@mutmutco/codex-plugin 4.6.20 → 4.6.22

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.20",
+  "version": "4.6.22",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -28089,10 +28089,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.20",
-    tag: "v4.6.20",
-    commit: "0feaec728c14",
-    npm: "@mutmutco/cli@4.6.20"
+    version: "4.6.22",
+    tag: "v4.6.22",
+    commit: "bc3629b50994",
+    npm: "@mutmutco/cli@4.6.22"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28109,14 +28109,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.20"
+          v3Target: "v4.6.22"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.20 and redeploy the Hub Lambda from tag v4.6.20 (0feaec728c14); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.20 (@mutmutco/cli@4.6.20, tag commit 0feaec728c14 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.22 and redeploy the Hub Lambda from tag v4.6.22 (bc3629b50994); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.22 (@mutmutco/cli@4.6.22, tag commit bc3629b50994 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -56903,9 +56903,15 @@ function orgScopedHint(path2) {
   if (!match) return "";
   const org = match[1];
   const runners = /^orgs\/[^/?#]+\/actions\/runners(?:\/|$)/.test(path2.split("?")[0]);
-  const surface = runners ? `For which lane is busy in a repo, use the App-token reads \`mmi-cli devops read run list --repo <owner>/<repo> --status in_progress --json databaseId,workflowName\` followed by \`mmi-cli devops read run view <id> --repo <owner>/<repo> --json jobs\` (runner-name/status per job); fleet-wide runner online/offline state has no App-token read and a human token holder answers it with \`gh api orgs/${org}/actions/runners\` (docs/Guides/gh-runner-runbook.md).` : "It needs a human token holder with an org-scoped token, or a dedicated mmi-cli verb when one exists for this resource.";
+  const surface = runners ? `For which lane is busy in a repo, use the App-token reads \`mmi-cli devops read run list --repo <owner>/<repo> --status in_progress --json databaseId,workflowName\` followed by \`MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs/<id>/jobs?per_page=100"\` (runner_name/status per job); fleet-wide runner online/offline state has no App-token read and a human token holder answers it with \`gh api orgs/${org}/actions/runners\` (docs/Guides/gh-runner-runbook.md).` : "It needs a human token holder with an org-scoped token, or a dedicated mmi-cli verb when one exists for this resource.";
   return ` This route is ORG-SCOPED (\`orgs/${org}/...\`) and is deliberately outside the allowlist \u2014 no App-token read exists for org-level resources, so retrying path variants cannot work and no \`repos/{owner}/{repo}/...\` respelling of it will be accepted. ${surface} A refusal writes nothing to stdout: check the exit code and never merge stderr into the JSON pipe (2>&1).`;
 }
+function repoRunnersReadHint(path2) {
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/actions/runners(?:/\\d+)?$`).exec(path2.split("?")[0]);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` This route is a REPO-SCOPED runner read (\`repos/${slug}/actions/runners...\`) and is deliberately outside the allowlist \u2014 retrying path variants cannot work, and no new grant or allowlist growth is implied. The App-token reads prove only observed activity, never fleet inventory or idle capacity: \`MMI_ACTOR=app mmi-cli devops read run list --repo ${slug} --status in_progress --json databaseId,workflowName\` followed by \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs/<id>/jobs?per_page=100"\` (runner_name/status per job). Fleet inventory is a human admin read: \`gh api orgs/<org>/actions/runners\` (docs/Guides/gh-runner-runbook.md) \u2014 whether this repo also carries repo-level runners is unproved either way. A refusal writes nothing to stdout: check the exit code and never merge stderr into the JSON pipe (2>&1).`;
+}
 function tagsReadHint(path2) {
   const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:tags|git/(?:refs|matching-refs|tags|commits))(?:[/?#]|$)`).exec(path2);
   if (!match) return "";
@@ -56949,7 +56955,7 @@ function parseApiGetPath(rawPath) {
   const path2 = normalizeApiGetPath(rawPath);
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(rawPath.trim()) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${workflowRunsReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${repoRunnersReadHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${workflowRunsReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.20",
+  "version": "4.6.22",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.20",
+  "version": "4.6.22",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",