@mutmutco/codex-plugin 4.6.18 → 4.6.20

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.18",
+  "version": "4.6.20",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -28089,10 +28089,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.18",
-    tag: "v4.6.18",
-    commit: "24b7f2455176",
-    npm: "@mutmutco/cli@4.6.18"
+    version: "4.6.20",
+    tag: "v4.6.20",
+    commit: "0feaec728c14",
+    npm: "@mutmutco/cli@4.6.20"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28109,14 +28109,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.18"
+          v3Target: "v4.6.20"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.18 and redeploy the Hub Lambda from tag v4.6.18 (24b7f2455176); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.18 (@mutmutco/cli@4.6.18, tag commit 24b7f2455176 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.20 and redeploy the Hub Lambda from tag v4.6.20 (0feaec728c14); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.20 (@mutmutco/cli@4.6.20, tag commit 0feaec728c14 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31238,7 +31238,7 @@ function suiteMemberRefusal(repo, meta, lane, solo = false, cut) {
   }
   if (authorisedSuiteCut(repo, meta, cut)) return null;
   if (lane !== "rcand" && solo) return null;
-  return `${repo} is part of the ${suite} suite; run the suite cut/release from ${suiteLeadRepo(repo, suite)} (mmi-cli devops suite rcand|release). A solo backend release needs --suite-solo --owner-go.`;
+  return `${repo} is part of the ${suite} suite; the cut comes from the suite lead ${suiteLeadRepo(repo, suite)}. A suite member never asks for, proposes or prompts an rc, release or hotfix: the suite orchestrator is the only voice that brings a cut to Jervaise, so state what landed and stop. --owner-go and --suite-solo are never self-authorized; only a backward-compatible solo backend release/hotfix with actual owner approval may pass --suite-solo --owner-go.`;
 }
 
 // src/tenant-control-parse.ts
@@ -56804,6 +56804,32 @@ var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FR
 var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/(${NAME})/(${NAME})/actions/runs$`);
+var ACTIONS_WORKFLOW_RUNS_RE = new RegExp(`^repos/(${NAME})/(${NAME})/actions/workflows/([A-Za-z0-9][A-Za-z0-9_.-]*\\.ya?ml)/runs$`);
+var WORKFLOW_RUNS_CANONICAL_DIR = ".github/workflows/";
+function workflowRunsAliasRequest(owner, repo, file, query) {
+  let page = "1";
+  let perPage = 30;
+  const filters = [];
+  for (const pair of query.split("&")) {
+    if (!pair) continue;
+    const eq = pair.indexOf("=");
+    if (pair.slice(0, eq) === "page") {
+      page = pair.slice(eq + 1);
+      continue;
+    }
+    if (pair.slice(0, eq) === "per_page") {
+      perPage = Number(pair.slice(eq + 1));
+      continue;
+    }
+    filters.push(pair);
+  }
+  return {
+    kind: "actions-workflow-runs",
+    path: `repos/${owner}/${repo}/actions/runs?per_page=100&page=${page}${filters.map((pair) => `&${pair}`).join("")}`,
+    paginate: false,
+    workflowRuns: { file, page: Number(page), perPage }
+  };
+}
 var RUNS_QUERY_VALUE = {
   per_page: /^(?:[1-9]\d?|100)$/,
   page: /^[1-9]\d{0,5}$/,
@@ -56840,7 +56866,7 @@ var RELEASE_LIST_QUERY_VALUE = { per_page: RUNS_QUERY_VALUE.per_page, page: RUNS
 var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
 var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
 var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/issues/comments/{id}, repos/{owner}/{repo}/issues/{n}/comments[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/artifacts[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/issues/comments/{id}, repos/{owner}/{repo}/issues/{n}/comments[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/workflows/<file>.yml|.yaml/runs[?same keys, each at most once \u2014 #9762 alias: ONE repository page (per_page=100 upstream) with workflow_runs sliced to exact .github/workflows/<file> path matches], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/artifacts[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
 var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing. Piping empty stdout into JSON.parse hides the stderr refusal; check the exit code before parsing.";
 var TYPED_READ_ROUTE_RE = new RegExp(`^repos/(${NAME})/(${NAME})/(issues|pulls)(?:/(comments/\\d+|\\d+)(?:/([a-z_]+))?)?$`);
 function typedReadHint(path2) {
@@ -56912,7 +56938,7 @@ function workflowRunsReadHint(path2) {
   if (!match) return "";
   const [, owner, repo, workflow] = match;
   const slug = `${owner}/${repo}`;
-  return ` Workflow routes are outside the App allowlist \u2014 use the typed workflow runs read \`MMI_ACTOR=app mmi-cli devops read run list --repo ${slug} --workflow ${workflow ?? "<workflow.yml>"} --branch <branch> --limit <n> --json databaseId,workflowName,event,status,conclusion\`, or the allowlisted REST runs list \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs?branch=<branch>&per_page=<n>"\`.`;
+  return ` Workflow routes are outside the App allowlist \u2014 use the typed workflow runs read \`MMI_ACTOR=app mmi-cli devops read run list --repo ${slug} --workflow ${workflow ?? "<workflow.yml>"} --branch <branch> --limit <n> --json databaseId,workflowName,event,status,conclusion\`, or the allowlisted REST runs list \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs?branch=<branch>&per_page=<n>"\`. A canonical workflow FILENAME at \`repos/${slug}/actions/workflows/<file>.yml|.yaml/runs\` IS the allowlisted alias (#9762: one repository page, runs sliced to exact .github/workflows/<file> path matches); numeric ids and display names are not.`;
 }
 function normalizeApiGetPath(raw) {
   const trimmed = raw.trim();
@@ -56935,6 +56961,8 @@ function parseApiGetPath(rawPath) {
   if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
   if (ACTIONS_RUNS_RE.test(base) && (q === -1 || validRunsQuery(query))) return { kind: "actions-runs", path: path2, paginate: false };
+  const wfRuns = ACTIONS_WORKFLOW_RUNS_RE.exec(base);
+  if (wfRuns && (q === -1 || validRunsQuery(query))) return workflowRunsAliasRequest(wfRuns[1], wfRuns[2], wfRuns[3], query);
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(base) && (q === -1 || validRunsQuery(query, RELEASE_LIST_QUERY_VALUE))) return { kind: "actions-jobs", path: path2, paginate: q === -1 };
   if (ACTIONS_ARTIFACTS_RE.test(base) && (q === -1 || validRunsQuery(query, RELEASE_LIST_QUERY_VALUE))) return { kind: "actions-artifacts", path: path2, paginate: q === -1 };
@@ -56950,6 +56978,20 @@ function parseApiGetPath(rawPath) {
   }
   throw refuse();
 }
+function sliceWorkflowRunsPage(body, selector) {
+  const parsed = JSON.parse(body);
+  if (!Array.isArray(parsed.workflow_runs)) throw new Error("api get: upstream repository runs page has no workflow_runs array");
+  const matched = parsed.workflow_runs.filter((run) => run?.path === `${WORKFLOW_RUNS_CANONICAL_DIR}${selector.file}`).slice(0, selector.perPage);
+  return JSON.stringify({
+    workflow_runs: matched,
+    matched_count: matched.length,
+    repository_total_count: parsed.total_count,
+    scope: "repository-page",
+    incomplete_results: true,
+    repository_page: selector.page,
+    repository_per_page: 100
+  });
+}
 var ZIP_TIMEOUT_MS = 12e4;
 var ZIP_MAX_BUFFER = 512 * 1024 * 1024;
 function buildApiGetArgs(path2, accept) {
@@ -56970,7 +57012,8 @@ async function readAppApi(path2, runner = apiReadRunner) {
   requireBrokerApp("read run log");
   const log = req.kind === "actions-job-logs";
   const body = await runApiGet((args, timeout) => runner(req.kind === "actions-jobs" ? [...args, "--slurp"] : args, log ? ZIP_TIMEOUT_MS : timeout, brokerChildEnv(), log || void 0), path2);
-  return log ? Buffer.from(body, "latin1").toString("utf8") : body;
+  const out = req.workflowRuns ? sliceWorkflowRunsPage(body, req.workflowRuns) : body;
+  return log ? Buffer.from(body, "latin1").toString("utf8") : out;
 }
 function registerApiReadCommands(program3, overrides) {
   const spawn7 = overrides?.runner ?? apiReadRunner;
@@ -56996,6 +57039,7 @@ function registerApiReadCommands(program3, overrides) {
         req.path,
         o.accept
       );
+      if (req.workflowRuns) body = sliceWorkflowRunsPage(body, req.workflowRuns);
       if (o.jq !== void 0) body = await jqRun(o.jq, body, localJqEnv(), ...bindings.length ? [bindings] : []);
       if (zip) {
         (0, import_node_fs46.writeFileSync)(o.out, body, "latin1");

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.18",
+  "version": "4.6.20",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.18",
+  "version": "4.6.20",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",