@mutmutco/codex-plugin 4.5.192 → 4.5.193

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.192",
+  "version": "4.5.193",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -19193,10 +19193,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.192",
-    tag: "v4.5.192",
-    commit: "f1f8ae295dcd",
-    npm: "@mutmutco/cli@4.5.192"
+    version: "4.5.193",
+    tag: "v4.5.193",
+    commit: "8a9085b5492f",
+    npm: "@mutmutco/cli@4.5.193"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19213,14 +19213,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.192"
+          v3Target: "v4.5.193"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.192 and redeploy the Hub Lambda from tag v4.5.192 (f1f8ae295dcd); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.192 (@mutmutco/cli@4.5.192, tag commit f1f8ae295dcd \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.193 and redeploy the Hub Lambda from tag v4.5.193 (8a9085b5492f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.193 (@mutmutco/cli@4.5.193, tag commit 8a9085b5492f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -33368,11 +33368,29 @@ function planRemoteScript(dests) {
 `;
 }
 var ALERT_DIR = "/var/lib/mmi-control/alerts";
+var SUPPRESSED_RUNNER_PRIVATE_KEY_GLOB = "*/.local/share/docker/containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/*/fs/etc/ssl/private/ssl-cert-snakeoil.key";
+var SUPPRESSED_RUNNER_PRIVATE_KEY_RE = new RegExp(
+  `^${SUPPRESSED_RUNNER_PRIVATE_KEY_GLOB.split("*").map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`
+);
+function isSuppressedRunnerPrivateKeyPath(p) {
+  return SUPPRESSED_RUNNER_PRIVATE_KEY_RE.test(p.trim());
+}
 function parseAlerts(output) {
   const out = [];
   for (const line of output.split("\n")) {
     const m = /^ALERT ([A-Za-z0-9._-]+) ?(.*)$/.exec(line.trim());
-    if (m) out.push({ name: m[1], message: m[2].trim() });
+    if (!m) continue;
+    const name = m[1];
+    let message2 = m[2].trim();
+    if (name === "runner-private-key") {
+      const pm = /^(\d+)( private key file\(s\) readable by every CI job on this box \(#7535\): )(.+)$/.exec(message2);
+      if (pm) {
+        const kept = pm[3].trim().split(/\s+/).filter((p) => p && !isSuppressedRunnerPrivateKeyPath(p));
+        if (kept.length === 0) continue;
+        message2 = `${kept.length}${pm[2]}${kept.join(" ")}`;
+      }
+    }
+    out.push({ name, message: message2 });
   }
   return out;
 }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.192",
+  "version": "4.5.193",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.192",
+  "version": "4.5.193",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",