@mutmutco/codex-plugin 4.6.28 → 4.6.29

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.28",
+  "version": "4.6.29",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -9092,6 +9092,73 @@ var require_dist = __commonJS({
   }
 });
 
+// src/ci-hosted-usage.ts
+var ci_hosted_usage_exports = {};
+__export(ci_hosted_usage_exports, {
+  projectHostedUsage: () => projectHostedUsage,
+  renderHostedUsage: () => renderHostedUsage
+});
+function projectHostedUsage(config, now = Date.now()) {
+  const summary = object(config.hostedUsage);
+  const state = object(summary?.state);
+  const tick = object(state?.lastTick);
+  const ok = object(state?.lastOk);
+  const record2 = object(summary?.record);
+  const unknowns = [];
+  let lastTick = null;
+  if (tick && typeof tick.ok === "boolean") {
+    lastTick = { ok: tick.ok };
+    if (iso(tick.at)) lastTick.at = tick.at;
+    if (typeof tick.complete === "boolean") lastTick.complete = tick.complete;
+    for (const k of ["scanned", "usedUsd", "remainingUsd", "paceUsdPerDay"]) {
+      if (typeof tick[k] === "number" && Number.isFinite(tick[k])) lastTick[k] = tick[k];
+    }
+    if (iso(tick.asOf)) lastTick.asOf = tick.asOf;
+  }
+  const lastOk = ok && iso(ok.at) && typeof ok.scanned === "number" && Number.isSafeInteger(ok.scanned) && ok.scanned >= 0 ? { at: ok.at, scanned: ok.scanned, ...typeof ok.complete === "boolean" && { complete: ok.complete } } : null;
+  const allowanceInputs = record2 && ["usedUsd", "remainingUsd", "paceUsdPerDay"].every((k) => typeof record2[k] === "number" && Number.isFinite(record2[k])) && iso(record2.asOf) && typeof record2.source === "string" && /^[\w .:/-]{1,64}$/.test(record2.source) ? { usedUsd: record2.usedUsd, remainingUsd: record2.remainingUsd, paceUsdPerDay: record2.paceUsdPerDay, asOf: record2.asOf, source: record2.source } : null;
+  const deployedRevision = typeof summary?.deployedRevision === "string" && /^[\w.+-]{1,128}$/.test(summary.deployedRevision) ? summary.deployedRevision : null;
+  if (!summary) unknowns.push("hostedUsage unavailable (server may predate this read or summary read failed)");
+  if (!deployedRevision) unknowns.push("deployedRevision unavailable");
+  if (!lastTick?.at) unknowns.push("lastTick.at unavailable");
+  if (!lastOk) unknowns.push("lastOk unavailable");
+  if (lastTick?.complete === void 0) unknowns.push("tick completeness unavailable");
+  if (!allowanceInputs) unknowns.push("allowance inputs and freshness unavailable");
+  if (summary && summary.record !== null && !allowanceInputs) unknowns.push("unrecognized allowance projection");
+  const age = allowanceInputs ? now - Date.parse(allowanceInputs.asOf) : null;
+  return {
+    source: { route: "GET /org/config", projection: "ORG#config hostedUsage", state: "CIHOSTED#v1/STATE", usage: "CIHOSTED#v1/USAGE" },
+    deployedRevision,
+    observedAt: new Date(now).toISOString(),
+    lastTick,
+    lastOk,
+    allowanceInputs,
+    decision: allowanceInputs ? "allowance served" : summary?.record === null ? "no allowance: record absent/malformed" : null,
+    complete: lastTick?.complete ?? null,
+    fresh: age === null ? null : age >= 0 && age < 12 * 36e5,
+    unknowns
+  };
+}
+function renderHostedUsage(read) {
+  const a = read.allowanceInputs;
+  return [
+    `${read.source.route} \u2014 ${read.source.projection} (${read.source.state}, ${read.source.usage})`,
+    `revision=${read.deployedRevision ?? "unknown"} observedAt=${read.observedAt}`,
+    `${read.decision ?? "decision unknown"}; complete=${read.complete ?? "unknown"} fresh=${read.fresh ?? "unknown"}`,
+    `lastTick=${read.lastTick?.at ?? "unknown"} ok=${read.lastTick?.ok ?? "unknown"}; lastOk=${read.lastOk?.at ?? "unknown"}`,
+    ...a ? [`Runtime allowance: used=$${a.usedUsd} remaining=$${a.remainingUsd} pace=$${a.paceUsdPerDay}/day asOf=${a.asOf} source=${a.source}`] : [],
+    ...read.unknowns.length ? [`Unknowns: ${read.unknowns.join("; ")}`] : []
+  ].join("\n");
+}
+var object, iso;
+var init_ci_hosted_usage = __esm({
+  "src/ci-hosted-usage.ts"() {
+    "use strict";
+    object = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+    iso = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -28181,10 +28248,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.28",
-    tag: "v4.6.28",
-    commit: "e21db51c4641",
-    npm: "@mutmutco/cli@4.6.28"
+    version: "4.6.29",
+    tag: "v4.6.29",
+    commit: "36e01a038f52",
+    npm: "@mutmutco/cli@4.6.29"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28201,14 +28268,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.28"
+          v3Target: "v4.6.29"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.28 and redeploy the Hub Lambda from tag v4.6.28 (e21db51c4641); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.28 (@mutmutco/cli@4.6.28, tag commit e21db51c4641 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.29 and redeploy the Hub Lambda from tag v4.6.29 (36e01a038f52); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.29 (@mutmutco/cli@4.6.29, tag commit 36e01a038f52 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31376,15 +31443,15 @@ function parseRuntimeIdentity(log, expected) {
   if (proofs.length !== 1) return unavailable("invalid-proof");
   const encoded = proofs[0].slice(prefix.length).trim();
   if (encoded.length > 16384) return unavailable("invalid-proof");
-  const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+  const object2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
   const keys = (v, allowed) => Object.keys(v).length === allowed.length && Object.keys(v).every((k) => allowed.includes(k));
   const text = (v, re) => typeof v === "string" && re.test(v);
   try {
     const p = JSON.parse(encoded);
-    if (JSON.stringify(p) !== encoded || !object(p)) return unavailable("invalid-proof");
+    if (JSON.stringify(p) !== encoded || !object2(p)) return unavailable("invalid-proof");
     if (p.version !== 1) return unavailable("unsupported-version");
     const parts = expected.repo.split("/");
-    if (parts.length !== 2 || !parts.every(Boolean) || !object(p.target) || !keys(p.target, ["slug", "stage"]) || p.target.slug !== parts[1].toLowerCase() || p.target.stage !== expected.stage) return unavailable("target-mismatch");
+    if (parts.length !== 2 || !parts.every(Boolean) || !object2(p.target) || !keys(p.target, ["slug", "stage"]) || p.target.slug !== parts[1].toLowerCase() || p.target.stage !== expected.stage) return unavailable("target-mismatch");
     if (p.status === "unavailable") {
       if (!keys(p, ["version", "target", "status", "reason"]) || typeof p.reason !== "string" || !["selection-unavailable", "inspection-failed", "snapshot-changed", "output-too-large"].includes(p.reason)) return unavailable("invalid-proof");
       return unavailable(p.reason);
@@ -31392,7 +31459,7 @@ function parseRuntimeIdentity(log, expected) {
     if (!keys(p, ["version", "target", "status", "slot", "replicas"]) || p.status !== "available" || p.slot !== "blue" && p.slot !== "green" || !Array.isArray(p.replicas) || !p.replicas.length) return unavailable("invalid-proof");
     const seen = /* @__PURE__ */ new Set();
     for (const r of p.replicas) {
-      if (!object(r) || !keys(r, ["service", "container", "configuredRef", "actualImageID", "repoDigests", "health", "state"]) || !text(r.service, /^[A-Za-z0-9][A-Za-z0-9_-]*$/) || !text(r.container, /^[a-f0-9]{64}$/) || !text(r.configuredRef, /^[A-Za-z0-9][A-Za-z0-9._/@:-]*$/) || !text(r.actualImageID, /^sha256:[a-f0-9]{64}$/) || !Array.isArray(r.repoDigests) || !r.repoDigests.every((d) => text(d, /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/)) || (typeof r.health !== "string" || !["healthy", "unhealthy", "starting", "not-configured", "unknown"].includes(r.health)) || r.state !== "running" || seen.has(r.container)) return unavailable("invalid-proof");
+      if (!object2(r) || !keys(r, ["service", "container", "configuredRef", "actualImageID", "repoDigests", "health", "state"]) || !text(r.service, /^[A-Za-z0-9][A-Za-z0-9_-]*$/) || !text(r.container, /^[a-f0-9]{64}$/) || !text(r.configuredRef, /^[A-Za-z0-9][A-Za-z0-9._/@:-]*$/) || !text(r.actualImageID, /^sha256:[a-f0-9]{64}$/) || !Array.isArray(r.repoDigests) || !r.repoDigests.every((d) => text(d, /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/)) || (typeof r.health !== "string" || !["healthy", "unhealthy", "starting", "not-configured", "unknown"].includes(r.health)) || r.state !== "running" || seen.has(r.container)) return unavailable("invalid-proof");
       seen.add(r.container);
     }
     return p;
@@ -58712,6 +58779,7 @@ function registerApiReadCommands(program3, overrides) {
     if (zip !== (o.out !== void 0)) {
       const shapes = "api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}";
       if (!zip && o.out !== void 0) {
+        if (req.kind === "contents") return fail(`${shapes} \u2014 for this file's bytes, drop --out and use \`--accept raw\` with a redirect: \`mmi-cli devops api get "${req.path}" --accept raw > <file>\` (decoded bytes on stdout, no base64 or JSON.parse). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
         return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>), or use the typed read (e.g. \`mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion\`). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
       }
       return fail(`${shapes} \u2014 append \`--out <file>\` to this command (e.g. \`MMI_ACTOR=app mmi-cli devops api get ${req.path} --out .jerv/tmp/job.log\`), or for job logs use the typed read \`MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> --job <name|id>\`. Shell redirection (\`>\` / \`2>&1\`) is not a substitute: this refusal exits 1 on stderr with nothing written to stdout, so \`>\` leaves a zero-byte file \u2014 delete it and check the exit code.`);
@@ -71172,6 +71240,24 @@ function parseWindow(raw, nowMs) {
   }
   return { ok: true, value: { since: formatUtc(nowMs - span), label: value, isDefault: false } };
 }
+function parseUntil(raw, nowMs) {
+  if (raw === void 0) return { ok: true, value: void 0 };
+  const value = raw.trim();
+  if (ABSOLUTE_WINDOW_RE.test(value)) return { ok: true, value: { until: value, label: value } };
+  const rel = RELATIVE_WINDOW_RE.exec(value);
+  if (!rel) {
+    return {
+      ok: false,
+      reason: `--until must be a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (got '${value}')`
+    };
+  }
+  const unit = rel[2] === "m" ? MINUTE_MS : rel[2] === "h" ? 60 * MINUTE_MS : 24 * 60 * MINUTE_MS;
+  const span = Number(rel[1]) * unit;
+  if (span > TENANT_LOG_WINDOW_MAX_MS) {
+    return { ok: false, reason: `--until ${value} is wider than 30d \u2014 the journal keeps 7 days, so a wider window buys no history and unbounded work` };
+  }
+  return { ok: true, value: { until: formatUtc(nowMs - span), label: value } };
+}
 function tenantLogUnitPrefix(slug, stage) {
   if (!SLUG_RE.test(slug)) return { ok: false, reason: `'${slug}' is not a tenant slug \u2014 refusing to build a unit namespace from it` };
   if (!TENANT_LOG_STAGES.includes(stage)) {
@@ -71263,6 +71349,11 @@ async function readTenantLogs(deps, opts) {
   const nowMs = deps.now();
   const window = parseWindow(opts.since, nowMs);
   if (!window.ok) return window;
+  const until = parseUntil(opts.until, nowMs);
+  if (!until.ok) return until;
+  if (until.value && Date.parse(until.value.until) <= Date.parse(window.value.since)) {
+    return { ok: false, reason: `--until ${until.value.label} must be after --since ${window.value.label}` };
+  }
   if (opts.grep !== void 0 && opts.grep.length === 0) return { ok: false, reason: "--grep needs a non-empty literal needle" };
   const slug = opts.repo.includes("/") ? (opts.repo.split("/").pop() ?? "").toLowerCase() : opts.repo.toLowerCase();
   const facts = await deps.deployFacts(slug);
@@ -71273,7 +71364,8 @@ async function readTenantLogs(deps, opts) {
     stage: coords.value.stage,
     action: "logs",
     lines: tail.value,
-    logSince: window.value.since
+    logSince: window.value.since,
+    logUntil: until.value?.until
   });
   const credentials = deps.credentials?.() ?? [];
   const bounded = applyBound(redactJournal(read.logs ?? "", credentials), tail.value);
@@ -71296,12 +71388,15 @@ async function readTenantLogs(deps, opts) {
         since: window.value.since,
         sinceLabel: window.value.label,
         sinceIsDefault: window.value.isDefault,
+        ...until.value ? { until: until.value.until, untilLabel: until.value.label } : {},
         truncated: bounded.truncated,
         dropped: bounded.dropped,
         received: bounded.received
       },
-      ...opts.grep ? { grep: { needle: opts.grep, matched: filtered.matched } } : {},
-      units: observedUnits(filtered.lines, coords.value.unitPrefix),
+      ...opts.grep ? { grep: { needle: opts.grep, matched: filtered.matched, scanned: lines2.length } } : {},
+      // #9878: report units from the BOUNDED lines, not the grep survivors — a grep miss must still say
+      // which units answered, or a filter miss reads as data loss.
+      units: observedUnits(lines2, coords.value.unitPrefix),
       lines: filtered.lines,
       conclusion: read.conclusion,
       ...read.runUrl ? { runUrl: read.runUrl } : {},
@@ -71314,18 +71409,18 @@ function renderTenantLogs(r) {
     `runtime tenant logs ${r.repo} ${r.stage} \u2014 journald on the stage's own box, slot resolved from the tenant's coords (no unit name, no slot flag)`,
     `  tenant   ${r.slug} (DEPLOY#${r.stage})${r.box ? ` box ${r.box}` : ""}${r.deployedTag ? ` tag ${r.deployedTag}` : ""}`,
     `  units    ${r.unitPrefix}* (journald tag namespace derived from the coords)`,
-    `  window   since ${r.bound.since}${r.bound.sinceIsDefault ? " (default 1h)" : ""} \u2014 journald keys by container NAME, so a deploy-recreated container still answers`,
+    `  window   since ${r.bound.since}${r.bound.sinceIsDefault ? " (default 1h)" : ""}${r.bound.until ? ` until ${r.bound.until}` : ""} \u2014 journald keys by container NAME, so a deploy-recreated container still answers`,
     `  bound    last ${r.bound.tail} line(s) of that window (max ${r.bound.tailMax}, default ${r.bound.tailDefault})`
   ];
   if (r.bound.truncated) {
     out.push(`  NOTE     the box returned ${r.bound.received} line(s); the bound kept the last ${r.bound.tail} and dropped ${r.bound.dropped}`);
   }
   if (r.grep) {
-    out.push(`  grep     '${r.grep.needle}' kept ${r.grep.matched} of ${r.lines.length === r.grep.matched ? r.lines.length : r.bound.tail} returned line(s) \u2014 the filter runs on the BOUNDED tail, not the whole journal; widen --tail/--since to search further back`);
+    out.push(`  grep     '${r.grep.needle}' kept ${r.grep.matched} of ${r.grep.scanned} bounded line(s) \u2014 the filter runs on the BOUNDED tail, not the whole journal; widen --tail or narrow with --since/--until to search further back`);
   }
   out.push(`  observed ${r.units.length ? r.units.map((u) => `${u.unit} (${u.lines})`).join(", ") : `no ${r.unitPrefix}* lines in this window`}`);
   if (!r.lines.length) {
-    out.push("  (no lines \u2014 the window is empty for this tenant stage; widen --since rather than concluding the app was quiet)");
+    out.push(r.grep && r.grep.scanned > 0 ? `  NOTE     grep matched 0 of ${r.grep.scanned} bounded line(s) \u2014 that is a filter miss, not an empty window; narrow with --since/--until or widen --tail` : "  (no lines \u2014 the window is empty for this tenant stage; widen --since rather than concluding the app was quiet)");
   } else {
     out.push("---8<---");
     out.push(...r.lines);
@@ -73402,7 +73497,7 @@ tenant.command("status <owner/repo> <stage>").description("read tenant runtime r
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false || result.edgeCertificate?.missing) process.exitCode = 1;
 });
-tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenant stage's application journal (journald, so a deploy-recreated container still answers) \u2014 the unit namespace comes from the tenant's DEPLOY coords and the blue/green slot is chosen on the box, never from a flag; bounded and redacted (#9230)").option("--tail <n>", `lines to return (1-${TENANT_LOG_TAIL_MAX}, default ${TENANT_LOG_TAIL_DEFAULT}); the applied bound is printed`).option("--since <window>", "window start: a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (default 1h)").option("--grep <needle>", "keep only returned lines containing this literal text (applied to the bounded tail, not the whole journal)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenant stage's application journal (journald, so a deploy-recreated container still answers) \u2014 the unit namespace comes from the tenant's DEPLOY coords and the blue/green slot is chosen on the box, never from a flag; bounded and redacted (#9230)").option("--tail <n>", `lines to return (1-${TENANT_LOG_TAIL_MAX}, default ${TENANT_LOG_TAIL_DEFAULT}); the applied bound is printed`).option("--since <window>", "window start: a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (default 1h)").option("--until <time>", "window end: same forms as --since (default: now) \u2014 the box returns the newest N lines OF the window, so end it earlier to reach older lines on a busy tenant (#9878)").option("--grep <needle>", "keep only returned lines containing this literal text (applied to the bounded tail, not the whole journal)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   try {
     const cfg = await loadConfig();
     const reg = registryClientDeps(cfg);
@@ -73410,12 +73505,12 @@ tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenan
       {
         deployFacts: (slug) => fetchDeployFactsBySlug(slug, reg),
         // The one dispatch a log read may make. Never watched=false: the run's OUTPUT is the answer.
-        control: (opts) => runTenantControl(trainApplyDeps(), { repo: opts.repo, stage: opts.stage, action: opts.action, watch: true, lines: opts.lines, logSince: opts.logSince }),
+        control: (opts) => runTenantControl(trainApplyDeps(), { repo: opts.repo, stage: opts.stage, action: opts.action, watch: true, lines: opts.lines, logSince: opts.logSince, logUntil: opts.logUntil }),
         now: Date.now,
         // The credentials this process holds, so the repo's exact-string redactor can strip them.
         credentials: () => [process.env.GH_TOKEN].filter((c) => !!c)
       },
-      { repo, stage, tail: o.tail, since: o.since, grep: o.grep }
+      { repo, stage, tail: o.tail, since: o.since, until: o.until, grep: o.grep }
     );
     if (!result.ok) return failGraceful(`runtime tenant logs: ${result.reason}`);
     if (o.json) {
@@ -74132,6 +74227,13 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
   else console.log(renderCiAuditText(report));
   if (!report.ok) process.exitCode = 1;
 });
+ci.command("hosted-usage").description("read-only hosted tick and lane-demand allowance proof from org config").option("--json", "machine-readable output").action(async (o) => {
+  const org = await fetchOrgConfig(registryClientDeps(await loadConfig()));
+  if (!org) return failGraceful("ci hosted-usage: Hub org config unavailable");
+  const { projectHostedUsage: projectHostedUsage2, renderHostedUsage: renderHostedUsage2 } = await Promise.resolve().then(() => (init_ci_hosted_usage(), ci_hosted_usage_exports));
+  const read = projectHostedUsage2(org);
+  console.log(o.json ? JSON.stringify(read, null, 2) : renderHostedUsage2(read));
+});
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
 var runRoot = program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` and `run rerun <id> [--failed]`, both on the org App actions:write profile");

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.28",
+  "version": "4.6.29",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.28",
+  "version": "4.6.29",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",