@mutmutco/codex-plugin 4.5.226 → 4.5.227

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.226",
+  "version": "4.5.227",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -16032,6 +16032,9 @@ function partitionByRequired(entries, requiredContexts) {
       ignoredFailures.push(entry.name);
     }
   }
+  if (relevant.length && [...requiredContexts].some((name) => !entries.some((entry) => entry.name === name))) {
+    relevant.push("pending");
+  }
   return { relevant, ignoredFailures };
 }
 function parseNdjsonLines(stdout) {
@@ -27088,10 +27091,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.226",
-    tag: "v4.5.226",
-    commit: "360239dd3172",
-    npm: "@mutmutco/cli@4.5.226"
+    version: "4.5.227",
+    tag: "v4.5.227",
+    commit: "9498ff4da322",
+    npm: "@mutmutco/cli@4.5.227"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27108,14 +27111,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.226"
+          v3Target: "v4.5.227"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.226 and redeploy the Hub Lambda from tag v4.5.226 (360239dd3172); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.226 (@mutmutco/cli@4.5.226, tag commit 360239dd3172 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.227 and redeploy the Hub Lambda from tag v4.5.227 (9498ff4da322); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.227 (@mutmutco/cli@4.5.227, tag commit 9498ff4da322 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -49623,15 +49626,40 @@ var PR_LAND_STATE_READ_RETRIES = 3;
 var PR_LAND_STATE_READ_DELAY_MS = 15e3;
 var PR_LAND_MERGE_RETRY_DELAY_MS = 3e4;
 async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
-  const first = await deps.mergeAuto(prNumber, repo);
-  if (first.mergeStatus !== "failed") return first;
-  const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
-  if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
+  const now = deps.now ?? (() => Date.now());
+  const deadline = now() + PR_LAND_ENQUEUE_TIMEOUT_MS;
   const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
-  const retried = await deps.mergeAuto(prNumber, repo);
-  if (retried.mergeStatus !== "failed") return retried;
-  return { mergeStatus: "failed", error: `merge retry after transient failure also failed: ${retried.error ?? first.error ?? "unknown error"}` };
+  const first = await deps.mergeAuto(prNumber, repo);
+  let result = first;
+  let transientRetried = false;
+  while (result.mergeStatus === "failed") {
+    const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false, checksPending: false }));
+    if (ready.open && ready.checksPending) {
+      if (now() >= deadline) break;
+      await sleep2(Math.min(PR_LAND_POLL_MS, deadline - now()));
+      if (now() >= deadline) break;
+      const checks = await deps.waitForChecks(prNumber, repo, deadline - now());
+      if (checks.status !== "success" && checks.status !== "skipped") {
+        return { mergeStatus: "failed", error: `${result.error ?? "merge failed"}
+registration wait: checks-wait ${checks.status}: ${checks.detail ?? checks.reason ?? "unknown"}` };
+      }
+      if (now() >= deadline) break;
+    } else {
+      if (!ready.open || !ready.mergeable || !ready.checksPassing || transientRetried) return result;
+      transientRetried = true;
+      if (now() >= deadline) break;
+      await sleep2(Math.min(PR_LAND_MERGE_RETRY_DELAY_MS, deadline - now()));
+      if (now() >= deadline) break;
+    }
+    const retried = await deps.mergeAuto(prNumber, repo);
+    result = retried.mergeStatus !== "failed" ? retried : {
+      mergeStatus: "failed",
+      error: `merge retry after transient failure also failed: first attempt: ${first.error ?? "unknown error"}
+retry: ${retried.error ?? "unknown error"}`
+    };
+  }
+  return result.mergeStatus === "failed" ? { ...result, error: `${result.error ?? "merge failed"}
+required-check registration did not settle within the enqueue deadline` } : result;
 }
 var AUTO_MERGE_CONFIRM_RETRIES = 3;
 var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
@@ -50025,15 +50053,15 @@ function invisibleTrailer(sha, line) {
   return {
     kind: "malformed-override-trailer",
     paths: [],
-    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
-    ${line}
-  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
-  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
-  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
-  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
-  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
-  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.
-  This is fixable forward: push a LATER commit on this branch carrying a well-formed trailer.
+    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)}
+  Recovery (trailer): create a LATER commit on this branch with \`${TRAILER_KEY}: <reason>\`
+  in the final trailer block, separated from the body by a blank line. Use \`Key: value\` lines
+  only in that block; indent continuation lines and keep prose such as \`Closes #123\` above it.
+  Verify: \`git log -1 --format='%(trailers:key=${TRAILER_KEY})' HEAD\` must show the waiver.
+  Then run \`mmi-cli tests policy --json --base origin/development\` from the selected worktree root
+  to refresh its receipt before retrying the focused test. Changing location alone cannot fix this trailer.
+  Rejected line: ${line}
+  Git's trailer parser reports no waiver; a regex-only reason is not git-auditable (#3628).
   The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.`
   };
 }
@@ -50911,9 +50939,8 @@ function ghFailureReason(e) {
   const err = e;
   const head = String(err?.message ?? "").split("\n")[0]?.trim() ?? "";
   const detail = `${err?.stderr ?? ""}
-${err?.stdout ?? ""}`.split("\n").map((line) => line.trim()).find((line) => line.length > 0);
-  if (detail && head) return `${head} \u2014 ${detail}`;
-  return detail || head || "unknown error";
+${err?.stdout ?? ""}`.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).join("\n");
+  return (detail && head ? `${head} \u2014 ${detail}` : detail || head || "unknown error").replace(/\x1b\[[0-9;]*m/g, "").replace(/\b(?:gh[pousr]_|github_pat_|AKIA|sk-)[\w-]+/g, "[redacted]").replace(/\b(authorization:\s*)(?:[^\n]*)/gi, "$1[redacted]");
 }
 var defaultGhMergeAutoIo = {
   gh: async (args, timeoutMs) => (await execFileP("gh", args, { timeout: timeoutMs })).stdout
@@ -51066,13 +51093,7 @@ async function mergeAutoEnqueueWithBody(prNumber, args, method, io, bodyFile, me
         error: stateRead.ok ? message2.split("\n")[0] : `could not confirm PR state after local branch cleanup warning: ${stateRead.error}`
       };
     }
-    if (!basePolicyBlocksImmediateMerge(message2)) {
-      return { mergeStatus: "failed", error: ghFailureReason(e) };
-    }
-    return {
-      mergeStatus: "failed",
-      error: `${ghFailureReason(e)} \u2014 auto-merge could not be armed yet (the PR's required checks have not registered); re-run the same --auto merge once they appear`
-    };
+    return { mergeStatus: "failed", error: ghFailureReason(e) };
   }
   return confirmEnqueueOutcome();
 }
@@ -56773,9 +56794,10 @@ ${list}`);
         },
         fetchTrainAuthority: async (repo) => fetchTrainAuthority(repo, registryClientDeps(await loadConfig())),
         resolveCiPolicy: (repo) => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
-        waitForChecks: async (prNumber, repo) => {
+        waitForChecks: async (prNumber, repo, timeoutMs) => {
           const requiredContexts = await fetchRequiredCheckContexts(repo, "development").catch(() => null);
           return waitForPrChecks({
+            timeoutMs,
             resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
             // #3024: REST-only wait loop — runPrLand's resolveRepo already guarantees `repo` is set.
             pollChecks: () => pollRestPrChecks(prNumber, repo, void 0, requiredContexts),
@@ -56817,7 +56839,8 @@ ${list}`);
           return {
             open: snapshot?.state === "open",
             mergeable: snapshot?.mergeable === "MERGEABLE",
-            checksPassing: checks === "success" || checks === "no-checks-reported"
+            checksPassing: checks === "success",
+            checksPending: checks === "pending" || checks === "failing" || checks === "no-checks-reported"
           };
         },
         readPrState: async (prNumber, repo) => {
@@ -62732,19 +62755,32 @@ function ghExitCodeOf(error) {
 }
 async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(chunk)) {
   const env = brokerChildEnv();
+  let output;
   try {
-    write(redactPrivateCredential(await run(spec.args, { timeoutMs: spec.timeoutMs, env }), env));
-    return 0;
+    output = redactPrivateCredential(await run(spec.args, { timeoutMs: spec.timeoutMs, env }), env);
   } catch (e) {
     const err = e;
     if (typeof err.stdout === "string" && err.stdout) process.stderr.write(redactPrivateCredential(err.stdout, env));
     const code = ghExitCodeOf(e);
     if (code !== null) {
       if (typeof err.stderr === "string" && err.stderr) process.stderr.write(redactPrivateCredential(err.stderr, env));
+      process.stderr.write(`read: gh ${spec.args.slice(0, 2).join(" ")} failed on the App pool (exit ${code}) \u2014 inspect stderr; retry the same typed read and only parse stdout after success
+`);
       return code;
     }
     throw new Error(`read: gh ${spec.args.slice(0, 2).join(" ")} did not finish on the App pool (${err.message ?? e}) \u2014 re-run the same command to refresh (same custody); reads never fall back to personal`);
   }
+  if (spec.args.includes("--json")) {
+    try {
+      JSON.parse(output);
+    } catch {
+      process.stderr.write(`read: gh ${spec.args.slice(0, 2).join(" ")} returned ${output.trim() ? "invalid" : "empty"} JSON on the App pool \u2014 retry the same typed read; only parse stdout after success
+`);
+      return 1;
+    }
+  }
+  write(output);
+  return 0;
 }
 async function runBrokerRestChecks(deps, spec, resolveRepo2) {
   const repo = await resolveRepo2(spec.repo);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.226",
+  "version": "4.5.227",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.226",
+  "version": "4.5.227",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/hotfix/SKILL.md

@@ -29,7 +29,15 @@ mmi-cli devops train doctor --lane hotfix --heal --json
 
 Parse stdout only; never `2>&1`. `ready` false → stop and quote every blocker's `code` and `remedy`; an unread origin is never green. Findings carry `code`, `severity`, `source`, `remedy`, `anchor`.
 
-Piping `mmi-cli devops api get` into a JSON parser: a refusal exits 1 with empty stdout, so guard both: `out=$(MMI_ACTOR=app mmi-cli devops api get <path>) && [ -n "$out" ] && printf '%s' "$out" | node -e '…'`. One job's metadata: read the allowlisted `repos/{owner}/{repo}/actions/runs/{id}/jobs` and filter `jobs[]` by `id`; `actions/jobs/{id}` is refused (only its `/logs`, with `--out`).
+Piping `mmi-cli devops api get` into a JSON parser: a refusal exits 1 with empty stdout, so guard both exit status and nonempty output. For one job's runner and timestamps, read the allowlisted `repos/{owner}/{repo}/actions/runs/{id}/jobs` and filter `jobs[]` by `id`; `actions/jobs/{id}` is refused (only its `/logs`, with `--out`). Do not retry that refused endpoint or broaden the allowlist.
+
+```bash
+# Set repo, run_id and job_id to the target repository, run and job.
+out=$(MMI_ACTOR=app mmi-cli devops api get "repos/$repo/actions/runs/$run_id/jobs") &&
+  [ -n "$out" ] && printf '%s' "$out" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s).jobs.find(j=>String(j.id)===process.argv[1]);if(!j)throw new Error("Job not found in run jobs");console.log(JSON.stringify({runner_name:j.runner_name,started_at:j.started_at,completed_at:j.completed_at,conclusion:j.conclusion}))})' "$job_id"
+```
+
+Do not parse stdout after a failing read, suppress its stderr, or merge stderr into the JSON.
 
 ## Apply
 

package/skills/org-guide/references/work-and-releases.md

@@ -18,11 +18,15 @@ Use host worktrees and MMI cleanup; no personal Jerv is required. At handoff, st
 session; never copy them forward from an earlier handoff, even labelled unverified (#9039).
 Report skill misfires to Hub
 with `mmi-cli learning skill-lesson --skill <name> --title <summary> --body-file <path>`.
-Under the App pool,
+Under the App pool, on raw `gh`
 `--jq`/`-q`/`--template`/`--web` are refused: use
 `MMI_ACTOR=app mmi-cli devops read issue view <id> --repo <owner/repo> --json comments`
 (or `pr`/`run view` with their fields); filter returned JSON locally, e.g. by adding
 `--jq '<expr>'` to that typed read (runs the local jq, never inside gh).
+For the last N comments (here, 3), use the typed JSON read with local filtering, not raw gh formatters:
+```bash
+MMI_ACTOR=app mmi-cli devops read issue view <id> --repo <owner/repo> --json comments --jq '.comments[-3:][] | {createdAt, body}'
+```
 For run logs, never native `gh run view --log`/`--log-failed`: use
 `MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> [--failed | --job <name>] [--tail N]`.
 A refused command writes no output, so a `> file` redirect leaves it empty or missing: read the