@mutmutco/cursor-plugin 4.1.4 → 4.1.5

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.1.4",
+  "version": "4.1.5",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and organisation gates for Cursor.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cursor-plugin",
-  "version": "4.1.4",
+  "version": "4.1.5",
   "description": "MMI workflow skills and organisation gates for Cursor.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -23,6 +23,7 @@ name: gate
 #                        main on trunk). `main` is ALWAYS included in the job `if:` below so a required-
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
+# GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
 # Estate policy 2026-08-23: GitHub-hosted Windows (`windows-latest` / windows-*) is forbidden org-wide.
 # Do not add a windows-compat (or any other) job that runs-on GH-hosted Windows. Linux self-hosted
 # (mmi-live / mmi-heavy) is the only CI merge gate. Rare Windows proof stays on the owner's machine or
@@ -58,7 +59,9 @@ jobs:
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+        with:
+          lockfile-path: {{GATE_CACHE_DEP_PATH}}
       # #5427: per-job npm cache under $RUNNER_TEMP — never the shared ~/.npm. Twelve mmi-live lanes
       # share the gha-runner home; npm hardlinks from that cache into node_modules, so one job's
       # `npm ci` can make another job's vitest/dist/workers/forks.js vanish mid-suite (Cannot find
@@ -91,21 +94,17 @@ jobs:
             exit 1
           fi
       - if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with: { node-version: 24, cache: npm, cache-dependency-path: {{GATE_CACHE_DEP_PATH}} }
+        uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: {{GATE_CACHE_DEP_PATH}}
       - if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: '{{GATE_PY_VERSION}}' }
-      # MMI-Hub#3446: assert the runtime toolchain is on PATH BEFORE the install step. A runner whose
-      # node/npm (or python) is missing, or whose setup step raced, fails `{{GATE_INSTALL_CMD}}` with a
-      # bare `command not found` (exit 127) that reads like a broken diff and abandons a correct PR in an
-      # autonomous merge loop. This names the RUNNER instead — a distinguishable infra failure that
-      # `mmi-cli devops pr checks-wait` classifies as rerunnable (title `CI runner toolchain`), mirroring the
-      # disk (#3366) and browser (#808) preflights. No test ran; the diff is not implicated.
-      - name: Toolchain preflight
-        if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
-        run: |
-          node -v && npm -v || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — node/npm not on PATH after setup-node. This is the runner, not your diff; no install or test ran. Re-run the job (a fresh lane usually clears it); if it persists the mmi-runner node toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
+      # MMI-Hub#3446: assert the runtime toolchain is on PATH BEFORE the install step. Node uses the
+      # runner-node-toolchain composite above (setup-node + preflight in one action, #5610). Python
+      # keeps the inline preflight below.
       - name: Toolchain preflight
         if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
         run: |

package/skills/release/SKILL.md

@@ -182,6 +182,19 @@ A different npm MAJOR (e.g. local 12 vs. CI's 11) resolves the same lockfile dif
 <pkg> from lock file` on a lockfile that is not actually broken. Align the local npm major
 (`npm install -g npm@<CI major>`) and re-run `npm ci` before rewriting or regenerating the lockfile.
 
+**A pre-tag `npm publish --dry-run` failure whose stack trace is inside npm internals — e.g.
+libnpmpublish cannot find its declared sigstore dependency (`MODULE_NOT_FOUND`) — is toolchain
+corruption / an npm-major mismatch, not a malformed publish surface (#5616).** Compare toolchains
+BEFORE inspecting package contents (deleted dir, malformed `package.json`, missing `files`):
+```bash
+npm -v
+# green gate npm from the gate log's `node -v && npm -v` toolchain-preflight line (#3446),
+# or the exact node pin in `.github/workflows/gate.yml` (Hub infra gate: node 24.19.0 → npm 11.17.0)
+```
+When local npm differs from the green gate (e.g. local npm 12 vs CI's 11.17.0), align local npm
+(`npm install -g npm@<gate npm>`) and rerun the train — do not rewrite the publish surface for an
+npm-internal missing module.
+
 **A `npm ci was killed (signal SIGTERM)` failure during the fold is a cold npm cache, not a lockfile or
 toolchain problem (#4841).** The signature is the kill, not error text: no `Missing:` line, no lockfile
 complaint at all — the fold's child-process budget expired while a cold cache installed the full tree.