@mutmutco/codex-plugin 4.6.45 → 4.6.47

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.45",
+  "version": "4.6.47",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -28556,10 +28556,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.45",
-    tag: "v4.6.45",
-    commit: "0a8549c195cd",
-    npm: "@mutmutco/cli@4.6.45"
+    version: "4.6.47",
+    tag: "v4.6.47",
+    commit: "4555234d7aa8",
+    npm: "@mutmutco/cli@4.6.47"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28576,14 +28576,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.45"
+          v3Target: "v4.6.47"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.45 and redeploy the Hub Lambda from tag v4.6.45 (0a8549c195cd); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.45 (@mutmutco/cli@4.6.45, tag commit 0a8549c195cd \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.47 and redeploy the Hub Lambda from tag v4.6.47 (4555234d7aa8); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.47 (@mutmutco/cli@4.6.47, tag commit 4555234d7aa8 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -42864,7 +42864,11 @@ async function runPrLandOnce(prNumber, options, deps) {
   };
   base.checksWait = await deps.waitForChecks(prNumber, repo);
   const waitError = await checksWaitError(base.checksWait);
-  if (waitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
+  if (waitError) {
+    if (!hasQueue || base.checksWait.status === "conflicting") return { ...base, error: waitError };
+    const noQueueEntry = /no-checks-reported/.test(base.checksWait.detail ?? "") ? `no merge-queue entry was created: workflow runs exist on the head but published no check-runs \u2014 inspect them with \`mmi-cli devops read run list --repo ${repo} --commit ${pinned ?? "<full head SHA>"}\`, then re-run \`mmi-cli devops pr land ${prNumber} --repo ${repo}\` once the required check exists` : "no merge-queue entry was created (the land stopped before enqueue)";
+    return { ...base, error: `${waitError} \u2014 ${noQueueEntry}` };
+  }
   const driftAfterChecks = await headDrift("after checks");
   if (driftAfterChecks) return driftAfterChecks;
   prState = prState ?? await readPrState();
@@ -42883,7 +42887,7 @@ async function runPrLandOnce(prNumber, options, deps) {
     }
     base.checksWait = await deps.waitForChecks(prNumber, repo);
     const reWaitError = await checksWaitError(base.checksWait);
-    if (reWaitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
+    if (reWaitError) return { ...base, error: reWaitError };
     prState = await readPrState();
   }
   if (isConflicting(prState)) return { ...base, error: conflictError() };
@@ -44185,8 +44189,8 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     error: `queue submission outcome unknown: ${reason}. Never hand-edit files under the mmi-cli queue-admissions receipt store (%LOCALAPPDATA%/MMI Future/mmi-cli/queue-admissions); read the queue entry with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\`; once the PR is verifiably OPEN at the submitted head and absent from the queue, abandon the stuck admission with \`mmi-cli devops pr land ${pr} --repo ${repo} --abandon-admission\` so a new intent needs no new head \u2014 no new request was sent after this uncertainty.`
   });
   const rejected = (reason) => markReenqueued(admissionRejected(reason, repo, pr));
-  const reconcile = async (reason, recordEntry = false, resumingSaved = false) => {
-    const maxReads = options.enqueueOnly ? 3 : 1;
+  const reconcile = async (reason, recordEntry = false, resumingSaved = false, minReads = 1) => {
+    const maxReads = Math.max(options.enqueueOnly ? 3 : 1, minReads);
     const sleep3 = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
     for (let readAttempt = 0; readAttempt < maxReads; readAttempt++) {
       if (readAttempt) await sleep3(readAttempt * 1e3);
@@ -44317,7 +44321,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     try {
       response = admissionResponse(output);
     } catch {
-      return reconcile("the send response was lost or malformed");
+      return reconcile("the send response was lost or malformed, and queue membership at the submitted head was re-read and not confirmed", true, false, 3);
     }
     const { code, body } = response;
     if (code === 200 && ["enqueued", "merged"].includes(body.status ?? "")) {
@@ -48241,7 +48245,11 @@ function tenantTaskWriteRefusal(existing, patch) {
   const sent = patch.tenantTasks;
   if (sent === null || sent === void 0) return null;
   const merged = /* @__PURE__ */ new Set([...Object.keys(stored), ...Object.keys(sent)]);
-  if (merged.size > 20) return `org project set: ${slug} would hold ${merged.size} tenantTasks (${Object.keys(stored).length} declared today); the cap is 20 \u2014 retire some first with --unset-task <name>`;
+  if (merged.size > 20) {
+    const repo = existing?.repos?.[0] || "<owner/repo>";
+    const names = Object.keys(stored).sort();
+    return `org project set: ${slug} would hold ${merged.size} tenantTasks (${names.length} declared today); the cap is 20 \u2014 retire one first with \`mmi-cli oracle org project set ${repo} --unset-task <name>\`. Declared: ${names.join(", ") || "(none)"}`;
+  }
   return null;
 }
 function secretRemovalRefusal(existing, patch) {
@@ -48479,6 +48487,7 @@ var DEPLOY_BUCKET_RE = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
 var DEPLOY_DISTRIBUTION_ID_RE = /^[A-Z0-9]{5,32}$/;
 var COMPOSE_PROFILE_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
 var MAX_COMPOSE_PROFILES = 8;
+var READINESS_PATH_RE = /^\/[A-Za-z0-9/._~-]*$/;
 function buildSetDeployPatch(_slug, input) {
   const clean4 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
   const stage = clean4(input.stage);
@@ -48547,6 +48556,29 @@ function buildSetDeployPatch(_slug, input) {
     }
     composeProfiles = [...seen];
   }
+  const healthUrl = clean4(input.healthUrl);
+  if (input.clearHealthUrl && healthUrl !== void 0) {
+    throw new Error("org project set-deploy: --clear-health-url cannot be combined with --health-url (they contradict)");
+  }
+  if (healthUrl !== void 0) {
+    let u;
+    try {
+      u = new URL(healthUrl);
+    } catch {
+      u = void 0;
+    }
+    const loopback = u?.hostname === "127.0.0.1" || u?.hostname === "localhost";
+    if (!DEPLOY_SHELL_SAFE_RE.test(healthUrl) || !u || u.protocol !== "https:" && !(u.protocol === "http:" && loopback)) {
+      throw new Error(`org project set-deploy: --health-url must be a shell-safe https URL (or loopback http), got ${JSON.stringify(input.healthUrl)}`);
+    }
+  }
+  const readinessPath = clean4(input.readinessPath);
+  if (input.clearReadinessPath && readinessPath !== void 0) {
+    throw new Error("org project set-deploy: --clear-readiness-path cannot be combined with --readiness-path (they contradict)");
+  }
+  if (readinessPath !== void 0 && !READINESS_PATH_RE.test(readinessPath)) {
+    throw new Error(`org project set-deploy: --readiness-path must be an absolute path of [A-Za-z0-9/._~-], got ${JSON.stringify(input.readinessPath)}`);
+  }
   return {
     stage,
     ...substrate !== void 0 ? { substrate } : {},
@@ -48567,7 +48599,10 @@ function buildSetDeployPatch(_slug, input) {
     ...input.noEnvFile !== void 0 ? { noEnvFile: input.noEnvFile } : {},
     // #7353: an explicit `[]` is what the route reads as "clear them"; omitting the key is what it reads as
     // "keep them" — same patch contract as aliases (#2986/#2984).
-    ...composeProfiles !== void 0 ? { composeProfiles } : {}
+    ...composeProfiles !== void 0 ? { composeProfiles } : {},
+    // #10096: an explicit null is what the route reads as "remove it"; omitting the key keeps it.
+    ...input.clearHealthUrl ? { healthUrl: null } : healthUrl !== void 0 ? { healthUrl } : {},
+    ...input.clearReadinessPath ? { readinessPath: null } : readinessPath !== void 0 ? { readinessPath } : {}
   };
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
@@ -75246,7 +75281,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file/--compose-profiles on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--redirect-from <host>", "permanent redirect host or host=target (primary or alias); repeatable", (host, hosts) => [...hosts, host], []).option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--compose-profiles <profiles>", "comma-separated compose profiles to enable for this stage (e.g. huddles,slack-bridge); omit to leave unchanged").option("--clear-compose-profiles", "remove EVERY compose profile from the row \u2014 omitting --compose-profiles preserves them, so clearing needs saying out loud").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file/--compose-profiles on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--redirect-from <host>", "permanent redirect host or host=target (primary or alias); repeatable", (host, hosts) => [...hosts, host], []).option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--compose-profiles <profiles>", "comma-separated compose profiles to enable for this stage (e.g. huddles,slack-bridge); omit to leave unchanged").option("--clear-compose-profiles", "remove EVERY compose profile from the row \u2014 omitting --compose-profiles preserves them, so clearing needs saying out loud").option("--health-url <url>", "master-only: stage health URL (https, or loopback http) the box health gate probes; omit to leave unchanged").option("--clear-health-url", "master-only: remove the stored health URL from the row").option("--readiness-path <path>", "master-only: readiness path Caddy actively probes (health_uri, e.g. /healthz); omit to leave unchanged").option("--clear-readiness-path", "master-only: remove the stored readiness path from the row").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -75305,7 +75340,11 @@ ${filelessTransitionGuide(target, o.stage)}`
       clearAliases: o.clearAliases,
       noEnvFile,
       composeProfiles,
-      clearComposeProfiles: o.clearComposeProfiles
+      clearComposeProfiles: o.clearComposeProfiles,
+      healthUrl: o.healthUrl,
+      clearHealthUrl: o.clearHealthUrl,
+      readinessPath: o.readinessPath,
+      clearReadinessPath: o.clearReadinessPath
     });
     if (target.includes("/")) body.repo = target;
   } catch (e) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.45",
+  "version": "4.6.47",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.45",
+  "version": "4.6.47",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",