@mutmutco/pi-plugin 4.5.102 → 4.5.104

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.5.102",
+  "version": "4.5.104",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -507,7 +507,11 @@ the bootstrap seed Dockerfile and compose templates). The seeded compose is file
 `labels: { mmi.runtime-env: "true" }`, no `env_file`, and a loopback-only port; the deploy injects the stage's
 vault values at runtime (`DEPLOY#<stage>.noEnvFile: true`) and the app reads plain env vars — it must **not** self-load SSM and must **not** ship a committed `.env`.
 
-For a `web-app` that declares `oauth` META, print the canonical OAuth surface and provision the client once:
+For a `suite: mm-work` tenant-container module, bootstrap apply selects the MM-Work module seed instead: a live `/health` server and `/module.js`, the example module scaffold, secret-backed image build, and `gate` plus `screens / screens`. It sets `requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"]` and requires only `gate`. Before the first CI/deploy, an org admin must grant the repo Read on both `@mutmutco/mmwork-ds` and `@mutmutco/mmwork-screens` under Package settings → Manage Actions access (no GitHub REST API; verify names the manual step). Add `screens / screens` to `requiredChecks` only after the screens job is green, or every PR blocks.
+
+**Never provision a Google OAuth client for an MM-Work suite module, even if old META declares `oauth`.** Modules sign in through the MM-Work pass and reach Google via `ctx.act`; read the package's GUIDE. The suite seed omits the Google-login guide.
+
+For a non-suite `web-app` that declares `oauth` META, print the canonical OAuth surface and provision the client once:
 
 ```bash
 mmi-cli vault org oauth plan --repo "$OWNER/$REPO"        # the exact JS origins + redirect URIs + canonical SSM keys

package/skills/bootstrap/seeds/suite-Dockerfile.template

@@ -0,0 +1,32 @@
+# MM-Work module tenant container: the TypeScript server plus the module bundle it serves.
+
+# The module bundle. The GitHub Packages token (for @mutmutco/mmwork-ds) arrives as a BuildKit secret
+# and is never written into a layer; compose passes it from the registry's requiredBuildSecrets.
+FROM node:24-bookworm-slim AS module-build
+WORKDIR /module
+COPY module/package.json module/package-lock.json module/.npmrc ./
+RUN --mount=type=secret,id=NODE_AUTH_TOKEN,env=NODE_AUTH_TOKEN npm ci --no-audit --no-fund
+COPY module/src ./src
+COPY module/vite.config.mjs ./
+RUN npm run build
+
+# The server.
+FROM node:24-bookworm-slim AS server-build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build && npm prune --omit=dev
+
+FROM node:24-bookworm-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=server-build /app/package.json ./package.json
+COPY --from=server-build /app/node_modules ./node_modules
+COPY --from=server-build /app/dist ./dist
+COPY --from=module-build /module/dist/module.js ./module/dist/module.js
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "dist/index.js"]

package/skills/bootstrap/seeds/suite-compose.template.yml

@@ -0,0 +1,26 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      secrets:
+        - NODE_AUTH_TOKEN
+    restart: unless-stopped
+    # Fileless deploy (DEPLOY#<stage>.noEnvFile: true): no .env exists. tenant-deploy.yml streams the
+    # stage-scoped vault values over SSH into a tmpfs (/dev/shm) runtime env, and the box injects them
+    # into every service labelled mmi.runtime-env. Never add env_file.
+    labels:
+      mmi.runtime-env: "true"
+    environment:
+      NODE_ENV: production
+      MMI_STAGE: ${MMI_STAGE:-dev}
+      MMI_PORT: ${MMI_PORT:-3000}
+      PORT: ${PORT:-3000}
+      MMI_EDGE_DOMAIN: ${MMI_EDGE_DOMAIN:-}
+    ports:
+      # Loopback only: the box Caddy is the one public door (TLS), never the bare port.
+      - "127.0.0.1:${MMI_PORT:-3000}:${PORT:-3000}"
+
+secrets:
+  NODE_AUTH_TOKEN:
+    environment: NODE_AUTH_TOKEN

package/skills/bootstrap/seeds/suite-files.template.json

@@ -0,0 +1 @@
+{ "result": { "items": [{ "id": "sample", "name": "Sample brief" }] } }

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -0,0 +1,35 @@
+name: gate
+on:
+  pull_request:
+  push:
+    branches: {{GATE_PUSH_BRANCHES_YAML}}
+    tags: ['v*']
+concurrency:
+  group: gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  packages: read
+jobs:
+  gate:
+    runs-on: [self-hosted, linux, x64, mmi-live]
+    timeout-minutes: 10
+    steps:
+      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+        with:
+          lockfile-path: package-lock.json
+      - name: Isolate npm cache
+        run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
+      - uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
+        with:
+          node-version: 24
+          npm-version: '12'
+      - run: npm ci --no-audit --no-fund
+      - run: npm ci --prefix module --no-audit --no-fund
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        with:
+          command: npm run typecheck && npm run build && npm --prefix module run check
+          max-seconds: {{GATE_MAX_SECONDS}}
+          working-directory: .

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -0,0 +1,11 @@
+# MM-Work module
+
+Read the matching `module/node_modules/@mutmutco/mmwork-ds/GUIDE.md` before changing this module. The starter entry and Vite setting come from MM-Work's `examples/example-module`; replace the example screens with your product's screens using only the shared design system.
+
+Sign-in belongs to MM-Work: verify its pass before adding protected backend routes. Do not provision a Google OAuth client or implement a separate login. Google and other shared services are reached through `ctx.act`, not module-owned credentials.
+
+Before the first CI/deploy, an org admin must grant this repo **Read** on `@mutmutco/mmwork-ds` under **Package settings → Manage Actions access**. This has no GitHub REST API. The Actions token installs the module in CI; the tenant image build uses the registry's `NODE_AUTH_TOKEN=@github-packages-token` BuildKit secret. Never commit a token.
+
+The server exposes `/health` and `/module.js`. Register the module's bundle URL, id, name and capabilities with MM-Work following the GUIDE. The seed deliberately exposes no authenticated product API yet.
+
+`gate` installs and checks the backend and module. `screens / screens` follows MM-PM's non-blocking PR/push/tag shape, using MM-Work's reusable runner with `run: false` (browser audits are not merge gates). Configure scheduled/on-demand screen audits separately when the product has screens to audit.