@mutmutco/codex-plugin 4.5.157 → 4.5.159

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.157",
+  "version": "4.5.159",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -7068,6 +7068,8 @@ var import_node_crypto5 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
+var APP2_VAULT_KEYS = ["GITHUB_APP2_ID", "GITHUB_APP2_INSTALLATION_ID", "GITHUB_APP2_PRIVATE_KEY"];
+var APP_POOL_MEMBERS = [APP_VAULT_KEYS, APP2_VAULT_KEYS];
 var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "pr checks-wait",
   // #8042: App-native required-only read (`pr checks-required`) — REST check/status rows scoped by
@@ -7184,10 +7186,52 @@ async function fleetStatusWriteEnv(args) {
   }
 }
 async function mintScopedInstallationToken(deps, permissions) {
-  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
+  const start = Math.floor((deps.random ?? Math.random)() * APP_POOL_MEMBERS.length) % APP_POOL_MEMBERS.length;
+  const order = APP_POOL_MEMBERS.map((_, i) => APP_POOL_MEMBERS[(start + i) % APP_POOL_MEMBERS.length]);
+  let firstError;
+  let exhausted;
+  let absent = 0;
+  for (const [i, keys] of order.entries()) {
+    try {
+      const minted = await mintFromMember(deps, permissions, keys);
+      if (i === order.length - 1 || !await allowanceSpent(deps, minted.token)) return minted;
+      exhausted ??= minted;
+    } catch (e) {
+      if (e instanceof AppActorError && e.code === "vault-denied") {
+        absent += 1;
+        continue;
+      }
+      firstError ??= e;
+    }
+  }
+  if (exhausted) return exhausted;
+  if (firstError) throw firstError;
+  if (absent === order.length) {
+    throw new AppActorError(
+      `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
+      "vault-denied"
+    );
+  }
+  throw new AppActorError("app actor: no App pool member minted \u2014 automation fails closed");
+}
+async function allowanceSpent(deps, token) {
+  try {
+    const res = await deps.fetch("https://api.github.com/rate_limit", {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "mmi-cli-app-actor" }
+    });
+    if (!res.ok) return false;
+    const body = await res.json();
+    return body.resources?.core?.remaining === 0 || body.resources?.graphql?.remaining === 0;
+  } catch {
+    return false;
+  }
+}
+async function mintFromMember(deps, permissions, keys) {
+  const [appId, installationId, privateKey] = await Promise.all(keys.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
-    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
-    if (missing.length === APP_VAULT_KEYS.length) {
+    const missing = keys.filter((_, i) => ![appId, installationId, privateKey][i]);
+    if (missing.length === keys.length) {
       throw new AppActorError(
         `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
         "vault-denied"
@@ -16372,6 +16416,38 @@ function checkRunbookCoverage(docs, base, git3) {
   }
   return findings;
 }
+function checkSeedRunbookReview(root, base, readFile10, git3) {
+  const manifestJson = readFile10((0, import_node_path15.join)(root, "skills/bootstrap/seeds/manifest.json"));
+  if (!manifestJson) return [];
+  const changed = new Set(git3(["diff", "--name-only", `${base}...HEAD`]).split(/\r?\n/).filter(Boolean));
+  const touched = loadBootstrapSeeds(manifestJson).seeds.filter((seed) => isPropagatableSeed(seed) && changed.has(seedSourcePath(seed)));
+  if (!touched.length) return [];
+  let declarations = null;
+  try {
+    declarations = JSON.parse(readFile10((0, import_node_path15.join)(root, RUNBOOK_UNAFFECTED_PATH)) ?? "null");
+  } catch {
+    declarations = null;
+  }
+  const findings = [];
+  for (const seed of touched) {
+    const source = seedSourcePath(seed);
+    let blob;
+    try {
+      blob = git3(["rev-parse", `HEAD:${source}`]).trim();
+    } catch {
+      continue;
+    }
+    if (!runbookUnaffectedReason(declarations, seed.target, blob)) {
+      findings.push({
+        kind: "seed-runbook-unreviewed",
+        doc: source,
+        line: 0,
+        detail: `${seed.target} (source blob ${blob}): propagatable seed changed without a runbook impact decision; add "${seed.target}": { "blob": "${blob}", "reason": "<why>" } to ${RUNBOOK_UNAFFECTED_PATH} or declare Seed-Runbook-Affected: <reason> in a commit message`
+      });
+    }
+  }
+  return findings;
+}
 function readFileOrNull(path2) {
   return (0, import_node_fs17.existsSync)(path2) ? (0, import_node_fs17.readFileSync)(path2, "utf8") : null;
 }
@@ -16505,11 +16581,14 @@ function runDocRefs(root, deps = {}) {
   if (deps.base) {
     const git3 = deps.git ?? ((args) => (0, import_node_child_process6.execFileSync)("git", args, { cwd: root, encoding: "utf8", maxBuffer: CHECK_IGNORE_MAX_BUFFER, windowsHide: true }));
     const stale = checkRunbookCoverage(runbooks, deps.base, git3);
+    const seedStale = checkSeedRunbookReview(root, deps.base, readFile10, git3);
     const messages = git3(["log", "--format=%B", `${deps.base}..HEAD`]);
-    const sourceMessages = stale.length ? mergeGroupRunbookMessages(root, deps, readFile10, warnings) : "";
-    const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(`${messages}
-${sourceMessages}`);
+    const sourceMessages = stale.length || seedStale.length ? mergeGroupRunbookMessages(root, deps, readFile10, warnings) : "";
+    const allMessages = `${messages}
+${sourceMessages}`;
+    const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(allMessages);
     (override ? warnings : findings).push(...stale);
+    if (!/^Seed-Runbook-Affected:[ \t]*\S.*$/m.test(allMessages)) findings.push(...seedStale);
   }
   return {
     ok: findings.length === 0,
@@ -18741,10 +18820,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.157",
-    tag: "v4.5.157",
-    commit: "a6662d29e5ff",
-    npm: "@mutmutco/cli@4.5.157"
+    version: "4.5.159",
+    tag: "v4.5.159",
+    commit: "daaf02084d87",
+    npm: "@mutmutco/cli@4.5.159"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18761,14 +18840,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.157"
+          v3Target: "v4.5.159"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.157 and redeploy the Hub Lambda from tag v4.5.157 (a6662d29e5ff); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.157 (@mutmutco/cli@4.5.157, tag commit a6662d29e5ff \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.159 and redeploy the Hub Lambda from tag v4.5.159 (daaf02084d87); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.159 (@mutmutco/cli@4.5.159, tag commit daaf02084d87 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.157",
+  "version": "4.5.159",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.157",
+  "version": "4.5.159",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",