@mutmutco/hub 4.0.4 → 4.0.6

package/dist/index.cjs

@@ -212,6 +212,17 @@ function resolveNpm(env = process.env) {
       return cachedNpm;
     }
   }
+  const bundled = (0, import_node_path2.join)((0, import_node_path2.dirname)(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js");
+  if ((0, import_node_fs2.existsSync)(bundled)) {
+    cachedNpm = { kind: "node-script", script: bundled };
+    return cachedNpm;
+  }
+  const located = (0, import_node_child_process.spawnSync)("/bin/sh", ["-lc", "command -v npm"], { encoding: "utf8", windowsHide: true });
+  const resolved = (located.stdout ?? "").trim().split("\n").map((line) => line.trim()).find(Boolean);
+  if (located.status === 0 && resolved && (0, import_node_fs2.existsSync)(resolved)) {
+    cachedNpm = { kind: "command", command: resolved };
+    return cachedNpm;
+  }
   cachedNpm = { kind: "command", command: "npm" };
   return cachedNpm;
 }
@@ -339,11 +350,12 @@ function checkAtomicity(cachePath, tagCommit, bom, candidate, npm) {
       rows.push({ id: row.id, name, ok: false, detail: `${name}@${candidate} not on npm` });
       continue;
     }
-    if (integrity !== row.identity.value) {
+    const legacySsri = /^sha\d+-/.test(row.identity.value ?? "");
+    if (legacySsri && integrity !== row.identity.value) {
       rows.push({ id: row.id, name, ok: false, detail: `${name}@${candidate} dist.integrity differs from BOM identity` });
       continue;
     }
-    rows.push({ id: row.id, name, ok: true, detail: `${name}@${candidate} published, integrity matches` });
+    rows.push({ id: row.id, name, ok: true, detail: legacySsri ? `${name}@${candidate} published, integrity matches` : `${name}@${candidate} published` });
   }
   return { ok: rows.length > 0 && rows.every((row) => row.ok), rows };
 }
@@ -548,6 +560,9 @@ var import_node_child_process5 = require("node:child_process");
 var import_node_fs7 = require("node:fs");
 var import_node_os3 = require("node:os");
 var import_node_path6 = require("node:path");
+function convergedAtOrAbove(installed, target, healthy) {
+  return healthy && typeof installed === "string" && compareSemver(installed, target) >= 0;
+}
 function cmdArg(value) {
   return /^[A-Za-z0-9_@./:\\=+-]+$/.test(value) ? value : `"${value.replaceAll('"', '""')}"`;
 }
@@ -671,9 +686,12 @@ function claudeArm(options) {
     }
     observed = claudeMmi(runner, env);
   }
-  if (observed.row?.version !== options.target || observed.row.enabled !== true) {
+  if (!convergedAtOrAbove(observed.row?.version, options.target, observed.row?.enabled === true)) {
     return { surface: "claude", from, to: observed.row?.version ?? "unknown", verdict: "fail", detail: `post-update evidence is version ${observed.row?.version ?? "missing"}, enabled=${String(observed.row?.enabled)}, expected ${options.target}/true` };
   }
+  if (observed.row.version !== options.target) {
+    return { surface: "claude", from, to: observed.row.version, verdict: "skip", detail: `installed ${observed.row.version} is above candidate ${options.target} (monotonic)` };
+  }
   return { surface: "claude", from, to: options.target, verdict: "ok", detail: `catalog refreshed; converged and verified ${from ?? "absent"} -> ${options.target}` };
 }
 var SNAPSHOT_MISSING = /marketplace snapshot|marketplace root does not contain/i;
@@ -713,9 +731,12 @@ function codexArm(options) {
     }
     observed = codexMmi(runner, env);
   }
-  if (observed.row?.version !== options.target || observed.row.installed !== true || observed.row.enabled !== true) {
+  if (!convergedAtOrAbove(observed.row?.version, options.target, observed.row?.installed === true && observed.row?.enabled === true)) {
     return { surface: "codex", from, to: observed.row?.version ?? "unknown", verdict: "fail", detail: `post-upgrade evidence is version ${observed.row?.version ?? "missing"}, installed=${String(observed.row?.installed)}, enabled=${String(observed.row?.enabled)}, expected ${options.target}/true/true` };
   }
+  if (observed.row.version !== options.target) {
+    return { surface: "codex", from, to: observed.row.version, verdict: "skip", detail: `installed ${observed.row.version} is above candidate ${options.target} (monotonic)` };
+  }
   return { surface: "codex", from, to: options.target, verdict: "ok", detail: `marketplace upgraded; payload refresh and native evidence verified at ${options.target}` };
 }
 var KILO_PACKAGE = "@mutmutco/kilo-plugin";
@@ -1965,12 +1986,24 @@ code = shell.Run("""${vbsQuote(nodeExe)}"" ""${vbsQuote(hubDist)}"" update", 0,
 WScript.Quit code
 `;
 }
-function launcherSh(nodeExe, hubDist) {
+function loginPath(fallback = process.env.PATH ?? "") {
+  const probe = (0, import_node_child_process9.spawnSync)("/bin/sh", ["-lc", 'printf %s "$PATH"'], { encoding: "utf8", windowsHide: true, timeout: 1e4 });
+  const captured = (probe.status === 0 ? probe.stdout ?? "" : "").trim();
+  const source = captured || fallback;
+  const durable = source.split(":").filter((entry) => entry && !/^\/(?:private\/)?(?:tmp|var\/folders)\//.test(entry));
+  return [...new Set(durable)].join(":");
+}
+function launcherSh(nodeExe, hubDist, capturedPath = loginPath()) {
   const shQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
+  const pathLine = capturedPath ? `PATH=${shQuote(capturedPath)}:"$PATH"
+export PATH
+` : "";
   return `#!/bin/sh
 # MMI Hub maintenance launcher \u2014 generated by \`mmi-hub autoupdate on\`.
 # The exit code is propagated and reported by \`mmi-hub status\`.
-exec ${shQuote(nodeExe)} ${shQuote(hubDist)} update
+# PATH is the one captured when autoupdate was enabled: a scheduler's PATH is not the interactive
+# one, and every surface below is reached through a command that lives outside it (#5278).
+${pathLine}exec ${shQuote(nodeExe)} ${shQuote(hubDist)} update
 `;
 }
 function taskXml(launcherPath, workDir, userId, startBoundary) {
@@ -2225,9 +2258,23 @@ function installWindowsTask(env) {
   }
   return { ok: true, detail: `enabled "${TASK_NAME}" \u2014 ${CADENCE} \u2192 ${hubDist}` };
 }
+function refreshPosixLauncher(env) {
+  const hubDist = globalDist(env, "@mutmutco/hub", "dist/index.cjs");
+  if (!hubDist) return null;
+  const paths = ensureState(env);
+  const launcherPath = (0, import_node_path12.join)(paths.root, POSIX_LAUNCHER_FILE);
+  const desired = launcherSh(process.execPath, hubDist);
+  if (readFileOrNull(launcherPath) === desired) return null;
+  (0, import_node_fs14.writeFileSync)(launcherPath, desired, "utf8");
+  (0, import_node_fs14.chmodSync)(launcherPath, 493);
+  return launcherPath;
+}
 function installLaunchd(env) {
   const current = darwinSchedulerStatus(env);
-  if (current.ok) return { ok: true, detail: `already enabled \u2014 ${current.detail}` };
+  if (current.ok) {
+    const refreshed = refreshPosixLauncher(env);
+    return { ok: true, detail: refreshed ? `already enabled; launcher refreshed \u2014 ${current.detail}` : `already enabled \u2014 ${current.detail}` };
+  }
   const hubDist = globalDist(env, "@mutmutco/hub", "dist/index.cjs");
   if (!hubDist) return { ok: false, detail: "cannot resolve the global @mutmutco/hub dist \u2014 run `npm install -g @mutmutco/hub` first" };
   const paths = ensureState(env);
@@ -2248,7 +2295,10 @@ function installLaunchd(env) {
 }
 function installSystemdTimer(env) {
   const current = linuxSchedulerStatus(env);
-  if (current.ok) return { ok: true, detail: `already enabled \u2014 ${current.detail}` };
+  if (current.ok) {
+    const refreshed = refreshPosixLauncher(env);
+    return { ok: true, detail: refreshed ? `already enabled; launcher refreshed \u2014 ${current.detail}` : `already enabled \u2014 ${current.detail}` };
+  }
   const hubDist = globalDist(env, "@mutmutco/hub", "dist/index.cjs");
   if (!hubDist) return { ok: false, detail: "cannot resolve the global @mutmutco/hub dist \u2014 run `npm install -g @mutmutco/hub` first" };
   const paths = ensureState(env);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/hub",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "description": "Install and maintain the MMI CLI and every present host surface from one release-gated Hub command.",
   "type": "module",
   "license": "UNLICENSED",