@mutmutco/codex-plugin 4.6.8 → 4.6.9

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.8",
+  "version": "4.6.9",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1236,7 +1236,7 @@ var init_house_map = __esm({
       api: "devops",
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       run: "devops",
-      // #9479: one named workflow run — currently the bounded `run cancel <id>` write
+      // #9479: one named workflow run — the bounded `run cancel <id>` and `run rerun <id>` writes
       ci: "devops",
       // the CI/gate audit
       jev: "devops",
@@ -15347,6 +15347,8 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["ci cancel-orphans", { metadata: "read", actions: "write" }],
   // #9479: one named run cancelled under the same actions:write profile as the orphan sweep.
   ["run cancel", { metadata: "read", actions: "write" }],
+  // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
+  ["run rerun", { metadata: "read", actions: "write" }],
   ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
   // #8401: the detached related-issue lookup (issue list/view reads + one marker comment) — no identity contract.
   ["issue discover-related", { metadata: "read", issues: "write" }]
@@ -25039,10 +25041,15 @@ function checkRunbookCoverage(docs, base, git3) {
       const heading = headings[i];
       const end = headings.slice(i + 1).find((h) => h.level <= heading.level)?.start ?? lines2.length + 1;
       const markerEnd = headings[i + 1]?.start ?? end;
-      const globs = lines2.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
+      const markers = lines2.slice(heading.start, markerEnd - 1).flatMap((text, j) => {
+        const found = /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim());
+        return found ? [{ line: heading.start + 1 + j, globs: found }] : [];
+      });
+      const globs = markers.flatMap((m) => m.globs);
       const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)) && !changesOnlyUses(path2));
       if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
-        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
+        const markerLine = markers.find((m) => m.globs.some((glob) => affected.some((path2) => matches(glob, path2)))).line;
+        findings.push({ kind: "runbook-section-stale", doc, line: markerLine, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}, covers marker at line ${markerLine}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
       }
     }
   }
@@ -27506,10 +27513,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.8",
-    tag: "v4.6.8",
-    commit: "0dd075a0d2c1",
-    npm: "@mutmutco/cli@4.6.8"
+    version: "4.6.9",
+    tag: "v4.6.9",
+    commit: "7cbf84926132",
+    npm: "@mutmutco/cli@4.6.9"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27526,14 +27533,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.8"
+          v3Target: "v4.6.9"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.8 and redeploy the Hub Lambda from tag v4.6.8 (0dd075a0d2c1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.8 (@mutmutco/cli@4.6.8, tag commit 0dd075a0d2c1 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.9 and redeploy the Hub Lambda from tag v4.6.9 (7cbf84926132); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.9 (@mutmutco/cli@4.6.9, tag commit 7cbf84926132 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -32106,8 +32113,11 @@ function classifyRunnerCost(selector) {
 }
 var STANDARD_HOSTED_ALLOWLIST = [
   ["mutmutco/MMI-Hub", ".github/workflows/launcher-build.yml", "build", "windows-latest"],
-  ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"]
+  ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"],
+  // #9571 (MM-Work#8894 chooser): owned mmi-heavy first, included ubuntu-latest only on a deep backlog.
+  ["mutmutco/MMI-Hub", ".github/workflows/gate.yml", "cli-part", "hosted-spill"]
 ];
+var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*'([^']+)'\s*\|\|\s*)?fromJSON\(needs\.[\w-]+\.outputs\.heavy_runs_on\s*\|\|\s*('[^']+')\)\s*\}\}$/;
 function standardHostedLabelFor(repo, path2, jobId) {
   if (repo === "mutmutco/Jerv-Hub") return ["ubuntu-latest", "windows-latest", "macos-14"];
   return STANDARD_HOSTED_ALLOWLIST.find(([r, p, j]) => r === repo && p === path2 && j === jobId)?.[3];
@@ -32122,6 +32132,8 @@ function classifyJobRunnerCost(job, allowance2) {
   if (approved(raw) || allowance2 === "windows-11-arm" && raw === allowance2) return "standard-hosted";
   const fallback = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'([^']+)'\s*\|\|\s*(fromJSON\('[^']+'\))\s*\}\}$/.exec(raw);
   if (fallback && approved(fallback[1]) && classifyRunnerCost("${{ " + fallback[2] + " }}") === "self-hosted") return "standard-hosted";
+  const spill = allowance2 === "hosted-spill" ? HOSTED_SPILL_RE.exec(raw) : null;
+  if (spill) return (!spill[1] || spill[1] === "ubuntu-latest") && classifyRunnerCost(`\${{ fromJSON(${spill[2]}) }}`) === "self-hosted" ? "standard-hosted" : "unknown";
   const direct = classifyRunnerCost(raw);
   const matrix = /^\$\{\{\s*matrix\.([\w-]+)(?:\.([\w-]+))?\s*\}\}$/.exec(raw);
   if (!matrix || direct === "hosted") return direct;
@@ -38643,7 +38655,7 @@ function runsOnLabelSets(job) {
   if (plainRecord(selector)) selector = selector.labels;
   if (typeof selector !== "string" || !selector.includes("${{")) return [toSet(selector)].filter((s) => Boolean(s));
   const sets = [];
-  for (const m of selector.matchAll(/fromJSON\('([^']+)'\)/g)) {
+  for (const m of selector.matchAll(/fromJSON\((?:needs\.[\w-]+\.outputs\.[\w-]+\s*\|\|\s*)?'([^']+)'\)/g)) {
     try {
       const parsed = toSet(JSON.parse(m[1]));
       if (parsed) sets.push(parsed);
@@ -43366,6 +43378,57 @@ function registerRunCancel(run, writeToken) {
     else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status}${receipt.runStatus ? `, runStatus: ${receipt.runStatus}` : ""})`);
   });
 }
+var RUN_RERUN_STATUS = "rerun-requested";
+async function rerunWorkflowRun(repo, id, deps, failed2 = false) {
+  const raw = String(id).trim();
+  if (!/^[1-9]\d*$/.test(raw)) throw new Error(`run rerun: <id> must be a positive workflow run id (received '${String(id)}')`);
+  const runId = Number(raw);
+  if (!Number.isSafeInteger(runId)) throw new Error(`run rerun: <id> ${raw} is beyond the safe integer range; refusing to address a different run`);
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`run rerun: --repo must be owner/repo (received '${repo}')`);
+  const projects = await deps.projects();
+  if (!projects) throw new Error("run rerun: the Hub project registry is unreadable; refusing to rerun on a repo this command cannot prove registered");
+  const key = registryRepoKey(repo);
+  if (!projects.some((p) => (p.repos ?? []).some((r) => typeof r === "string" && registryRepoKey(qualifyRegistryRepo(r)) === key))) {
+    throw new Error(`run rerun: ${repo} is not a registered org repo; App writes are limited to repos in the Hub registry`);
+  }
+  const mode = failed2 ? "failed" : "all";
+  let httpStatus;
+  try {
+    httpStatus = await deps.post(`repos/${repo}/actions/runs/${runId}/${failed2 ? "rerun-failed-jobs" : "rerun"}`);
+  } catch (error) {
+    const e = error;
+    const detail = String(e.stderr ?? error);
+    const code = /\bHTTP(?:\/[\d.]+)? (\d{3})\b/.exec(`${detail} ${e.stdout ?? ""}`)?.[1];
+    if (code === "403") throw new Error(`run rerun: GitHub App denied (HTTP 403) on ${repo}; actions:write permission is required; no personal-token fallback`);
+    if (code === "404") throw new Error(`run rerun: run ${runId} not found on ${repo} (HTTP 404), or the App cannot see that repo`);
+    if (code === "409" || code === "422") throw new Error(`run rerun: run ${runId} is not rerunnable (HTTP ${code}); it may still be in progress, or be past GitHub's rerun window`);
+    throw new Error(`run rerun: ${detail}`);
+  }
+  return { ok: true, repo, runId, mode, httpStatus, credential: "app_installation", status: RUN_RERUN_STATUS };
+}
+function appRunPost(writeToken, exec3 = execFileP) {
+  let token;
+  return async (path2) => {
+    token ??= await writeToken();
+    const { stdout } = await exec3("gh", ["api", "--include", "--method", "POST", path2], {
+      timeout: 2e4,
+      env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" }
+    });
+    return Number(/^HTTP\/[\d.]+ (\d{3})/.exec(stdout)?.[1] ?? 0);
+  };
+}
+function registerRunRerun(run, writeToken, projects) {
+  run.command("rerun <id>").description("rerun one workflow run on the org App (actions:write), registered repos only; --failed reruns only the failed jobs; prints a receipt").requiredOption("--repo <owner/repo>", "registered repository that owns the run").option("--failed", "rerun only the failed jobs (POST .../rerun-failed-jobs)").option("--json", "machine-readable receipt").action(async (id, options) => {
+    let receipt;
+    try {
+      receipt = await rerunWorkflowRun(options.repo, id, { projects, post: appRunPost(writeToken) }, options.failed === true);
+    } catch (error) {
+      return fail(error.message);
+    }
+    if (options.json) console.log(JSON.stringify(receipt));
+    else console.log(`run rerun: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.mode === "failed" ? "failed jobs" : "all jobs"} rerun requested (HTTP ${receipt.httpStatus}, credential: ${receipt.credential})`);
+  });
+}
 
 // src/board-commands.ts
 init_cli_shared();
@@ -69965,7 +70028,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel") return;
+  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel" || commandPath4 === "run rerun") return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -70800,9 +70863,12 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
 });
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
-registerRunCancel(
-  program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` is the only one, and it rides the org App actions:write profile"),
-  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token
+var runRoot = program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` and `run rerun <id> [--failed]`, both on the org App actions:write profile");
+registerRunCancel(runRoot, async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token);
+registerRunRerun(
+  runRoot,
+  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run rerun")).token,
+  async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.8",
+  "version": "4.6.9",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.8",
+  "version": "4.6.9",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",