@mutmutco/codex-plugin 4.5.141 → 4.5.143

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.141",
+  "version": "4.5.143",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -18277,10 +18277,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.141",
-    tag: "v4.5.141",
-    commit: "ade3705c0828",
-    npm: "@mutmutco/cli@4.5.141"
+    version: "4.5.143",
+    tag: "v4.5.143",
+    commit: "6bf9c07e6831",
+    npm: "@mutmutco/cli@4.5.143"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18297,14 +18297,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.141"
+          v3Target: "v4.5.143"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.141 and redeploy the Hub Lambda from tag v4.5.141 (ade3705c0828); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.141 (@mutmutco/cli@4.5.141, tag commit ade3705c0828 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.143 and redeploy the Hub Lambda from tag v4.5.143 (6bf9c07e6831); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.143 (@mutmutco/cli@4.5.143, tag commit 6bf9c07e6831 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31892,6 +31892,7 @@ var import_node_path28 = require("node:path");
 var import_node_crypto10 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
+var sshdPost = (dest) => `if sshd -t; then systemctl reload ssh; else rm -f ${dest}; echo 'sshd -t rejected ${dest}: removed, not reloaded' >&2; exit 1; fi`;
 function parseManifest(text) {
   const raw = JSON.parse(text);
   if (!Array.isArray(raw.files)) throw new Error('box control manifest: "files" must be an array');
@@ -31905,9 +31906,10 @@ function parseManifest(text) {
     if (f.lanes !== void 0) targets.push(...expandLanes(f.lanes, where));
     if (!targets.length) throw new Error(`${where} (${f.src}): needs targets or lanes`);
     const ownSysctl = typeof f.post === "string" && /^sysctl -p (\/etc\/sysctl\.d\/[A-Za-z0-9._-]+\.conf)$/.exec(f.post);
-    const postOk = f.post === void 0 || typeof f.post === "string" && ALLOWED_POST.has(f.post) || !!ownSysctl && targets.every((t) => t.dest === ownSysctl[1]);
+    const sshdDest = /^\/etc\/ssh\/sshd_config\.d\/[A-Za-z0-9._-]+\.conf$/.test(targets[0].dest) && targets.every((t) => t.dest === targets[0].dest) ? targets[0].dest : "";
+    const postOk = f.post === void 0 || typeof f.post === "string" && ALLOWED_POST.has(f.post) || !!ownSysctl && targets.every((t) => t.dest === ownSysctl[1]) || !!sshdDest && f.post === sshdPost(sshdDest);
     if (!postOk) {
-      throw new Error(`${where} (${f.src}): post must be one of ${[...ALLOWED_POST].join(", ")}, or \`sysctl -p <its own /etc/sysctl.d dest>\``);
+      throw new Error(`${where} (${f.src}): post must be one of ${[...ALLOWED_POST].join(", ")}, \`sysctl -p <its own /etc/sysctl.d dest>\`, or the sshd post for its own drop-in`);
     }
     for (const t of targets) {
       if (typeof t.box !== "string" || !/^[a-z0-9-]+$/.test(t.box)) throw new Error(`${where} (${f.src}): bad box name`);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.141",
+  "version": "4.5.143",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.141",
+  "version": "4.5.143",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",