@mutmutco/codex-plugin 4.5.158 → 4.5.159

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.158",
+  "version": "4.5.159",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -7068,6 +7068,8 @@ var import_node_crypto5 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
+var APP2_VAULT_KEYS = ["GITHUB_APP2_ID", "GITHUB_APP2_INSTALLATION_ID", "GITHUB_APP2_PRIVATE_KEY"];
+var APP_POOL_MEMBERS = [APP_VAULT_KEYS, APP2_VAULT_KEYS];
 var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "pr checks-wait",
   // #8042: App-native required-only read (`pr checks-required`) — REST check/status rows scoped by
@@ -7184,10 +7186,52 @@ async function fleetStatusWriteEnv(args) {
   }
 }
 async function mintScopedInstallationToken(deps, permissions) {
-  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
+  const start = Math.floor((deps.random ?? Math.random)() * APP_POOL_MEMBERS.length) % APP_POOL_MEMBERS.length;
+  const order = APP_POOL_MEMBERS.map((_, i) => APP_POOL_MEMBERS[(start + i) % APP_POOL_MEMBERS.length]);
+  let firstError;
+  let exhausted;
+  let absent = 0;
+  for (const [i, keys] of order.entries()) {
+    try {
+      const minted = await mintFromMember(deps, permissions, keys);
+      if (i === order.length - 1 || !await allowanceSpent(deps, minted.token)) return minted;
+      exhausted ??= minted;
+    } catch (e) {
+      if (e instanceof AppActorError && e.code === "vault-denied") {
+        absent += 1;
+        continue;
+      }
+      firstError ??= e;
+    }
+  }
+  if (exhausted) return exhausted;
+  if (firstError) throw firstError;
+  if (absent === order.length) {
+    throw new AppActorError(
+      `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
+      "vault-denied"
+    );
+  }
+  throw new AppActorError("app actor: no App pool member minted \u2014 automation fails closed");
+}
+async function allowanceSpent(deps, token) {
+  try {
+    const res = await deps.fetch("https://api.github.com/rate_limit", {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "user-agent": "mmi-cli-app-actor" }
+    });
+    if (!res.ok) return false;
+    const body = await res.json();
+    return body.resources?.core?.remaining === 0 || body.resources?.graphql?.remaining === 0;
+  } catch {
+    return false;
+  }
+}
+async function mintFromMember(deps, permissions, keys) {
+  const [appId, installationId, privateKey] = await Promise.all(keys.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
-    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
-    if (missing.length === APP_VAULT_KEYS.length) {
+    const missing = keys.filter((_, i) => ![appId, installationId, privateKey][i]);
+    if (missing.length === keys.length) {
       throw new AppActorError(
         `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
         "vault-denied"
@@ -18776,10 +18820,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.158",
-    tag: "v4.5.158",
-    commit: "21733e84802e",
-    npm: "@mutmutco/cli@4.5.158"
+    version: "4.5.159",
+    tag: "v4.5.159",
+    commit: "daaf02084d87",
+    npm: "@mutmutco/cli@4.5.159"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18796,14 +18840,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.158"
+          v3Target: "v4.5.159"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.158 and redeploy the Hub Lambda from tag v4.5.158 (21733e84802e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.158 (@mutmutco/cli@4.5.158, tag commit 21733e84802e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.159 and redeploy the Hub Lambda from tag v4.5.159 (daaf02084d87); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.159 (@mutmutco/cli@4.5.159, tag commit daaf02084d87 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.158",
+  "version": "4.5.159",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.158",
+  "version": "4.5.159",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",