@cldmv/gh-broker 0.7.0 → 0.9.0

package/package.json

@@ -1,13 +1,19 @@
 {
 	"name": "@cldmv/gh-broker",
-	"version": "0.7.0",
+	"version": "0.9.0",
 	"description": "Local credential-routing MCP proxy: holds per-org GitHub PATs out of the agent's reach, routes by repo owner, exposes a config-driven default-deny toolset in front of GitHub's hosted MCP.",
 	"type": "module",
 	"license": "Apache-2.0",
 	"bin": {
-		"gh-broker": "./dist/index.mjs"
+		"gh-broker": "./deploy/install.mjs"
 	},
 	"main": "./dist/index.mjs",
+	"files": [
+		"dist",
+		"deploy",
+		"config.example.json",
+		"config.sample.json"
+	],
 	"engines": {
 		"node": ">=22.12.0"
 	},
@@ -50,16 +56,16 @@
 	"homepage": "https://github.com/CLDMV/gh-broker#readme",
 	"devDependencies": {
 		"@cldmv/configs": "^1.3.0",
-		"@cldmv/fix-headers": "^2.2.1",
-		"@cldmv/vitest-runner": "^1.5.4",
-		"@types/node": "^26.6.5",
-		"@vitest/coverage-v8": "^5.0.2",
+		"@cldmv/fix-headers": "^2.2.3",
+		"@cldmv/vitest-runner": "^1.5.6",
+		"@types/node": "^26.6.6",
+		"@vitest/coverage-v8": "^5.0.5",
 		"esbuild": "^0.28.2",
 		"typescript": "^6.0.3",
-		"vitest": "^5.0.3"
+		"vitest": "^5.0.5"
 	},
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "^1.32.1",
+		"@modelcontextprotocol/sdk": "^1.32.2",
 		"@octokit/auth-app": "^8.3.1",
 		"@octokit/core": "^7.0.8"
 	},
@@ -68,5 +74,9 @@
 	},
 	"allowScripts": {
 		"esbuild": true
+	},
+	"overrides": {
+		"katex": ">=0.19.1 <1.0.0",
+		"minimatch": "^11.0.3"
 	}
 }

package/.configs/fix-headers.json

@@ -1,3 +0,0 @@
-{
-	"extends": "@cldmv/configs/fix-headers.json"
-}

package/.configs/vitest.config.mjs

@@ -1,44 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /.configs/vitest.config.mjs
- *	@Date: 2026-08-02T16:55:52-07:00 (1785714952)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { defineConfig } from "vitest/config";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-export default defineConfig({
-	root,
-	test: {
-		include: ["tests/**/*.test.vitest.mts"],
-		exclude: ["node_modules", "dist"],
-		environment: "node",
-		testTimeout: 30000,
-		reporters: ["dot"],
-		coverage: {
-			provider: "v8",
-			include: ["src/**/*.ts"],
-			// index.ts is the process entrypoint (arg parse + wire + listen);
-			// types.ts is type-only (elided at compile time — zero runtime code).
-			// Neither is unit-testable. server.ts (the stdio<->socket bridge) is
-			// deliberately NOT excluded — its logic is real and only partly covered,
-			// so it should show honestly rather than be hidden. Measured units are
-			// the pure logic: config, router/owner-routing, catalog, audit, secrets,
-			// verbs, upstream, appauth.
-			exclude: ["tests/**", "**/*.json", "src/index.ts", "src/types.ts"],
-			reporter: ["text", "html", "json-summary", "json"]
-		}
-	}
-});

package/.github/dependabot.yml

@@ -1,111 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/dependabot.yml
-#	@Date: 2026-05-26T00:00:00-07:00 (1779778800)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/dependabot.yml
-#
-# Dependabot configuration tuned for the v4 staging-branch release flow.
-#
-# How it fits with v4:
-#   - All Dependabot PRs target `next` so they pool with every other
-#     contributor change and batch into the next release.
-#   - `dependabot-auto-merge.yml` (in this same folder) auto-merges
-#     patch/minor bumps into `next` after CI passes — zero-touch pooling.
-#     Delete that workflow if you'd rather review each bump by hand.
-#   - Security updates are detected by `hotfix-redirector.yml`
-#     (release-flow-v4/) by GHSA references in the PR body and auto-promoted
-#     from `next` → `hotfixes` so they ship via the hotfix lane, not the
-#     next-batch release. No special routing needed in this config.
-#
-# Customize per repo:
-#   - Add or remove `package-ecosystem` blocks for your stack (gomod, pip,
-#     bundler, gradle, maven, cargo, docker, etc.).
-#   - Adjust `directory` if your manifests don't live at the repo root.
-#   - Tighten `open-pull-requests-limit` if Dependabot's noise is too much.
-#   - Add `allow` / `ignore` rules for specific packages.
-#   - Add `groups` to bundle related bumps into a single PR.
-
-version: 2
-updates:
-    # GitHub Actions: keep pinned action SHAs / version tags fresh.
-    - package-ecosystem: "github-actions"
-      directory: "/"
-      target-branch: "next"
-      schedule:
-          interval: "weekly"
-      open-pull-requests-limit: 5
-      commit-message:
-          prefix: "deps"
-      # Grouped PRs cut noise: one PR per (security | patch | minor) bundle
-      # per week instead of N separate PRs. Security PRs still get retargeted
-      # to `hotfixes` by hotfix-redirector.yml when GHSA refs appear in the
-      # body — bundling N GHSA fixes into one PR is fine, the redirector
-      # only needs one match to retarget.
-      groups:
-          security:
-              applies-to: security-updates
-              patterns: ["*"]
-          patch:
-              applies-to: version-updates
-              update-types: ["patch"]
-          minor:
-              applies-to: version-updates
-              update-types: ["minor"]
-
-    # NPM: package.json + package-lock.json updates.
-    # Delete this block if your repo isn't a Node project.
-    - package-ecosystem: "npm"
-      directory: "/"
-      target-branch: "next"
-      schedule:
-          interval: "weekly"
-      open-pull-requests-limit: 5
-      commit-message:
-          prefix: "deps"
-      groups:
-          # vitest and @vitest/coverage-v8 (and other @vitest/* packages) peer
-          # each other EXACTLY, so a partial bump (e.g. vitest to 5.0.0 while
-          # @vitest/coverage-v8 stays 4.1.11) breaks `npm ci` with an ERESOLVE.
-          # Bump the whole family together in one PR so the exact-peer
-          # versions never diverge. Must come before security/patch/minor
-          # below — Dependabot assigns each update to the FIRST matching
-          # group, and this one has no applies-to restriction so it always
-          # wins for vitest-family packages regardless of update type.
-          vitest:
-              patterns:
-                  - "vitest"
-                  - "@vitest/*"
-          # @eslint/js peers eslint with a major-locked range ("^10.0.0"), so a
-          # future eslint major bump without @eslint/js moving too would hit
-          # the same npm ci ERESOLVE class as the vitest/coverage-v8 split.
-          # @cldmv/eslint-plugin-jsonv doesn't peer eslint directly but is
-          # bundled here to keep the lint-config family moving together.
-          eslint:
-              patterns:
-                  - "eslint"
-                  - "@eslint/*"
-                  - "@cldmv/eslint-plugin-*"
-          # @cldmv/prettier-plugin-jsonv peers prettier with a major-locked
-          # range ("^3.0.0") — same reasoning as the eslint group above.
-          prettier:
-              patterns:
-                  - "prettier"
-                  - "@cldmv/prettier-plugin-*"
-          security:
-              applies-to: security-updates
-              patterns: ["*"]
-          patch:
-              applies-to: version-updates
-              update-types: ["patch"]
-          minor:
-              applies-to: version-updates
-              update-types: ["minor"]

package/.github/workflows/branch-retention.yml

@@ -1,44 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/branch-retention.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/branch-retention.yml
-#
-# On PR merge: most branches deleted immediately; release/* keeps last 5,
-# hotfix/* keeps last 3. master/main/badges/gh-pages never touched.
-#
-# v4 flow: feature PRs merge into `next` and hotfix PRs into `hotfixes`
-# (not directly into master). next/hotfixes are in the branches: filter
-# below so this workflow fires on those PR closures too — otherwise
-# feat/* / fix/* / chore/* etc. would pile up on origin indefinitely.
-# (Repos that haven't adopted v4 just won't see those branches; the
-# extra entries in the filter are harmless.)
-name: 🌿 Branch Retention
-
-on:
-    pull_request:
-        types: [closed]
-        branches: [master, main, next, hotfixes]
-
-permissions:
-    contents: read
-
-jobs:
-    retain:
-        permissions:
-            contents: write
-            pull-requests: read
-        if: github.event.pull_request.merged == true
-        uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/bundle-size.yml

@@ -1,52 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/bundle-size.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/bundle-size.yml
-#
-# Only relevant for runtime libraries where bundle size matters (e.g.
-# @cldmv/slothlet). Skip this template for tool repos / meta repos.
-#
-# Fork-PR caveat: builds PR-supplied code, so we use `pull_request`
-# (NOT pull_request_target). Fork builds run safely without secrets;
-# comment posting fails for fork PRs because the token is read-only.
-# Maintainer can run via workflow_dispatch after reviewing the code.
-#
-# Batch 5.4 from tmp/plan-future-workflows.md.
-name: 📊 Bundle Size
-
-on:
-    pull_request:
-        types: [opened, synchronize, reopened, ready_for_review]
-        branches: [master, main]
-    workflow_dispatch:
-
-permissions:
-    contents: read
-    pull-requests: write
-
-jobs:
-    diff:
-        uses: CLDMV/.github/.github/workflows/reusable-bundle-size.yml@v4
-        with:
-            build_command: "npm run build:ci"
-            dist_paths: "dist/**"
-            # warning_pct: 5
-            # warning_bytes: 500
-            # comment_mode: "update"
-        # Optional. Without these, the size-diff comment is posted by
-        # github-actions[bot]. With these, it's posted by your CLDMV bot App.
-        # Note: fork PRs can't access org secrets, so the bot attribution only
-        # applies to same-repo PRs; fork PRs fall back to GITHUB_TOKEN.
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}