@mutmutco/codex-plugin 4.5.192 → 4.5.194

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.192",
+  "version": "4.5.194",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -365,7 +365,35 @@ var init_error_codes = __esm({
 function isAppFilingWrite(args) {
   if (args.some((a) => VIEWER.test(a))) return false;
   const [group, verb] = args;
-  return (group === "issue" || group === "label") && verb === "create";
+  if ((group === "issue" || group === "label" || group === "pr") && verb === "create") return true;
+  if (group === "pr" && verb === "merge") return true;
+  if (group === "api") return isFilingWriteApi(args.slice(1));
+  return false;
+}
+function isFilingWriteApi(rest) {
+  let method = "GET";
+  let path2;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "-X" || a === "--method") {
+      method = (rest[i + 1] ?? "").toUpperCase();
+      i++;
+    } else if (/^--method=/.test(a)) {
+      method = a.slice(9).toUpperCase();
+    } else if (a === "-f" || a === "-F" || a === "--field" || a === "--raw-field" || a === "--input" || a === "-H" || a === "--header" || a === "-q" || a === "--jq" || a === "-t" || a === "--template" || a === "--hostname") {
+      if (a === "-f" || a === "-F" || a === "--field" || a === "--raw-field" || a === "--input") {
+        if (method === "GET") method = "POST";
+      }
+      i++;
+    } else if (a.startsWith("--input=")) {
+      if (method === "GET") method = "POST";
+    } else if (!a.startsWith("-") && path2 === void 0) {
+      path2 = a.replace(/^\//, "");
+    }
+  }
+  if (method === "POST" && path2 && /^repos\/[^/]+\/[^/]+\/(issues|pulls)$/.test(path2)) return true;
+  if (method === "PUT" && path2 && /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/merge$/.test(path2)) return true;
+  return false;
 }
 function isViewerFreeGhRead(args) {
   if (args.some((a) => VIEWER.test(a))) return false;
@@ -1254,8 +1282,13 @@ __export(cli_shared_exports, {
   repoProject: () => repoProject,
   setGhReadTokenProvider: () => setGhReadTokenProvider,
   setGhWriteTokenProvider: () => setGhWriteTokenProvider,
-  setInjectedStdin: () => setInjectedStdin
+  setInjectedStdin: () => setInjectedStdin,
+  shouldRetryIntegrationRefusalOnAmbient: () => shouldRetryIntegrationRefusalOnAmbient
 });
+function shouldRetryIntegrationRefusalOnAmbient(err, env = process.env) {
+  if (env.MMI_ACTOR?.trim() === "app") return false;
+  return /Resource not accessible by integration/i.test(String(err?.stderr ?? ""));
+}
 function setGhReadTokenProvider(provider) {
   ghReadTokenProvider = provider;
 }
@@ -1265,8 +1298,18 @@ function setGhWriteTokenProvider(provider) {
 async function ghFilingAppEnv(file, args) {
   if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
   if (!isAppFilingWrite(args)) return void 0;
-  const token = await ghWriteTokenProvider().catch(() => void 0);
-  return token ? { ...process.env, GH_TOKEN: token } : void 0;
+  const explicitApp = process.env.MMI_ACTOR?.trim() === "app";
+  let token;
+  try {
+    token = await ghWriteTokenProvider();
+  } catch (e) {
+    if (explicitApp) throw e;
+    return void 0;
+  }
+  if (!token && explicitApp) {
+    throw new Error("app actor: filing write token unavailable \u2014 refusing personal-token fallback under MMI_ACTOR=app");
+  }
+  return token ? { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" } : void 0;
 }
 async function ghReadAppEnv(file, args) {
   if (!ghReadTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
@@ -1477,7 +1520,7 @@ var init_cli_shared = __esm({
       try {
         return await run(appEnv);
       } catch (e) {
-        if (/Resource not accessible by integration/i.test(String(e.stderr ?? ""))) return run();
+        if (shouldRetryIntegrationRefusalOnAmbient(e)) return run();
         throw e;
       }
     };
@@ -7385,7 +7428,11 @@ async function mintCommandWriteToken(deps, commandPath4) {
 }
 async function mintFilingWriteToken(deps) {
   try {
-    return await mintFromMember(deps, { metadata: "read", issues: "write" }, APP_VAULT_KEYS);
+    return await mintFromMember(
+      deps,
+      { metadata: "read", contents: "write", issues: "write", pull_requests: "write" },
+      APP_VAULT_KEYS
+    );
   } catch (e) {
     if (e instanceof AppActorError) throw e;
     throw new AppActorError(`app actor: filing token mint failed (${e?.constructor?.name ?? "Error"})`);
@@ -7512,6 +7559,11 @@ async function pollTokenOrUndefined(deps, env = process.env) {
 }
 var notedIneligibleCommand = false;
 var notedVaultDenied = false;
+var APP_SUBPROCESS_ROUTED_COMMANDS = /* @__PURE__ */ new Set([
+  "issue create",
+  "pr create",
+  "pr merge"
+]);
 async function activateAppActor(commandPath4, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
   activeQuotaScope = void 0;
@@ -7522,7 +7574,7 @@ async function activateAppActor(commandPath4, env, mint, note = (line) => proces
     throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' and 'personal' are supported; refusing to guess an identity`);
   }
   if (!APP_ELIGIBLE_COMMANDS.has(commandPath4) && !APP_WRITE_COMMANDS.has(commandPath4)) {
-    if (requested === "app" && !notedIneligibleCommand) {
+    if (requested === "app" && !notedIneligibleCommand && !APP_SUBPROCESS_ROUTED_COMMANDS.has(commandPath4)) {
       notedIneligibleCommand = true;
       note(`app actor: '${commandPath4}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
     }
@@ -14003,6 +14055,11 @@ mutation($projectId: ID!, $itemId: ID!) {
   }
 }`;
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
+  if (process.env.MMI_ACTOR?.trim() === "app") {
+    const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
+    await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+    return { credential: "app_installation" };
+  }
   try {
     await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
     return { credential: "user" };
@@ -19193,10 +19250,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.192",
-    tag: "v4.5.192",
-    commit: "f1f8ae295dcd",
-    npm: "@mutmutco/cli@4.5.192"
+    version: "4.5.194",
+    tag: "v4.5.194",
+    commit: "e53e981582fc",
+    npm: "@mutmutco/cli@4.5.194"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19213,14 +19270,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.192"
+          v3Target: "v4.5.194"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.192 and redeploy the Hub Lambda from tag v4.5.192 (f1f8ae295dcd); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.192 (@mutmutco/cli@4.5.192, tag commit f1f8ae295dcd \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.194 and redeploy the Hub Lambda from tag v4.5.194 (e53e981582fc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.194 (@mutmutco/cli@4.5.194, tag commit e53e981582fc \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -33368,11 +33425,33 @@ function planRemoteScript(dests) {
 `;
 }
 var ALERT_DIR = "/var/lib/mmi-control/alerts";
+var SUPPRESSED_RUNNER_PRIVATE_KEY_GLOB = "*/.local/share/docker/containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/*/fs/etc/ssl/private/ssl-cert-snakeoil.key";
+var SUPPRESSED_RUNNER_PRIVATE_KEY_RE = new RegExp(
+  `^${SUPPRESSED_RUNNER_PRIVATE_KEY_GLOB.split("*").map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`
+);
+function isSuppressedRunnerPrivateKeyPath(p) {
+  return SUPPRESSED_RUNNER_PRIVATE_KEY_RE.test(p.trim());
+}
 function parseAlerts(output) {
   const out = [];
   for (const line of output.split("\n")) {
     const m = /^ALERT ([A-Za-z0-9._-]+) ?(.*)$/.exec(line.trim());
-    if (m) out.push({ name: m[1], message: m[2].trim() });
+    if (!m) continue;
+    const name = m[1];
+    let message2 = m[2].trim();
+    if (name === "runner-private-key") {
+      const pm = /^(\d+)( private key file\(s\) readable by every CI job on this box \(#7535\): )(.+)$/.exec(message2);
+      if (pm) {
+        const advertisedCount = Number(pm[1]);
+        const paths = pm[3].trim().split(/\s+/).filter(Boolean);
+        if (paths.length === advertisedCount) {
+          const kept = paths.filter((p) => !isSuppressedRunnerPrivateKeyPath(p));
+          if (kept.length === 0) continue;
+          message2 = `${kept.length}${pm[2]}${kept.join(" ")}`;
+        }
+      }
+    }
+    out.push({ name, message: message2 });
   }
   return out;
 }
@@ -47553,6 +47632,19 @@ async function attachToProject(issueNumber, repo, priority) {
       defaultGitHubClient()
     );
     if (!contentId) throw new Error("could not resolve issue node id");
+    if (process.env.MMI_ACTOR?.trim() === "app") {
+      const projectItemId2 = await attachViaHubApp(cfg, contentId);
+      if (projectItemId2 && priority) {
+        try {
+          await setBoardItemPriority(defaultGitHubClient(), cfg, projectItemId2, priority);
+        } catch (e) {
+          const err = e;
+          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(err.stderr || err.message || String(e)).trim()}
+`);
+        }
+      }
+      return { projectItemId: projectItemId2, onBoard: true, credential: "app_installation" };
+    }
     const { stdout } = await execFileP("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: GH_MUTATION_TIMEOUT_MS });
     const projectItemId = parseAddedItemId(stdout);
     if (projectItemId && priority) {
@@ -58008,7 +58100,12 @@ setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appAct
 setGhReadTokenProvider(pollToken);
 setGitHubReadTokenProvider(pollToken);
 var filingToken;
-setGhWriteTokenProvider(() => filingToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, () => void 0));
+setGhWriteTokenProvider(() => {
+  if (process.env.MMI_ACTOR?.trim() === "app") {
+    return mintFilingWriteToken(appActorDeps()).then((t) => t.token);
+  }
+  return filingToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, () => void 0);
+});
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.192",
+  "version": "4.5.194",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.192",
+  "version": "4.5.194",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",