gh", ghRunWatchArgs(candidate.databaseId, "mutmutco/MMI-Hub"), void 0, WATCH_TIMEOUT, await ghReadEnv() ?? void 0);
     } catch {
     }
     const verdict = JSON.parse(await gh(["run", "view", String(candidate.databaseId), "--repo", "mutmutco/MMI-Hub", "--json", "conclusion"]));
@@ -47963,7 +47943,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   };
   const rcRunCause = async (id) => {
     try {
-      return rcRunCauseFromLog(await exec("gh", ["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
+      return rcRunCauseFromLog(await gh(["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
     } catch {
       return "";
     }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.111",
+  "version": "4.5.112",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.111",
+  "version": "4.5.112",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",