@mutmutco/codex-plugin 4.6.39 → 4.6.41

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.39",
+  "version": "4.6.41",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -19611,6 +19611,48 @@ function isValidSecretKey(key) {
 function stripTrailingCRLF(value) {
   return value.replace(/\r\n$|\r$|\n$/, "");
 }
+function countCaptureGroups(source) {
+  let count = 0;
+  let inClass = false;
+  for (let i = 0; i < source.length; i += 1) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i += 1;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch !== "(") continue;
+    if (source[i + 1] !== "?") {
+      count += 1;
+      continue;
+    }
+    if (source[i + 2] === "<" && source[i + 3] !== "=" && source[i + 3] !== "!") count += 1;
+  }
+  return count;
+}
+function compileExtractRegex(source) {
+  let re;
+  try {
+    re = new RegExp(source);
+  } catch {
+    return { ok: false, reason: "syntax" };
+  }
+  if (countCaptureGroups(source) !== 1) return { ok: false, reason: "capture-groups" };
+  return { ok: true, re };
+}
+function extractSingleMatch(text, re) {
+  const flags = re.flags.includes("g") ? re.flags : `${re.flags}g`;
+  const all = [...text.matchAll(new RegExp(re.source, flags))];
+  if (all.length !== 1) return { ok: false, count: all.length };
+  return { ok: true, value: all[0][1] ?? "" };
+}
 var ORG_WIDE_SLUGS = /* @__PURE__ */ new Set([ORG_INFRA_SLUG, "shared", "cloudflare", "docs", "mmi-hub"]);
 function classifyTier(slug, _key) {
   return ORG_WIDE_SLUGS.has(slug) ? "org" : "project";
@@ -21231,6 +21273,64 @@ async function secretsSet(deps, key, opts) {
   }
   return putSecret(deps, key, value, opts);
 }
+async function secretsSetFromClipboard(deps, key, opts) {
+  let value;
+  try {
+    if (!isValidSecretKey(key)) {
+      deps.err(`invalid secret key ${JSON.stringify(key)}`);
+      return false;
+    }
+    let re;
+    if (opts.extract !== void 0) {
+      const compiled = compileExtractRegex(opts.extract);
+      if (!compiled.ok) {
+        deps.err(
+          compiled.reason === "syntax" ? "secrets set: --extract is not a valid regular expression \u2014 aborted (nothing written)" : "secrets set: --extract must contain exactly one capture group, e.g. '--token\\s+(\\S+)' \u2014 aborted (nothing written)"
+        );
+        return false;
+      }
+      re = compiled.re;
+    }
+    if (!deps.readClipboard) {
+      deps.err("secrets set: --from-clipboard is not available in this build \u2014 aborted (nothing written)");
+      return false;
+    }
+    let text;
+    try {
+      text = await deps.readClipboard();
+    } catch (e) {
+      deps.err(`secrets set: --from-clipboard: ${e.message}`);
+      return false;
+    }
+    if (re) {
+      const matched = extractSingleMatch(text, re);
+      if (!matched.ok) {
+        deps.err(
+          matched.count === 0 ? "secrets set: --from-clipboard: --extract found no match (0 matches) \u2014 aborted (nothing written)" : `secrets set: --from-clipboard: --extract matched ${matched.count} times \u2014 need exactly one; aborted (nothing written)`
+        );
+        return false;
+      }
+      value = stripTrailingCRLF(matched.value);
+    } else {
+      value = stripTrailingCRLF(text);
+    }
+    if (!value) {
+      deps.err(`secrets set: --from-clipboard: empty value for ${key} \u2014 aborted (nothing written)`);
+      return false;
+    }
+    const ok = await putSecret(deps, key, value, opts);
+    if (ok) deps.log(`set ${key} (${value.length} chars)`);
+    return ok;
+  } finally {
+    if (deps.writeClipboard) {
+      try {
+        await deps.writeClipboard("");
+      } catch (e) {
+        deps.err(`secrets set: warning: could not clear the clipboard \u2014 ${e.message}`);
+      }
+    }
+  }
+}
 var DECLARE_KEY_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
 var DECLARE_STAGES = /* @__PURE__ */ new Set(["dev", "rc", "main"]);
 var DECLARE_CONSUMERS = /* @__PURE__ */ new Set(["runtime", "build", "lambda", "actions", "agent", "box"]);
@@ -22469,7 +22569,10 @@ async function boardDoctor(options, deps = {}) {
         const holderProvenDead = Boolean(
           evidence.marker && evidence.sessionState === "dead" && isHostSessionId(evidence.marker.session) && !evidence.openPr && !evidence.branch
         );
-        const freshMarker = evidence.sessionState === "live" || evidence.sessionState !== "dead" && evidence.markerAgeMs !== void 0 && evidence.markerAgeMs < CLAIM_MARKER_LIVE_MS;
+        const freshMarker = evidence.marker ? !claimStampStaleness(evidence.marker, {
+          activityAt: [evidence.lastCommentAt],
+          sessionState: evidence.sessionState
+        }).stale : false;
         const bits = [
           evidence.marker ? `claim marker ${describeClaimMarker(evidence.marker)} ${formatClaimAge(evidence.markerAgeMs)} old` + (evidence.sessionState ? `; local session ${evidence.sessionState}` : "") : evidence.failed.includes("comments") ? "claim marker unreadable" : "no claim marker",
           evidence.openPr,
@@ -23709,6 +23812,9 @@ function parseClaimReleases(body) {
   }
   return out;
 }
+function isClaimStampComment(body) {
+  return parseClaimMarkers(body).length > 0 || parseClaimReleases(body).length > 0;
+}
 function renderClaimReleaseBody(release) {
   return `Released by \`${formatSessionIdentity(release)}\` at ${release.ts}.
 
@@ -23759,19 +23865,27 @@ function boardItemClaim(item) {
 function claimStampStaleness(marker, evidence = {}, now = Date.now()) {
   const times = [marker.ts, ...evidence.activityAt ?? []].map((t) => t ? Date.parse(t) : Number.NaN);
   const idleMs = now - Math.max(...times.filter(Number.isFinite));
-  return { stale: !evidence.linkedWork && idleMs >= CLAIM_STAMP_IDLE_MS, idleMs };
+  if (evidence.sessionState === "live") return { stale: false, idleMs };
+  if (evidence.linkedWork) return { stale: false, idleMs };
+  return { stale: evidence.sessionState === "dead" || idleMs >= CLAIM_STAMP_IDLE_MS, idleMs };
 }
 function workIsLive(at, now = Date.now()) {
   const idle = now - Date.parse(at ?? "");
   return !Number.isFinite(idle) || idle < CLAIM_STAMP_IDLE_MS;
 }
 function claimFromMarker(item, marker, linked = {}, now = Date.now()) {
+  const sessionState = linked.sessionState ?? probeLocalClaimSession(marker);
   return {
     marker,
     holder: describeClaimMarker(marker),
     ageMs: now - Date.parse(marker.ts),
     currentlyClaimed: item.assignees.length > 0 && item.status === "In Progress",
-    ...claimStampStaleness(marker, { activityAt: [...linked.activityAt ?? []], linkedWork: linked.linkedWork }, now)
+    ...sessionState ? { sessionState } : {},
+    ...claimStampStaleness(marker, {
+      activityAt: [...linked.activityAt ?? []],
+      linkedWork: linked.linkedWork,
+      ...sessionState ? { sessionState } : {}
+    }, now)
   };
 }
 function latestClaimMarkerAuthor(comments) {
@@ -23783,14 +23897,15 @@ function latestClaimMarkerAuthor(comments) {
   }
   return void 0;
 }
-function classifyClaimableMarker(comments, actor, now = Date.now(), activityAt = [], viewerLogin) {
+function classifyClaimableMarker(comments, actor, now = Date.now(), activityAt = [], viewerLogin, sessionState) {
   const marker = comments ? latestClaimMarker(comments) : void 0;
   if (!marker) return { verdict: "claimable" };
   const markerBy = comments ? latestClaimMarkerAuthor(comments) : void 0;
-  if (isSeatClaimMarker(marker, actor, { viewerLogin: viewerLogin ?? markerBy, markerBy, now })) {
+  const state = sessionState ?? probeLocalClaimSession(marker);
+  if (isSeatClaimMarker(marker, actor, { viewerLogin: viewerLogin ?? markerBy, markerBy, now, sessionState: state })) {
     return { verdict: "owned", holder: describeClaimMarker(marker) };
   }
-  if (!claimStampStaleness(marker, { activityAt }, now).stale) {
+  if (!claimStampStaleness(marker, { activityAt, sessionState: state }, now).stale) {
     return { verdict: "taken", holder: describeClaimMarker(marker) };
   }
   return { verdict: "claimable" };
@@ -23845,10 +23960,12 @@ async function markStaleClaimStamps(scope, readComments, options = {}) {
         markerBy: markerBy ?? (bucket === "userOwned" ? item.assignees[0] : void 0),
         now
       });
+      const sessionState = (options.probeSessionState ?? probeLocalClaimSession)(marker);
       const prs = (options.pullRequests ?? []).filter((pr) => pr.closesIssues.some((ref) => ref.toLowerCase() === item.ref.toLowerCase()));
       item.claim = claimFromMarker(item, marker, {
         activityAt: prs.map((pr) => pr.updatedAt),
-        linkedWork: prs.some((pr) => !pr.updatedAt)
+        linkedWork: prs.some((pr) => !pr.updatedAt),
+        ...sessionState ? { sessionState } : {}
       }, now);
       if (ownSeat && bucket !== "userOwned" && bucket !== "claimable") {
         kept.pop();
@@ -23920,9 +24037,25 @@ async function demoteLiveClaimedClaimables(scope, client, actor = describeSessio
 var CLAIM_SESSION_ACTIVITY_MS = 30 * 6e4;
 var CLAIM_SESSION_PROBE_CACHE_MS = 6e4;
 var claimSessionProbeCache = /* @__PURE__ */ new Map();
-function probeLocalClaimSession(marker, now = Date.now()) {
+function scanSessionTranscripts(root, matches, now) {
+  const pending = [root];
+  while (pending.length) {
+    const dir = pending.pop();
+    for (const entry of (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true })) {
+      const path2 = (0, import_node_path15.join)(dir, entry.name);
+      if (entry.isDirectory()) pending.push(path2);
+      else if (entry.isFile() && matches(entry.name.toLowerCase())) {
+        return now - (0, import_node_fs18.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead";
+      }
+    }
+  }
+  return "dead";
+}
+function probeLocalClaimSession(marker, now = Date.now(), roots = {}) {
   if (!isHostSessionId(marker.session) || !marker.host || marker.host.toLowerCase() !== (0, import_node_os11.hostname)().toLowerCase()) return void 0;
-  if (!marker.surface?.toLowerCase().startsWith("claude")) return void 0;
+  const surface = marker.surface?.toLowerCase() ?? "";
+  const kind = surface.startsWith("claude") ? "claude" : surface.startsWith("jerv") || surface.startsWith("pi") ? "jerv" : void 0;
+  if (!kind) return void 0;
   const cacheKey = `${marker.host.toLowerCase()}/${marker.session}`;
   const cached = claimSessionProbeCache.get(cacheKey);
   if (cached && now - cached.checkedAt <= CLAIM_SESSION_PROBE_CACHE_MS) return cached.state;
@@ -23930,21 +24063,10 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     claimSessionProbeCache.set(cacheKey, { checkedAt: now, state });
     return state;
   };
-  const root = (0, import_node_path15.join)((0, import_node_os11.homedir)(), ".claude", "projects");
-  try {
-    const wanted = `${marker.session}.jsonl`.toLowerCase();
-    const pending = [root];
-    while (pending.length) {
-      const dir = pending.pop();
-      for (const entry of (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true })) {
-        const path2 = (0, import_node_path15.join)(dir, entry.name);
-        if (entry.isDirectory()) pending.push(path2);
-        else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs18.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
-        }
-      }
-    }
-    return remember("dead");
+  try {
+    const session = marker.session.toLowerCase();
+    const state = kind === "claude" ? scanSessionTranscripts(roots.claude ?? (0, import_node_path15.join)((0, import_node_os11.homedir)(), ".claude", "projects"), (name) => name === `${session}.jsonl`, now) : scanSessionTranscripts(roots.jerv ?? (0, import_node_path15.join)((0, import_node_os11.homedir)(), ".jerv", "agent", "sessions"), (name) => name.endsWith(`_${session}.jsonl`), now);
+    return remember(state);
   } catch {
     return remember("unverifiable");
   }
@@ -23992,7 +24114,7 @@ async function gatherClaimLiveness(client, repo, number, fetchOpenPulls) {
     out.marker = latestClaimMarker(rows);
     if (!out.marker) out.releasedAt = latestClaimRelease(rows)?.ts;
     for (let i = comments.length - 1; i >= 0; i -= 1) {
-      if (comments[i].created_at && !latestClaimMarker([rows[i]])) {
+      if (comments[i].created_at && !isClaimStampComment(rows[i].body)) {
         out.lastCommentAt = comments[i].created_at;
         break;
       }
@@ -24067,7 +24189,7 @@ function liveEvidenceLines(evidence, repo) {
   if (evidence.marker && evidence.sessionState === "live") {
     live.push(`claim session ${describeClaimMarker(evidence.marker)} has recent local transcript activity`);
   } else if (evidence.marker && evidence.sessionState !== "dead") {
-    const { stale, idleMs } = claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt] });
+    const { stale, idleMs } = claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt], sessionState: evidence.sessionState });
     const marker = describeClaimMarker(evidence.marker);
     if (!stale) {
       live.push(evidence.lastCommentAt && Date.parse(evidence.lastCommentAt) > Date.parse(evidence.marker.ts) ? `claim marker from ${marker} is ${formatClaimAge(evidence.markerAgeMs)} old but the issue was commented ${formatClaimAge(idleMs)} ago (session not locally probeable)` : `claim marker from ${marker} is only ${formatClaimAge(evidence.markerAgeMs)} old (session not locally probeable)`);
@@ -24161,7 +24283,7 @@ async function checkLaneContest(client, item, actor = describeSessionIdentity(),
     }
   }
   const carry = staleWorkLines(evidence);
-  const staleStamp = !contested && !resume && !ownSeat && evidence.marker ? `stale claim stamp ${describeClaimMarker(evidence.marker)} (idle ${formatClaimAge(claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt] }).idleMs)})${carry.length ? `; continue its ${carry.join(" and ")}` : ""}` : void 0;
+  const staleStamp = !contested && !resume && !ownSeat && evidence.marker ? `stale claim stamp ${describeClaimMarker(evidence.marker)} (idle ${formatClaimAge(claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt], sessionState: evidence.sessionState }).idleMs)})${carry.length ? `; continue its ${carry.join(" and ")}` : ""}` : void 0;
   return {
     contested,
     live,
@@ -28405,10 +28527,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.39",
-    tag: "v4.6.39",
-    commit: "2669c496b69e",
-    npm: "@mutmutco/cli@4.6.39"
+    version: "4.6.41",
+    tag: "v4.6.41",
+    commit: "2cf5b22abb64",
+    npm: "@mutmutco/cli@4.6.41"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28425,14 +28547,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.39"
+          v3Target: "v4.6.41"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.39 and redeploy the Hub Lambda from tag v4.6.39 (2669c496b69e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.39 (@mutmutco/cli@4.6.39, tag commit 2669c496b69e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.41 and redeploy the Hub Lambda from tag v4.6.41 (2cf5b22abb64); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.41 (@mutmutco/cli@4.6.41, tag commit 2cf5b22abb64 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -47190,7 +47312,7 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 
 // src/box-commands.ts
 var import_node_fs39 = require("node:fs");
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_os20 = require("node:os");
 var import_node_path36 = require("node:path");
 
@@ -47418,6 +47540,7 @@ init_cli_shared();
 
 // src/secrets-commands.ts
 var import_node_fs37 = require("node:fs");
+var import_node_child_process12 = require("node:child_process");
 var import_node_path34 = require("node:path");
 var import_node_os19 = require("node:os");
 init_cli_shared();
@@ -48684,9 +48807,122 @@ function makeSecretsDeps(cfg) {
     slug: async () => (await repoProject(cfg)).toLowerCase(),
     readSecretValue: () => readSecretStdin(),
     log: (m) => console.log(m),
-    err: (m) => console.error(m)
+    err: (m) => console.error(m),
+    // #10056: the sanctioned clipboard handoff — read/write the OS clipboard directly, never through a
+    // shell, so a pasted value cannot be re-parsed by cmd.exe/PowerShell.
+    readClipboard: () => readClipboardText(),
+    writeClipboard: (value) => clearClipboard(value)
   };
 }
+var CLIPBOARD_TIMEOUT_MS = 1e4;
+function clipboardReadCommands(platform2) {
+  if (platform2 === "win32") return [{ cmd: "powershell", args: ["-NoProfile", "-Command", "Get-Clipboard -Raw"] }];
+  if (platform2 === "darwin") return [{ cmd: "pbpaste", args: [] }];
+  return [
+    { cmd: "wl-paste", args: ["-n"] },
+    { cmd: "xclip", args: ["-selection", "clipboard", "-o"] }
+  ];
+}
+function clipboardClearCommands(platform2) {
+  if (platform2 === "win32") return [{ cmd: "powershell", args: ["-NoProfile", "-Command", "Set-Clipboard -Value ' '"] }];
+  if (platform2 === "darwin") return [{ cmd: "pbcopy", args: [], input: "" }];
+  return [
+    { cmd: "wl-copy", args: ["--clear"] },
+    { cmd: "xclip", args: ["-selection", "clipboard"], input: "" }
+  ];
+}
+function clipboardFailure(command, error) {
+  const code = error.code;
+  if (code === "ENOENT") return `${command.cmd}: not found`;
+  if (typeof code === "number") return `${command.cmd}: exit ${code}`;
+  return `${command.cmd}: could not run`;
+}
+function runClipboardCommand(command) {
+  return new Promise((resolveRun, rejectRun) => {
+    const child2 = (0, import_node_child_process12.spawn)(command.cmd, command.args, {
+      shell: false,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const out = [];
+    let settled2 = false;
+    const settle = (error, value) => {
+      if (settled2) return;
+      settled2 = true;
+      clearTimeout(timer);
+      if (error) rejectRun(error);
+      else resolveRun(value ?? "");
+    };
+    const timer = setTimeout(() => {
+      child2.kill();
+      settle(new Error(`${command.cmd}: timed out`));
+    }, CLIPBOARD_TIMEOUT_MS);
+    timer.unref?.();
+    child2.stdout?.on("data", (chunk) => out.push(chunk));
+    child2.stderr?.on("data", () => {
+    });
+    child2.on("error", (e) => settle(e instanceof Error ? e : new Error(String(e))));
+    child2.on("close", (code) => {
+      if (code === 0) settle(void 0, Buffer.concat(out).toString("utf8"));
+      else settle(Object.assign(new Error(`${command.cmd}: exit ${code}`), { code }));
+    });
+    child2.stdin?.on("error", () => {
+    });
+    child2.stdin?.end(command.input ?? "");
+  });
+}
+async function readClipboardText(platform2 = process.platform) {
+  const failures = [];
+  for (const command of clipboardReadCommands(platform2)) {
+    try {
+      return await runClipboardCommand(command);
+    } catch (e) {
+      failures.push(clipboardFailure(command, e));
+    }
+  }
+  throw new Error(`could not read the clipboard (${failures.join(", ")})`);
+}
+async function clearClipboard(value, platform2 = process.platform) {
+  const failures = [];
+  for (const command of clipboardClearCommands(platform2)) {
+    try {
+      await runClipboardCommand({ ...command, ...command.input !== void 0 ? { input: value } : {} });
+      return;
+    } catch (e) {
+      failures.push(clipboardFailure(command, e));
+    }
+  }
+  throw new Error(`${failures.join(", ")}`);
+}
+function clipboardSourceRefusal(fromClipboard, stdinHasData) {
+  if (!fromClipboard || !stdinHasData) return null;
+  return "secrets set: --from-clipboard conflicts with piped stdin \u2014 remove the pipe (the value comes from the clipboard), or drop --from-clipboard and pipe it";
+}
+async function stdinCarriesData(timeoutMs = 50) {
+  const stdin = process.stdin;
+  if (stdin.isTTY) return false;
+  if (stdin.readableLength > 0) return true;
+  return new Promise((resolveProbe) => {
+    let settled2 = false;
+    const finish = (value) => {
+      if (settled2) return;
+      settled2 = true;
+      clearTimeout(timer);
+      stdin.off("readable", onReadable);
+      stdin.off("end", onEnd);
+      resolveProbe(value);
+    };
+    const onReadable = () => {
+      if (stdin.readableLength > 0) finish(true);
+    };
+    const onEnd = () => finish(false);
+    const timer = setTimeout(() => finish(stdin.readableLength > 0), timeoutMs);
+    timer.unref?.();
+    stdin.once("readable", onReadable);
+    stdin.once("end", onEnd);
+    stdin.once("error", () => finish(false));
+  });
+}
 async function withSecrets(run) {
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
@@ -48833,10 +49069,22 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   }));
   const setHandler = (key, o) => withSecrets(async (d) => {
+    if (o.fromClipboard) {
+      const refusal = clipboardSourceRefusal(true, await stdinCarriesData());
+      if (refusal) return fail(refusal);
+      const ok2 = await secretsSetFromClipboard(d, key, {
+        ...o.repo !== void 0 ? { repo: o.repo } : {},
+        ...o.slug !== void 0 ? { slug: o.slug } : {},
+        ...o.extract !== void 0 ? { extract: o.extract } : {}
+      });
+      if (!ok2) process.exitCode = 1;
+      return;
+    }
+    if (o.extract !== void 0) return fail("secrets set: --extract needs --from-clipboard (it isolates the value inside copied text)");
     const ok = await secretsSet(d, key, o);
     if (!ok) process.exitCode = 1;
   });
-  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix. --slug _org writes an org-infra <provider>/<KEY> coordinate (#3298) \u2014 master or an exact grant, declare-first enforced server-side").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value write \u2014 master or an exact grant (#3298)").action(setHandler);
+  secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix. --slug _org writes an org-infra <provider>/<KEY> coordinate (#3298) \u2014 master or an exact grant, declare-first enforced server-side. --from-clipboard takes the value from the OS clipboard instead of stdin, extracts it with --extract, and CLEARS the clipboard afterwards \u2014 the sanctioned handoff for a secret embedded in copied text (#10056)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for the value write \u2014 master or an exact grant (#3298)").option("--from-clipboard", "read the value from the OS clipboard instead of stdin: powershell Get-Clipboard / pbpaste / wl-paste (xclip fallback). The clipboard is overwritten on EVERY path (success, no match, failed write). Conflicts with piped stdin").option("--extract <regex>", "with --from-clipboard: a regex with EXACTLY ONE capture group whose single match inside the copied text is the value, e.g. --extract '--token\\s+(\\S+)'. Zero or 2+ matches are refused (the count is reported, the text never is). Without --extract the whole clipboard, minus one trailing newline, is the value").action(setHandler);
   secrets.command("copy").description("copy provider keys between stages in your own project vault (audit-logged; encryption keys blocked)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.from) || !stages.includes(o.to)) {
@@ -49662,7 +49910,7 @@ var UsageError = class extends Error {
 var UnreadableError = class extends Error {
 };
 function hubGitShow(ref) {
-  const git3 = (args) => (0, import_node_child_process12.execFileSync)("git", args, { maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  const git3 = (args) => (0, import_node_child_process13.execFileSync)("git", args, { maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
   try {
     git3(["cat-file", "-e", `HEAD:${MANIFEST_PATH}`]);
   } catch {
@@ -49676,7 +49924,7 @@ function runOnBox(found, script) {
   try {
     const recipe = (0, import_node_path36.join)(dir, "recipe.sh");
     (0, import_node_fs39.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
-    const r = (0, import_node_child_process12.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
+    const r = (0, import_node_child_process13.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
@@ -54433,7 +54681,7 @@ async function runRcDataSwitch(deps, opts) {
 }
 
 // src/suite-train-io.ts
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 var import_node_path52 = require("node:path");
 var import_node_fs55 = require("node:fs");
 var import_node_path53 = require("node:path");
@@ -56022,13 +56270,13 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag, workflows = H
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 var GIT_MAX_BUFFER = 512 * 1024 * 1024;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process13.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process14.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
   const revList = (range) => {
     const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -56096,7 +56344,7 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process13.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process14.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
   const isAncestor = (sha, ref) => {
     try {
       git3(["merge-base", "--is-ancestor", sha, ref]);
@@ -57983,7 +58231,7 @@ function prTitleRefusal(title) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_fs54 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
 init_clean_exit();
@@ -59521,7 +59769,7 @@ async function readAppApi(path2, runner = apiReadRunner) {
   return log ? Buffer.from(body, "latin1").toString("utf8") : out;
 }
 function registerApiReadCommands(program3, overrides) {
-  const spawn7 = overrides?.runner ?? apiReadRunner;
+  const spawn8 = overrides?.runner ?? apiReadRunner;
   const jqRun = overrides?.jqRunner ?? systemJqRunner;
   let bindings = [];
   const runGet = async (req, o) => {
@@ -59541,7 +59789,7 @@ function registerApiReadCommands(program3, overrides) {
     let body;
     try {
       body = await runApiGet(
-        async (args, timeoutMs) => zip ? spawn7(args, ZIP_TIMEOUT_MS, env, true) : spawn7(args, timeoutMs, env),
+        async (args, timeoutMs) => zip ? spawn8(args, ZIP_TIMEOUT_MS, env, true) : spawn8(args, timeoutMs, env),
         req.path,
         o.accept
       );
@@ -59787,7 +60035,7 @@ function registerRunLogRead(run, runner) {
 
 // src/app-read-broker.ts
 init_cli_shared();
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 var JSON_FIELD_RE = /^[A-Za-z0-9_,]+$/;
 var ID_RE = /^\d+$/;
@@ -59873,7 +60121,7 @@ function formatJqFailureMessage(code, stderr) {
   return `${base} \u2014 the expression is handed to jq verbatim (mmi-cli never re-quotes it), so if a shell or seat layer collapsed a backslash, use an escape-free form such as \`test("bundle[.]css")\` or \`contains("bundle.css")\`, or drop --jq and filter the JSON locally`;
 }
 var systemJqRunner = (expr, input, env, bindings) => new Promise((resolveOut, reject2) => {
-  const child2 = (0, import_node_child_process14.spawn)("jq", [...process.platform === "win32" ? ["--binary"] : [], "-r", "-c", ...(bindings ?? []).flatMap((b) => [b.kind, b.name, b.value]), expr], { env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+  const child2 = (0, import_node_child_process15.spawn)("jq", [...process.platform === "win32" ? ["--binary"] : [], "-r", "-c", ...(bindings ?? []).flatMap((b) => [b.kind, b.name, b.value]), expr], { env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
   let stdout = "";
   let stderr = "";
   child2.stdout.setEncoding("utf8").on("data", (chunk) => {
@@ -61088,7 +61336,7 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/review-verdict.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_fs49 = require("node:fs");
 var import_node_os25 = require("node:os");
 var import_node_path46 = require("node:path");
@@ -61188,8 +61436,8 @@ async function checkPrReview(number, repo, head, deps = {
 }
 function computePrPatchId(number, repo) {
   return new Promise((resolve8, reject2) => {
-    const gh2 = (0, import_node_child_process15.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-    const git3 = (0, import_node_child_process15.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const gh2 = (0, import_node_child_process16.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const git3 = (0, import_node_child_process16.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
     let ghErr = "";
     let gitErr = "";
@@ -61414,7 +61662,7 @@ async function observePrCreateClaims(body, repoOption, deps = {}) {
 }
 
 // src/pr-create-docs-check.ts
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
@@ -61422,7 +61670,7 @@ function catFileBatch(root, ref, paths) {
   return new Promise((resolve8) => {
     const chunks = [];
     let settled2 = false;
-    const child2 = (0, import_node_child_process16.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
+    const child2 = (0, import_node_child_process17.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
     const finish = (ok = false) => {
       if (settled2) return;
       settled2 = true;
@@ -61761,7 +62009,7 @@ var import_node_path49 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
-var import_node_child_process17 = require("node:child_process");
+var import_node_child_process18 = require("node:child_process");
 var import_node_fs51 = require("node:fs");
 var import_node_path48 = require("node:path");
 var import_node_net = require("node:net");
@@ -61932,7 +62180,7 @@ function stageComposeFileEnv(files) {
 }
 
 // src/stage-runner.ts
-var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process17.execFile);
+var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process18.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
@@ -62576,7 +62824,7 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child2 = (0, import_node_child_process17.spawn)(bash, ["-c", up], {
+  const child2 = (0, import_node_child_process18.spawn)(bash, ["-c", up], {
     cwd,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
     // `taskkill /T /F` (no group needed), and detached+shell defeats windowsHide — every spawn would
@@ -63709,7 +63957,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process18.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -66693,7 +66941,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
     const target = await checkout(repo);
     return new Promise((resolveResult, reject2) => {
-      const child2 = (0, import_node_child_process19.fork)((0, import_node_path52.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+      const child2 = (0, import_node_child_process20.fork)((0, import_node_path52.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
         cwd: target,
         stdio: ["ignore", "inherit", "inherit", "ipc"],
         execArgv: []
@@ -67314,7 +67562,7 @@ function registerJevCommands(program3) {
 }
 
 // src/packages-adopt-export.ts
-var import_node_child_process20 = require("node:child_process");
+var import_node_child_process21 = require("node:child_process");
 var import_node_fs57 = require("node:fs");
 var import_node_os26 = require("node:os");
 var import_node_path54 = require("node:path");
@@ -67971,7 +68219,7 @@ async function adoptExport(opts, deps) {
     (0, import_node_fs57.rmSync)(work, { recursive: true, force: true });
   }
 }
-var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process20.execFile);
+var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process21.execFile);
 var MAX_OUTPUT = 200 * 1024 * 1024;
 async function findPython() {
   for (const bin of ["python3", "python"]) {
@@ -72537,7 +72785,7 @@ async function resolveWhoami(deps) {
 var import_node_path64 = require("node:path");
 
 // src/doc-refs-command-source.ts
-var import_node_child_process21 = require("node:child_process");
+var import_node_child_process22 = require("node:child_process");
 var import_node_fs62 = require("node:fs");
 var import_node_path58 = require("node:path");
 var IN_PROCESS_SOURCE = "in-process";
@@ -72558,7 +72806,7 @@ function inventoryFromManifest(manifest, source) {
   collect(body?.tree);
   return { commandPaths, commandOptions, source };
 }
-function readBundleManifest(bundle, exec3 = import_node_child_process21.execFileSync) {
+function readBundleManifest(bundle, exec3 = import_node_child_process22.execFileSync) {
   try {
     const text = exec3(process.execPath, [bundle, "commands", "--all", "--json"], {
       cwd: (0, import_node_path58.dirname)(bundle),
@@ -72727,7 +72975,7 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process22 = require("node:child_process");
+var import_node_child_process23 = require("node:child_process");
 var import_node_crypto26 = require("node:crypto");
 var import_node_fs64 = require("node:fs");
 var import_node_os28 = require("node:os");
@@ -72873,7 +73121,7 @@ function bomPathFor(root) {
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process22.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process23.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -72997,9 +73245,9 @@ async function runLiveDocRefs(root, deps, live) {
 }
 
 // src/doc-refs-live-io.ts
-var import_node_child_process23 = require("node:child_process");
+var import_node_child_process24 = require("node:child_process");
 var import_node_util7 = require("node:util");
-var exec2 = (0, import_node_util7.promisify)(import_node_child_process23.execFile);
+var exec2 = (0, import_node_util7.promisify)(import_node_child_process24.execFile);
 function createRunbookLiveDeps(cliBin) {
   const json = async (args) => {
     const { stdout } = await exec2(process.execPath, [cliBin, ...args, "--json"], { windowsHide: true, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 });
@@ -73310,7 +73558,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process24 = require("node:child_process");
+var import_node_child_process25 = require("node:child_process");
 var import_node_fs65 = require("node:fs");
 var import_node_path63 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
@@ -73381,7 +73629,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process24.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process25.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.39",
+  "version": "4.6.41",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.39",
+  "version": "4.6.41",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -15,7 +15,7 @@ The server exposes `/health` and `/module.js`. Register the module's bundle URL,
 1. **Single source of truth:** the source folder of `packages/mmwork-ds` in `mutmutco/MM-Work`, owned by the MM-Work Design Lead (tokens, layers, component bundle, component docs, `DESIGN.md` and its `design.json` sidecar). Never edit the kit or its copies here; a missing piece or variant is built there first, or requested via kit MCP `request_piece`.
 2. **MM Artifact on Live Docs:** Live Docs (`Canlı belgeler / MM-Work`) displays document `3a5c79df-5274-40ad-a1b5-a75e67a74dac` (ATOMIC, module `mm-work-kit`), an MM Artifact in the `design-system` format rebuilt from the kit source on every kit release: Overview, Guide (kit README + `DESIGN.md`), Tokens, Atoms, Molecules, Organisms, Templates and Files. Browse it to see every piece live.
 3. **Impeccable knows Atomic Design at boot:** `impeccable context` loads `PRODUCT.md`, `DESIGN.md` and the `design.json` sidecar in `.impeccable`, which carry the Atomic Design contract 1.1.0: `Atoms -> Molecules -> Organisms -> Templates -> Pages`, upward-only composition enforced by `npm --prefix module run lint` (or `npm run lint` inside `module/`; `mmwork-check-ui` and `mmwork-check-i18n` are bins of `@mutmutco/mmwork-ds`, so a bare `npx mmwork-check-ui` outside that project's installed `node_modules` is resolved as a package name and 404s). Pages arrange exported `@mutmutco/mmwork-ds` pieces around one template and never paint custom controls, raw `<button>`/`<input>`, `mw-*` classes, inline visual styles or raw hex/px values.
-4. **Automatic propagation:** on every kit release the Hub kit-adopt workflow opens an adoption PR here that bumps `@mutmutco/mmwork-ds`, runs `mmwork-sync-impeccable`, and writes `DESIGN.md`, the `.impeccable` design manifest and `.impeccable/config.json` (`hook.enabled: true`) at the repository root, and deletes any stale copies under `module/`. These files are kit-owned: do not hand-edit them, and keep them committed even if `.impeccable/` is ignored (the adoption PR force-stages them).
+4. **Automatic propagation:** on every kit release the Hub kit-adopt workflow opens an adoption PR here that bumps `@mutmutco/mmwork-ds`, runs `mmwork-sync-impeccable`, and writes `DESIGN.md`, the `.impeccable` design manifest and `.impeccable/config.json` (`hook.enabled: true`) at the repository root, and deletes any stale copies under `module/`. These files are kit-owned: do not hand-edit them, and keep them committed even if `.impeccable/` is ignored (the adoption PR force-stages them). The adoption PR and any `kit-adopt` failure issue are Hub-owned — merge the PR or leave it for the Hub's scheduled reconcile, and leave failure issues open and unedited; a hand-closed unmerged adoption PR strands the operation until an explicit `--recover-closed-pr` dispatch retires it.
 5. **Root only:** `PRODUCT.md`, `DESIGN.md`, the `.impeccable` design manifest and `.impeccable/config.json` live only at this repository's root, never duplicated under `module/`; a copy there makes Impeccable treat `module/` as a separate root without `PRODUCT.md` and the config. Run `impeccable context` from the root. Any suite-wide propagation of these files needs an explicit intercom ACK handshake with the MM-Work Design Lead naming the files written and removed, `impeccable context` + `impeccable doctor --json` verification, and the issue/PR reference.
 6. **Front-loaded harmony (owner, 2026-10-25; Hub#8837 / MM-Work#7668):** design work runs one workflow — Front-Loaded Impeccable v4.7.0 + MM Artifacts + Live Docs (`Canlı belgeler`, `3a5c79df-5274-40ad-a1b5-a75e67a74dac`) + Atomic Design Kit (`@mutmutco/mmwork-ds`). The former local stage skill is retired; preview and verify through these tools only.