@mutmutco/codex-plugin 4.5.150 → 4.5.152

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.150",
+  "version": "4.5.152",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -7152,7 +7152,7 @@ async function readAppVaultSecret(read) {
     if (/^(Hub GitHub App allowance used up|rate limited)/.test(reason)) {
       throw new AppActorError(`app actor: the vault could not read the App credentials because GitHub is rate-limited, not a denial: ${reason}`, "mint-failed");
     }
-    if (/^authority refused|\(HTTP 404\b/.test(reason)) return null;
+    if (/^authority refused|\(HTTP 40[14]\b/.test(reason)) return null;
     throw new AppActorError(`app actor: the vault read of the App credentials failed, not a denial: ${reason}`, "mint-failed");
   }
 }
@@ -7203,7 +7203,8 @@ async function mintInstallationToken(deps) {
   }
   return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
 }
-async function pollTokenOrUndefined(deps) {
+async function pollTokenOrUndefined(deps, env = process.env) {
+  if (env[APP_ACTOR_ENV]?.trim() === "personal") return void 0;
   try {
     return (await mintInstallationToken(deps)).token;
   } catch (e) {
@@ -7212,25 +7213,42 @@ async function pollTokenOrUndefined(deps) {
   }
 }
 var notedIneligibleCommand = false;
+var notedVaultDenied = false;
 async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
   activeQuotaScope = void 0;
   activeToken = void 0;
   const requested = (env[APP_ACTOR_ENV] ?? "").trim();
-  if (!requested) return "personal";
-  if (requested !== "app") {
-    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' is supported; refusing to guess an identity`);
+  if (requested === "personal") return "personal";
+  if (requested && requested !== "app") {
+    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' and 'personal' are supported; refusing to guess an identity`);
   }
   if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
-    if (!notedIneligibleCommand) {
+    if (requested === "app" && !notedIneligibleCommand) {
       notedIneligibleCommand = true;
       note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
     }
     return "personal";
   }
+  const personalGh = env.GH_TOKEN;
+  const personalGithub = env.GITHUB_TOKEN;
   delete env.GH_TOKEN;
   delete env.GITHUB_TOKEN;
-  const minted = await mint();
+  let minted;
+  try {
+    minted = await mint();
+  } catch (e) {
+    if (!requested && e instanceof AppActorError && e.code === "vault-denied") {
+      if (personalGh !== void 0) env.GH_TOKEN = personalGh;
+      if (personalGithub !== void 0) env.GITHUB_TOKEN = personalGithub;
+      if (!notedVaultDenied) {
+        notedVaultDenied = true;
+        note("app actor: vault denied App credentials \u2014 running on the personal token on this host");
+      }
+      return "personal";
+    }
+    throw e;
+  }
   env.GH_TOKEN = minted.token;
   activeQuotaScope = minted.quotaScope;
   activeToken = minted.token;
@@ -7741,7 +7759,7 @@ function setPollTokenProvider(provider) {
   observedPool.clear();
 }
 async function pollToken() {
-  if (!pollTokenProvider) return void 0;
+  if (process.env.MMI_ACTOR?.trim() === "personal" || !pollTokenProvider) return void 0;
   pollTokenOnce ??= pollTokenProvider().catch((e) => {
     if (e instanceof AppActorError && e.code === "mint-failed") throw e;
     return void 0;
@@ -17125,9 +17143,6 @@ function suiteModuleSeeds(seeds, suite, deployModel) {
     "module/.npmrc": "suite-npmrc.template",
     "module/src/module.jsx": "suite-module.template.jsx",
     "module/vite.config.mjs": "suite-vite.template.mjs",
-    "module/screens/screens.json": "suite-screens.template.json",
-    "module/screens/files.json": "suite-files.template.json",
-    ".github/workflows/screens.yml": "suite-screens.template.yml",
     "docs/Guides/mm-work-module.md": "suite-guide.template.md"
   };
   return [
@@ -18669,10 +18684,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.150",
-    tag: "v4.5.150",
-    commit: "4dc71e3761ec",
-    npm: "@mutmutco/cli@4.5.150"
+    version: "4.5.152",
+    tag: "v4.5.152",
+    commit: "8437cd11d3f1",
+    npm: "@mutmutco/cli@4.5.152"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18689,14 +18704,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.150"
+          v3Target: "v4.5.152"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.150 and redeploy the Hub Lambda from tag v4.5.150 (4dc71e3761ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.150 (@mutmutco/cli@4.5.150, tag commit 4dc71e3761ec \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.152 and redeploy the Hub Lambda from tag v4.5.152 (8437cd11d3f1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.152 (@mutmutco/cli@4.5.152, tag commit 8437cd11d3f1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22987,6 +23002,14 @@ async function runTenantControl(deps, options) {
       if (output) result.taskOutput = clampTaskOutput(output);
     }
   }
+  if (watch && runId != null && action === "run-task" && conclusion === "success") {
+    try {
+      const pages = JSON.parse(await deps.run("gh", ["api", `repos/${HUB_REPO2}/actions/runs/${runId}/artifacts`, "--paginate", "--slurp"]));
+      result.outputArtifacts = pages.flatMap((page) => page.artifacts ?? []).filter((a) => a.name.startsWith("task-output-") && Number.isSafeInteger(a.id) && a.id > 0).map((a) => ({ id: a.id, name: a.name, runId, downloadCommand: `MMI_ACTOR=app mmi-cli devops api get repos/${HUB_REPO2}/actions/artifacts/${a.id}/zip --out tmp/task-output-${runId}-${a.id}.zip` }));
+    } catch {
+      result.outputArtifactReadError = `Could not read output artifacts; retry with --resume ${runId} --watch (no re-dispatch)`;
+    }
+  }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
   if (conclusion === "pending" && runId != null && action === "run-task") {
     result.note += `; run ${runId} \u2014 resume without re-dispatching: mmi-cli devops runtime tenant control ${repo} ${stage} run-task --resume ${runId} --watch`;
@@ -23001,6 +23024,8 @@ function renderTenantControl(r) {
   if (r.secrets?.length) {
     for (const s of r.secrets) lines2.push(`  ${s.key}: ${s.status}`);
   }
+  for (const a of r.outputArtifacts ?? []) lines2.push(`  output artifact: ${a.name} (id ${a.id}, run ${a.runId})`, `  ${a.downloadCommand}`);
+  if (r.outputArtifactReadError) lines2.push(`  ${r.outputArtifactReadError}`);
   if (r.taskOutput) {
     lines2.push("  task output:");
     for (const l of r.taskOutput.split("\n")) lines2.push(`    ${l}`);
@@ -32901,7 +32926,7 @@ function parseTenantTasksVar(raw) {
     if (!nameRe.test(name)) throw new Error(`org project set: tenantTasks name ${JSON.stringify(name)} must be lowercase kebab-case`);
     if (!rawTask || typeof rawTask !== "object" || Array.isArray(rawTask)) throw new Error(`org project set: tenantTasks.${name} must be an object`);
     const task = rawTask;
-    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact", "secretOutput"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
+    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact", "output", "secretOutput"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
     if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
     if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
     if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
@@ -32911,12 +32936,16 @@ function parseTenantTasksVar(raw) {
     if (artifact !== "none" && artifact !== "required") throw new Error(`org project set: tenantTasks.${name}.artifact must be none or required`);
     const carriesPlaceholder = task.command.some((arg) => arg.includes("{artifact}"));
     if (artifact === "required" !== carriesPlaceholder) throw new Error(`org project set: tenantTasks.${name} must use {artifact} exactly when artifact is required`);
+    if (task.output !== void 0 && task.output !== "file") throw new Error(`org project set: tenantTasks.${name}.output must be file, use {output}, and cannot combine with secretOutput`);
+    const outputPlaceholder = task.command.some((arg) => arg.includes("{output}"));
+    if (task.output === "file" !== outputPlaceholder || task.output !== void 0 && task.secretOutput !== void 0) throw new Error(`org project set: tenantTasks.${name}.output must be file, use {output}, and cannot combine with secretOutput`);
     out[name] = {
       service: task.service,
       command: task.command,
       stages: task.stages,
       ...task.timeoutSeconds !== void 0 ? { timeoutSeconds: task.timeoutSeconds } : {},
       ...artifact !== "none" ? { artifact } : {},
+      ...task.output === "file" ? { output: "file" } : {},
       ...task.secretOutput !== void 0 ? { secretOutput: parseTenantTaskSecretOutput(task.secretOutput, `tenantTasks.${name}.secretOutput`) } : {}
     };
   }
@@ -32979,7 +33008,7 @@ var SETTABLE_VAR_HINTS = {
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
-  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
+  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",output?:"file",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
   internalPeers: "JSON {owner/repo:[dev|rc|main]} \u2014 same-box suite peers via the box Caddy; clear with --unset internalPeers (#7886)",
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
@@ -35655,8 +35684,8 @@ function suiteModulePackageAccessCheck(suite, deployModel) {
   if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
   return {
     ok: true,
-    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
-    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
+    label: "mmwork-ds package access (manual org-admin step; unverified)",
+    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build fails with 403 read_package."
   };
 }
 function attachTrainDoctorVerdicts(report, trainDoctors) {
@@ -40608,6 +40637,7 @@ var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
 var REC = "";
 var FLD = "";
+var GH_SQUASH_COAUTHORS_RE = /\r?\n(?:[ \t]*\r?\n)+---------\r?\n(?:[ \t]*\r?\n)+(?:Co-authored-by:[ \t]+\S[^\r\n]*(?:\r?\n|$))+[ \t\r\n]*$/i;
 var WAIVABLE_KINDS = [
   "mandatory-zone-untested",
   "unrequested-test-file",
@@ -40765,6 +40795,21 @@ function isShallowRepository(cwd) {
     return true;
   }
 }
+function readOverrideTrailer(trailer, body, cwd) {
+  const direct = (trailer ?? "").trim();
+  if (direct) return direct;
+  const raw = body ?? "";
+  const stripped = raw.replace(GH_SQUASH_COAUTHORS_RE, "\n");
+  if (stripped === raw) return "";
+  const prefix = `${TRAILER_KEY.toLowerCase()}:`;
+  return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    windowsHide: true,
+    cwd,
+    input: stripped,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024
+  }).split(/\r?\n/).filter((line) => line.trim().toLowerCase().startsWith(prefix)).map((line) => line.trim().slice(prefix.length).trim()).join("\n").trim();
+}
 function readOverride(base, cwd) {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
   const refusals = [];
@@ -40773,7 +40818,7 @@ function readOverride(base, cwd) {
     const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
     if (!sha) continue;
     if (override) break;
-    const value = (trailer ?? "").trim();
+    const value = readOverrideTrailer(trailer, body, cwd);
     if (!value) {
       const shaped = OVERRIDE_RE.exec(body ?? "");
       if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
@@ -53243,8 +53288,9 @@ async function runBrokerRestChecks(deps, spec, resolveRepo2) {
   return { rows: read.rows, state: read.state, exitCode: checkRowsExitCode(read.state) };
 }
 function requireBrokerApp(label) {
-  if (process.env.MMI_ACTOR !== "app") {
-    fail(`${label}: App-only read \u2014 re-run with spawn-scoped MMI_ACTOR=app (reads never fall back to personal; interactive use keeps gh and the human commands)`);
+  const actor = (process.env.MMI_ACTOR ?? "").trim();
+  if (actor && actor !== "app") {
+    fail(`${label}: App-only read \u2014 re-run with spawn-scoped MMI_ACTOR=app (explicit personal opt-out uses gh and the human commands instead)`);
   }
 }
 function registerPrChecksRequiredCommand(prRoot, resolveRepo2, overrides) {
@@ -53400,27 +53446,58 @@ var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FR
 var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
+var RUNS_QUERY_VALUE = {
+  per_page: /^(?:[1-9]\d?|100)$/,
+  page: /^[1-9]\d{0,5}$/,
+  status: /^[A-Za-z_]+$/,
+  branch: /^[A-Za-z0-9_.\/-]+$/,
+  event: /^[A-Za-z_]+$/,
+  head_sha: /^[0-9a-fA-F]{40}$/,
+  created: /^[0-9:TZ.<>=-]+$/,
+  actor: /^[A-Za-z0-9_.\[\]-]+$/
+};
+function validRunsQuery(query) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) return false;
+    const key = pair.slice(0, eq);
+    const value = pair.slice(eq + 1);
+    const re = Object.prototype.hasOwnProperty.call(RUNS_QUERY_VALUE, key) ? RUNS_QUERY_VALUE[key] : void 0;
+    if (!re || seen.has(key) || !re.test(value)) return false;
+    seen.add(key);
+  }
+  return true;
+}
+var JSON_MAX_BUFFER = 64 * 1024 * 1024;
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
 var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/attempts/\\d+)?/jobs$`);
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
+var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
+var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
+var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
+  const q = path2.indexOf("?");
+  const base = q === -1 ? path2 : path2.slice(0, q);
+  const query = q === -1 ? "" : path2.slice(q + 1);
   if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
-  if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
+  if (ACTIONS_RUNS_RE.test(base) && (q === -1 || validRunsQuery(query))) return { kind: "actions-runs", path: path2, paginate: false };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
   if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
   if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
   if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
-  const q = path2.indexOf("?");
-  const base = q === -1 ? path2 : path2.slice(0, q);
-  const query = q === -1 ? "" : path2.slice(q + 1);
+  if (RELEASE_LATEST_RE.test(path2)) return { kind: "release-latest", path: path2, paginate: false };
+  const tag = RELEASE_TAG_RE.exec(path2)?.[1];
+  if (tag && !tag.includes("..")) return { kind: "release-tag", path: path2, paginate: false };
+  if (RELEASE_ASSET_RE.test(path2)) return { kind: "release-asset", path: path2, paginate: false };
   if (CONTENTS_BASE_RE.test(base) && (query === "" || CONTENTS_QUERY_RE.test(query))) {
     return { kind: "contents", path: path2, paginate: false };
   }
@@ -53432,14 +53509,15 @@ function buildApiGetArgs(path2, accept) {
   const req = parseApiGetPath(path2);
   const args = ["api", req.path];
   if (req.paginate) args.push("--paginate");
-  const header = acceptHeaderFor(accept);
+  const requestedHeader = acceptHeaderFor(accept);
+  const header = req.kind === "release-asset" ? "application/octet-stream" : requestedHeader;
   if (header !== API_ACCEPT_HEADERS.json) args.push("-H", `Accept: ${header}`);
   return args;
 }
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
-var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout;
+var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : { maxBuffer: JSON_MAX_BUFFER }, ...env ? { env } : {} })).stdout;
 async function readAppApi(path2, runner = apiReadRunner) {
   const req = parseApiGetPath(path2);
   requireBrokerApp("read run log");
@@ -53449,16 +53527,16 @@ async function readAppApi(path2, runner = apiReadRunner) {
 }
 function registerApiReadCommands(program3, overrides) {
   const spawn6 = overrides?.runner ?? apiReadRunner;
-  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts)");
+  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts, releases)");
   api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
     acceptHeaderFor(v);
     return v.trim().toLowerCase();
-  }, "json").option("--out <file>", "write the response bytes to this file instead of stdout (required for, and only valid with, actions/artifacts/{id}/zip)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
-    const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs";
-    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs`);
-    const actionsRoute = req.kind.startsWith("actions-");
-    if (actionsRoute) requireBrokerApp("api get");
-    const env = actionsRoute || process.env.MMI_ACTOR === "app" ? brokerChildEnv() : void 0;
+  }, "json").option("--out <file>", "write response bytes to a file (required for, and only valid with, actions artifact zips, job logs, and release assets)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+    const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs" || req.kind === "release-asset";
+    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}`);
+    const appRoute = req.kind.startsWith("actions-") || req.kind.startsWith("release-");
+    if (appRoute) requireBrokerApp("api get");
+    const env = appRoute || process.env.MMI_ACTOR?.trim() !== "personal" ? brokerChildEnv() : void 0;
     let body;
     try {
       body = await runApiGet(
@@ -57166,7 +57244,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..10800 (1..3600 with a secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description('register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?,output?:"file"}; required artifact tasks must carry {artifact} in the command argv.').option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..10800 (1..3600 with a secretOutput)").option("--output <file>", "return {output} as a private 1-day Actions artifact (cannot combine with secretOutput)").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", 'full task object {service,command[],stages[],timeoutSeconds?,artifact?,output?:"file"} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -57191,7 +57269,8 @@ projectTenantTasks.command("declare <name>").description("register a NEW tenant
       command: o.command,
       stages: o.stages.split(",").map((s) => s.trim()).filter(Boolean),
       ...o.timeoutSeconds !== void 0 ? { timeoutSeconds: Number(o.timeoutSeconds) } : {},
-      ...o.artifact !== void 0 ? { artifact: o.artifact } : {}
+      ...o.artifact !== void 0 ? { artifact: o.artifact } : {},
+      ...o.output !== void 0 ? { output: o.output } : {}
     };
   }
   if (task && typeof task === "object" && task.secretOutput !== void 0) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.150",
+  "version": "4.5.152",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.150",
+  "version": "4.5.152",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -8,4 +8,4 @@ Before the first CI/deploy, an org admin must grant this repo **Read** on `@mutm
 
 The server exposes `/health` and `/module.js`. Register the module's bundle URL, id, name and capabilities with MM-Work following the GUIDE. The seed deliberately exposes no authenticated product API yet.
 
-`gate` installs and checks the backend and module. `screens / screens` follows MM-PM's non-blocking PR/push/tag shape, using MM-Work's reusable runner with `run: false` (browser audits are not merge gates). Configure scheduled/on-demand screen audits separately when the product has screens to audit.
+`gate` installs and checks the backend and module. Product repos carry no screenshot or browser tests (owner ruling 2026-10-15, MM-Work#5388).

package/skills/bootstrap/seeds/suite-module-package.template.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
-  "description": "MM-Work module screens",
+  "description": "MM-Work module",
   "scripts": {
     "lint": "mmwork-check-ui src",
     "build": "vite build",

package/skills/bootstrap/seeds/suite-files.template.json

@@ -1 +0,0 @@
-{ "result": { "items": [{ "id": "sample", "name": "Sample brief" }] } }

package/skills/bootstrap/seeds/suite-screens.template.json

@@ -1,170 +0,0 @@
-{
-  "module": {
-    "id": "{{REPO_SLUG}}",
-    "name": "{{REPO_NAME}}",
-    "glyph": "grid",
-    "tone": "blue",
-    "description": "Offline module screen check",
-    "sections": [
-      {
-        "label": "Home",
-        "path": "/"
-      },
-      {
-        "label": "Details",
-        "path": "/details"
-      }
-    ],
-    "help": {
-      "home": {
-        "name": "Example home",
-        "howTos": [
-          {
-            "id": "recent",
-            "title": "See recent files",
-            "intro": "The module counts the files you opened lately in Google Drive.",
-            "steps": [
-              {
-                "title": "Connect Drive",
-                "text": "Connect your Google account in Files to see your recent files.",
-                "scene": "connect"
-              },
-              {
-                "title": "Come back here",
-                "text": "The overview shows how many recent files MM-Work found."
-              }
-            ]
-          },
-          {
-            "id": "details",
-            "title": "Open the details page",
-            "steps": [
-              {
-                "title": "Press Open a page inside the module",
-                "text": "It is under the overview. Details is also in the section row.",
-                "scene": "screen"
-              },
-              {
-                "title": "Go back",
-                "text": "Press Home in the section row."
-              }
-            ]
-          }
-        ],
-        "faq": [
-          {
-            "id": "drive",
-            "question": "Where are my files?",
-            "answer": "Recent files come from your connected Google Drive."
-          },
-          {
-            "id": "job",
-            "question": "What is the Review files job?",
-            "answer": "A job your admin can give you. The overview says whether you hold it."
-          },
-          {
-            "id": "access",
-            "question": "Does this module get my Google password?",
-            "answer": "No. It asks MM-Work for your files, and MM-Work uses the access you granted it."
-          }
-        ],
-        "tour": [
-          {
-            "anchor": "example-intro",
-            "title": "What this is",
-            "text": "A module's own screen, drawn with MM-Work's design system."
-          },
-          {
-            "anchor": "example-overview",
-            "title": "Your overview",
-            "text": "See your workspace and recent Drive files here."
-          },
-          {
-            "anchor": "example-actions",
-            "title": "Where to go next",
-            "text": "Open the details page, or go to Files."
-          }
-        ]
-      }
-    },
-    "privacy": [
-      {
-        "class": "company-visible",
-        "what": {
-          "en": "The example reads recent Google Drive file metadata through MM-Work after the person connects Files.",
-          "tr": "Örnek modül, kişi Files bağlantısını kurduktan sonra MM-Work üzerinden son Google Drive dosyalarının meta verilerini okur."
-        },
-        "who": {
-          "en": "The signed-in person sees the count on this example screen; no file content is saved by the example.",
-          "tr": "Oturum açmış kişi örnek ekranda sayıyı görür; örnek modül dosya içeriğini kaydetmez."
-        },
-        "evidence": [
-          "repo:MM-Work:examples/example-module/src/module.jsx"
-        ]
-      }
-    ]
-  },
-  "screens": [
-    {
-      "name": "home",
-      "path": "/m/example",
-      "jobs": [
-        "files.review"
-      ],
-      "routes": {
-        "POST /api/actions/files.list": "files.json"
-      }
-    },
-    {
-      "name": "open details journey",
-      "path": "/m/example",
-      "steps": [
-        {
-          "assert": {
-            "selector": "[data-tour=example-actions] button",
-            "count": 2
-          }
-        },
-        {
-          "click": "[data-tour=example-actions] button:first-child"
-        },
-        {
-          "assert": {
-            "url": "/m/example/details"
-          }
-        }
-      ],
-      "routes": {
-        "POST /api/actions/files.list": "files.json"
-      }
-    },
-    {
-      "name": "details",
-      "path": "/m/example/details",
-      "routes": {
-        "POST /api/actions/files.list": "files.json"
-      }
-    },
-    {
-      "name": "loading",
-      "path": "/m/example",
-      "query": "state=loading",
-      "routes": {
-        "POST /api/actions/files.list": "pending"
-      }
-    },
-    {
-      "name": "error",
-      "path": "/m/example",
-      "query": "state=error",
-      "routes": {
-        "POST /api/actions/files.list": {
-          "status": 500,
-          "body": {
-            "error": "offline failure"
-          }
-        }
-      }
-    }
-  ]
-}

package/skills/bootstrap/seeds/suite-screens.template.yml

@@ -1,63 +0,0 @@
-name: screens
-# A required check (#250): it runs wherever gate runs, so no PR into development, rc or main and no train tag
-# waits on a context that never reports.
-on:
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  push:
-    branches: {{GATE_PUSH_BRANCHES_YAML}}
-    tags: ['v*']
-# Cancel superseded runs per PR, or per branch for pushes (MMI-Hub#7515, #3001; as MM-Strategy#415).
-concurrency:
-  group: screens-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-  packages: read
-  pull-requests: read
-jobs:
-  # Owner ruling (#474, 6 Oct 2026): browser checks block nothing, releases included. Every PR, push and tag
-  # reports this required context without a browser audit (run: false); screens-sweep.yml audits nightly and
-  # on demand (issue-on-red). A development push still reports
-  # the required "screens / screens" on the SHA, which the dev deploy needs (MMI-Hub dev-auto-deploy).
-  changes:
-    runs-on: [self-hosted, linux, x64, mmi-live]
-    outputs:
-      run: ${{ steps.pick.outputs.run }}
-      full: ${{ steps.pick.outputs.full }}
-    steps:
-      - id: pick
-        env:
-          GH_TOKEN: ${{ github.token }}
-          EVENT: ${{ github.event_name }}
-          BASE: ${{ github.base_ref }}
-          REF: ${{ github.ref_name }}
-          REF_TYPE: ${{ github.ref_type }}
-          PR: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          # #474: no browser audit on any PR, push or tag; screens-sweep.yml runs it nightly.
-          run=false; full=false
-          echo "run=$run full=$full"
-          { echo "run=$run"; echo "full=$full"; } >> "$GITHUB_OUTPUT"
-  screens:
-    needs: changes
-    # Fail closed (MMI-Hub, 6 Oct): a SKIPPED required check counts as passing, so this job runs even when
-    # `changes` failed, and a missing answer means the full audit, never a skip.
-    if: ${{ !cancelled() }}
-    uses: mutmutco/MM-Work/.github/workflows/module-screens.yml@development
-    with:
-      run: ${{ needs.changes.outputs.run != 'false' }}
-      audit-sizes: ${{ needs.changes.outputs.full != 'false' && '["phone","768","1024","1280"]' || '["phone"]' }}
-      # Pinned to the shell built from the kit this module ships (ds-v0.71.42): the runner MM-Work
-      # published with that kit; bump with the kit.
-      # 0.1.55+ checks MM-Work #1575: selectedStyle, pageBackground, noJump (#418).
-      screens-version: '0.1.113'
-      working-directory: 'module'
-      build-command: 'npm run build'
-      bundle-path: 'dist/module.js'
-      fixtures-path: 'screens/screens.json'
-      # Every screen in English and Turkish (#369): Turkish words run longer, so they get their own audit.
-      languages: 'en,tr'