@mutmutco/kimi-plugin 4.2.4 → 4.2.6

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.2.4",
+  "version": "4.2.6",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kimi-plugin",
-  "version": "4.2.4",
+  "version": "4.2.6",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/command-ladder-core.mjs

@@ -322,7 +322,12 @@ export function analyzeGhLadder(command) {
         replacement: hit.replacement,
         mapped,
         reason:
-          `Command ladder (#2347): use \`${hit.replacement}\` instead of raw \`gh ${hit.object} ${hit.verb}\`. ` +
+          `Command ladder (#2347): use \`${hit.replacement}\` instead of raw \`gh ${hit.object} ${hit.verb}\` — ` +
+          // #5858: the deny aborts the ENTIRE tool call, and the remedy line below invites retrying only
+          // the corrected verb — the one retry that cannot work when a heredoc wrote the body file in the
+          // same call. It fails with ENOENT, which reads as a path bug, not as a discarded write. Same
+          // sentence, same position, as the test-policy guard (#5726).
+          'the ENTIRE command was aborted before execution; no segment ran, so any file write or other step batched into the same call was NOT applied — re-run those steps separately. ' +
           runLine +
           'mmi-cli is the required path for covered board/issue/PR writes in org repos. ' +
           'Genuine gaps stay allowed: gh api reads, gh project, gh issue/pr view|list|close|edit, gh pr checks, gh auth/repo/workflow/run. ' +

package/scripts/edit-tool-paths.mjs

@@ -8,8 +8,10 @@
 //
 // One extractor, used by every edit-shaped hook, so a new host contract is taught in one place.
 
-/** Tool names that mean "this call writes files". */
-export const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'apply_patch', 'ApplyPatch']);
+/** Tool names that mean "this call writes files". `StrReplace` is Cursor's in-place edit tool: it
+ *  carries its target in `tool_input.path` and was outside this set, so even once the adapter matched
+ *  it the gate would have read a non-edit tool and allowed (#5852). */
+export const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'apply_patch', 'ApplyPatch', 'StrReplace']);
 
 export function isEditTool(toolName) {
   return typeof toolName === 'string' && EDIT_TOOL_NAMES.has(toolName);

package/skills/bootstrap/seeds/gate.template.yml

@@ -97,10 +97,14 @@ jobs:
       # cache policy is declared on runner-node-toolchain (cache + cache-restore-max-mb). Per-job
       # NPM_CONFIG_CACHE above is the org default; unbounded Actions cache blobs can exhaust mmi-live
       # disks mid-extract before the real check runs (Jerv-Hub SQLCipher gate, ~4.3GB restore).
+      # MMI-Hub#5871: declare the npm MAJOR rather than inheriting whatever the runner's node bundles.
+      # A bare major, never an exact patch (it goes stale and then prescribes downgrading operator
+      # hosts toward it, #5862) and never `latest` (it takes the next major silently, #4782).
       - if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
         with:
           node-version: 24
+          npm-version: '12'
       - if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: '{{GATE_PY_VERSION}}' }

package/skills/release/SKILL.md

@@ -187,13 +187,37 @@ Treating doctor's exit code as the gate halts a healthy train on cosmetic drift
 operator to ignore doctor's exit code entirely.
 
 **`mmi-cli devops release --apply` and `mmi-cli devops rcand --apply` now run an active npm-major preflight
-before any branch/tag mutation (#5666).** They read the repo's expected CI npm from `.github/workflows/gate.yml`
-(when the infra gate's exact node pin maps to a bundled npm, e.g. node 24.19.0 → npm 11.17.0) or, when
-gate.yml only declares a floating node major with no bundled npm, from the publish workflow's explicit npm pin
-(e.g. `npx --yes npm@11.17.0 pack` in `publish.yml`). Local `npm -v` must match that npm **major**; a
-mismatch refuses `--apply` before any repository write. The receipt gives the supported npm-only repair
-(`npm install -g npm@<exact CI version>`), the `node -v && npm -v` verification, and tells you to rerun the
-same release command. This preserves Node and avoids routing a machine-global mutation through the train.
+before any branch/tag mutation (#5666).** They read the repo's expected CI npm, in this order (#5866):
+an explicit `npm-version:` on the gate's `runner-node-toolchain` step; else the infra gate's exact node pin
+through the bundled-npm map (only for an estate that still carries a retired pre-#5870 pin); else the
+publish workflow's own npm pin (`npm install -g npm@12`, the #5870 retirement shape). Local `npm -v`
+must match that npm **major**; a
+mismatch refuses `--apply` before any repository write.
+
+**Check which side is wrong before repairing (#5862).** The receipt names one direction — move the machine
+to the pin — and that is only right when the pin is current. Compare it against the registry first:
+
+```bash
+npm view npm version      # what npm is actually at
+```
+
+A pin **behind** latest is fixed by a PR moving the pin, not by a machine-global downgrade that every
+release host then inherits. The pin is coordinated, so move all of it together: on Jerv-Hub the same
+version lives in `publish.yml`, `DISTRIBUTION_NPM_VERSION`, `package.json` `packageManager`, and a
+workflow-contract test. Prefer declaring a bare **major** (`npm@12`) over an exact patch — an exact pin
+goes stale and then prescribes downgrades, and `latest` silently takes the next major.
+
+**Bumping the pin can break workflow code that reads npm output (#5862).** `npm pack --json` changed shape
+between majors (npm ≤10 a top-level array, npm ≥11 a name-keyed object) and npm 12 prints the `prepare`
+lifecycle script's stdout ahead of the document, so `JSON.parse(stdout)` throws. An inline
+`const [entry] = JSON.parse(pack.json)` in a workflow step is the hazard — on Jerv-Hub it failed **after**
+`npm publish` had already succeeded, leaving the GitHub Release assets and the Gateway deploy undone. Repo
+scripts that already tolerate both shapes (`scripts/distribution-assembly.mjs`, #4741) are the fix; audit
+inline workflow parsing before bumping.
+
+When the machine genuinely is the wrong side, the receipt's repair (`npm install -g npm@<CI major>`, then
+`node -v && npm -v`, then rerun the same release command) preserves Node and avoids routing a
+machine-global mutation through the train.
 
 **A local `npm ci` failure during the fold on a lockfile CI already accepted is an npm-major mismatch, not a
 bad lockfile (#4578).** Before touching the lockfile, compare toolchains:
@@ -214,10 +238,10 @@ BEFORE inspecting package contents (deleted dir, malformed `package.json`, missi
 ```bash
 npm -v
 # green gate npm from the gate log's `node -v && npm -v` toolchain-preflight line (#3446),
-# the exact node pin in `.github/workflows/gate.yml` (Hub infra gate: node 24.19.0 → npm 11.17.0),
+# the gate's declared `npm-version:`, or an exact node pin that maps to a bundled npm,
 # or the publish workflow npm pin when gate.yml has no bundled npm (#5666)
 ```
-When local npm differs from the green gate (e.g. local npm 12 vs CI's 11.17.0), align local npm
+When local npm differs from the green gate (e.g. local npm 11 vs CI's 12), align local npm
 (`npm install -g npm@<gate npm>`) and rerun the train — do not rewrite the publish surface for an
 npm-internal missing module.
 
@@ -539,6 +563,20 @@ The one remaining caveat: `--watch` blocks only on deploy-model-named runs, not
 deploys — those you conclude from the `workflowRuns` list yourself. Any `failure` there is a failed release
 deploy even when the train reported success — flag it loudly and fix it before calling the release healthy.
 
+**Identify WHICH run is red before believing the wording (#5872).** The release pushes the tag and the
+branch seconds apart, so an ordinary repo CI gate lands on the release SHA too — it is enumerated
+alongside the deploy and publish runs, and a red one reads out as
+`deploy/publish on the release SHA FAILED`. On Jerv-Hub v3.4.4 that sentence appeared while `publish.yml`
+was green and npm was already serving 3.4.4: the red entry was a `gate` push run that had raced the
+shared runner's npm cache (the same SHA's tag-push gate passed, and a re-run passed). A red build gate
+**holds the release unverified but is not a publish failure** — and on Jerv-Hub it defers the fail-closed
+Gateway phase (#5699) until the gate is green, so it must be re-run and the release resumed, not
+re-tagged. Read the run NAMES in `workflowRuns` first:
+
+- `deploy.yml` / `publish.yml` / `tenant-deploy.yml` / `jerv-gateway` — a real deploy or publish verdict.
+- `gate` (or any repo CI workflow) on a `push` event — ordinary CI that happens to share the SHA. Re-run
+  it; nothing about the published artifact is in question.
+
 **Hub releases announce to Slack (#883).** Hub scope is **only** `mutmutco/MMI-Hub`: the commits/PRs on
 `origin/main..origin/development`, this repo's `deploy.yml` + `publish.yml`, and Hub tooling (`mmi-cli`,
 skills, plugin, registry, central workflows). Do **not** read another repo's board (`mmi-cli oracle board` / `/mmi`
@@ -655,6 +693,14 @@ Collect the backgrounded prod-deploy watch from Step 4 (it has typically finishe
 healthy (the central deploy workflow smoke step / a health check); **red** → report the failure prominently and flag
 that the release shipped on a failed deploy (re-run just the deploy — `main` is already correct).
 
+**Say which run is red, never just "deploy/publish failed" (#5872).** `--resume` reports a single
+`deployStatus` for every run on the release SHA, so a flaky repo CI gate that shares that SHA is reported
+in the language of a failed publication — the operator is told publication failed while npm is serving
+the version. Before writing that into a report, name the workflow: a red `deploy.yml` / `publish.yml` /
+`tenant-deploy.yml` / `jerv-gateway` is a real deploy or publish failure; a red `gate` on a `push` event
+is ordinary CI. Both hold the release unverified and both are fixed by re-running that run and resuming —
+neither is ever fixed by re-tagging — but only the first means anything about the artifact.
+
 **This distribution verifier is Hub-only.** It assumes the Hub release fold has already committed its
 generated artifacts. Non-Hub `registry-publish` repositories must not run `release-distribution.mjs
 verify`: use their own release-workflow evidence and the publish-visibility contract below.