@mutmutco/codex-plugin 4.5.153 → 4.5.154

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.153",
+  "version": "4.5.154",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -7163,6 +7163,27 @@ async function readAppVaultSecret(read) {
   }
 }
 async function mintInstallationToken(deps) {
+  return mintScopedInstallationToken(deps, APP_POLL_PERMISSIONS);
+}
+async function mintStatusWriteToken(deps) {
+  return mintScopedInstallationToken(deps, { metadata: "read", statuses: "write" });
+}
+var statusWriteTokenProvider;
+function setStatusWriteTokenProvider(provider) {
+  statusWriteTokenProvider = provider;
+}
+async function fleetStatusWriteEnv(args) {
+  if (args[0] !== "api" || args[1] !== "-X" || args[2] !== "POST" || !/^repos\/[^/]+\/[^/]+\/statuses\/[^/]+$/.test(args[3] ?? "") || !args.some((arg, i) => arg === "context=fleet-lockstep" && args[i - 1] === "-f")) return void 0;
+  if (!statusWriteTokenProvider) throw new AppActorError("app actor: status-write provider not installed");
+  try {
+    const { token } = await statusWriteTokenProvider();
+    return { ...process.env, GH_TOKEN: token };
+  } catch (e) {
+    if (e instanceof AppActorError && e.code === "vault-denied") return void 0;
+    throw e;
+  }
+}
+async function mintScopedInstallationToken(deps, permissions) {
   const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
     const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
@@ -7189,7 +7210,7 @@ async function mintInstallationToken(deps) {
         "content-type": "application/json",
         "user-agent": "mmi-cli-app-actor"
       },
-      body: JSON.stringify({ permissions: APP_POLL_PERMISSIONS })
+      body: JSON.stringify({ permissions })
     });
   } catch (e) {
     if (e instanceof AppActorError) throw e;
@@ -18720,10 +18741,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.153",
-    tag: "v4.5.153",
-    commit: "57b23d8d7d5f",
-    npm: "@mutmutco/cli@4.5.153"
+    version: "4.5.154",
+    tag: "v4.5.154",
+    commit: "045e47363357",
+    npm: "@mutmutco/cli@4.5.154"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18740,14 +18761,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.153"
+          v3Target: "v4.5.154"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.153 and redeploy the Hub Lambda from tag v4.5.153 (57b23d8d7d5f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.153 (@mutmutco/cli@4.5.153, tag commit 57b23d8d7d5f \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.154 and redeploy the Hub Lambda from tag v4.5.154 (045e47363357); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.154 (@mutmutco/cli@4.5.154, tag commit 045e47363357 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19682,9 +19703,12 @@ async function resolveBoardProjectId(repoOption) {
     return void 0;
   }
 }
-function queryDeps() {
+function queryDeps(readEnv) {
   return {
-    ghJson: async (args, timeoutMs = GH_LIST_TIMEOUT_MS) => JSON.parse((await execFileP("gh", args, { timeout: timeoutMs })).stdout),
+    ghJson: async (args, timeoutMs = GH_LIST_TIMEOUT_MS) => {
+      const env = await readEnv?.();
+      return JSON.parse((await execFileP("gh", args, { timeout: timeoutMs, ...env ? { env } : {} })).stdout);
+    },
     viewer: () => githubLogin(),
     resolveRepo
   };
@@ -20070,7 +20094,8 @@ function defaultFleetTrackInventoryDeps(consistent = false) {
       if (!projects) throw new Error("live Hub registry roster is unavailable \u2014 a committed inventory is never current truth, so there is no fallback; retry when the Hub API is reachable");
       return projects;
     },
-    query: queryDeps(),
+    // #8350: gate inventory probes bypass the train runner, so supply its App read env here too.
+    query: queryDeps(ghReadEnv),
     now: () => /* @__PURE__ */ new Date()
   };
 }
@@ -48186,7 +48211,7 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      const readEnv = file === "gh" && isAppRoutableGhReadArgs(args) ? await ghReadEnv() : void 0;
+      const readEnv = file !== "gh" ? void 0 : isAppRoutableGhReadArgs(args) ? await ghReadEnv() : await fleetStatusWriteEnv(args);
       try {
         return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...readEnv ? { env: readEnv } : {} })).stdout;
       } catch (e) {
@@ -56751,6 +56776,7 @@ function appActorDeps() {
   };
 }
 setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appActorDeps()));
+setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
   const commandPath3 = commandPathOf(actionCommand);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.153",
+  "version": "4.5.154",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.153",
+  "version": "4.5.154",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",