@cyanheads/git-mcp-server 2.6.1 → 2.6.3

package/README.md

@@ -7,7 +7,7 @@
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-2.6.1-blue.svg?style=flat-square)](./CHANGELOG.md) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2025--11--25-8A2BE2.svg?style=flat-square)](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.24.3-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Status](https://img.shields.io/badge/Status-Stable-brightgreen.svg?style=flat-square)](https://github.com/cyanheads/git-mcp-server/issues) [![TypeScript](https://img.shields.io/badge/TypeScript-^5.9.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.2.21-blueviolet.svg?style=flat-square)](https://bun.sh/)
+[![Version](https://img.shields.io/badge/Version-2.6.2-blue.svg?style=flat-square)](./CHANGELOG.md) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2025--11--25-8A2BE2.svg?style=flat-square)](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.24.3-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Status](https://img.shields.io/badge/Status-Stable-brightgreen.svg?style=flat-square)](https://github.com/cyanheads/git-mcp-server/issues) [![TypeScript](https://img.shields.io/badge/TypeScript-^5.9.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.2.21-blueviolet.svg?style=flat-square)](https://bun.sh/)
 
 </div>
 

package/dist/index.js

@@ -14356,7 +14356,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@cyanheads/git-mcp-server",
-    version: "2.6.0",
+    version: "2.6.2",
     mcpName: "io.github.cyanheads/git-mcp-server",
     description: "A secure and scalable Git MCP server enabling AI agents to perform comprehensive Git version control operations via STDIO and Streamable HTTP.",
     main: "dist/index.js",
@@ -14440,6 +14440,7 @@ var init_package = __esm(() => {
       "@opentelemetry/semantic-conventions": "^1.38.0",
       "@supabase/supabase-js": "^2.87.1",
       "@types/bun": "^1.3.4",
+      "@types/cross-spawn": "^6.0.6",
       "@types/js-yaml": "^4.0.9",
       "@types/node": "^25.0.1",
       "@types/node-cron": "^3.0.11",
@@ -14530,6 +14531,7 @@ var init_package = __esm(() => {
       }
     ],
     dependencies: {
+      "cross-spawn": "^7.0.6",
       pino: "^10.1.0",
       "pino-pretty": "^13.1.3"
     },
@@ -161116,6 +161118,462 @@ var require_main6 = __commonJS((exports) => {
   }
 });
 
+// node_modules/isexe/windows.js
+var require_windows = __commonJS((exports, module) => {
+  module.exports = isexe;
+  isexe.sync = sync;
+  var fs = __require("fs");
+  function checkPathExt(path2, options) {
+    var pathext = options.pathExt !== undefined ? options.pathExt : process.env.PATHEXT;
+    if (!pathext) {
+      return true;
+    }
+    pathext = pathext.split(";");
+    if (pathext.indexOf("") !== -1) {
+      return true;
+    }
+    for (var i2 = 0;i2 < pathext.length; i2++) {
+      var p = pathext[i2].toLowerCase();
+      if (p && path2.substr(-p.length).toLowerCase() === p) {
+        return true;
+      }
+    }
+    return false;
+  }
+  function checkStat(stat, path2, options) {
+    if (!stat.isSymbolicLink() && !stat.isFile()) {
+      return false;
+    }
+    return checkPathExt(path2, options);
+  }
+  function isexe(path2, options, cb) {
+    fs.stat(path2, function(er, stat) {
+      cb(er, er ? false : checkStat(stat, path2, options));
+    });
+  }
+  function sync(path2, options) {
+    return checkStat(fs.statSync(path2), path2, options);
+  }
+});
+
+// node_modules/isexe/mode.js
+var require_mode = __commonJS((exports, module) => {
+  module.exports = isexe;
+  isexe.sync = sync;
+  var fs = __require("fs");
+  function isexe(path2, options, cb) {
+    fs.stat(path2, function(er, stat) {
+      cb(er, er ? false : checkStat(stat, options));
+    });
+  }
+  function sync(path2, options) {
+    return checkStat(fs.statSync(path2), options);
+  }
+  function checkStat(stat, options) {
+    return stat.isFile() && checkMode(stat, options);
+  }
+  function checkMode(stat, options) {
+    var mod2 = stat.mode;
+    var uid = stat.uid;
+    var gid = stat.gid;
+    var myUid = options.uid !== undefined ? options.uid : process.getuid && process.getuid();
+    var myGid = options.gid !== undefined ? options.gid : process.getgid && process.getgid();
+    var u = parseInt("100", 8);
+    var g = parseInt("010", 8);
+    var o = parseInt("001", 8);
+    var ug = u | g;
+    var ret = mod2 & o || mod2 & g && gid === myGid || mod2 & u && uid === myUid || mod2 & ug && myUid === 0;
+    return ret;
+  }
+});
+
+// node_modules/isexe/index.js
+var require_isexe = __commonJS((exports, module) => {
+  var fs = __require("fs");
+  var core3;
+  if (process.platform === "win32" || global.TESTING_WINDOWS) {
+    core3 = require_windows();
+  } else {
+    core3 = require_mode();
+  }
+  module.exports = isexe;
+  isexe.sync = sync;
+  function isexe(path2, options, cb) {
+    if (typeof options === "function") {
+      cb = options;
+      options = {};
+    }
+    if (!cb) {
+      if (typeof Promise !== "function") {
+        throw new TypeError("callback not provided");
+      }
+      return new Promise(function(resolve, reject) {
+        isexe(path2, options || {}, function(er, is) {
+          if (er) {
+            reject(er);
+          } else {
+            resolve(is);
+          }
+        });
+      });
+    }
+    core3(path2, options || {}, function(er, is) {
+      if (er) {
+        if (er.code === "EACCES" || options && options.ignoreErrors) {
+          er = null;
+          is = false;
+        }
+      }
+      cb(er, is);
+    });
+  }
+  function sync(path2, options) {
+    try {
+      return core3.sync(path2, options || {});
+    } catch (er) {
+      if (options && options.ignoreErrors || er.code === "EACCES") {
+        return false;
+      } else {
+        throw er;
+      }
+    }
+  }
+});
+
+// node_modules/which/which.js
+var require_which = __commonJS((exports, module) => {
+  var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
+  var path2 = __require("path");
+  var COLON = isWindows ? ";" : ":";
+  var isexe = require_isexe();
+  var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
+  var getPathInfo = (cmd, opt) => {
+    const colon = opt.colon || COLON;
+    const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [
+      ...isWindows ? [process.cwd()] : [],
+      ...(opt.path || process.env.PATH || "").split(colon)
+    ];
+    const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
+    const pathExt = isWindows ? pathExtExe.split(colon) : [""];
+    if (isWindows) {
+      if (cmd.indexOf(".") !== -1 && pathExt[0] !== "")
+        pathExt.unshift("");
+    }
+    return {
+      pathEnv,
+      pathExt,
+      pathExtExe
+    };
+  };
+  var which = (cmd, opt, cb) => {
+    if (typeof opt === "function") {
+      cb = opt;
+      opt = {};
+    }
+    if (!opt)
+      opt = {};
+    const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+    const found = [];
+    const step = (i2) => new Promise((resolve, reject) => {
+      if (i2 === pathEnv.length)
+        return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
+      const ppRaw = pathEnv[i2];
+      const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+      const pCmd = path2.join(pathPart, cmd);
+      const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+      resolve(subStep(p, i2, 0));
+    });
+    const subStep = (p, i2, ii) => new Promise((resolve, reject) => {
+      if (ii === pathExt.length)
+        return resolve(step(i2 + 1));
+      const ext = pathExt[ii];
+      isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
+        if (!er && is) {
+          if (opt.all)
+            found.push(p + ext);
+          else
+            return resolve(p + ext);
+        }
+        return resolve(subStep(p, i2, ii + 1));
+      });
+    });
+    return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
+  };
+  var whichSync = (cmd, opt) => {
+    opt = opt || {};
+    const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+    const found = [];
+    for (let i2 = 0;i2 < pathEnv.length; i2++) {
+      const ppRaw = pathEnv[i2];
+      const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+      const pCmd = path2.join(pathPart, cmd);
+      const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+      for (let j = 0;j < pathExt.length; j++) {
+        const cur = p + pathExt[j];
+        try {
+          const is = isexe.sync(cur, { pathExt: pathExtExe });
+          if (is) {
+            if (opt.all)
+              found.push(cur);
+            else
+              return cur;
+          }
+        } catch (ex) {}
+      }
+    }
+    if (opt.all && found.length)
+      return found;
+    if (opt.nothrow)
+      return null;
+    throw getNotFoundError(cmd);
+  };
+  module.exports = which;
+  which.sync = whichSync;
+});
+
+// node_modules/path-key/index.js
+var require_path_key = __commonJS((exports, module) => {
+  var pathKey = (options = {}) => {
+    const environment = options.env || process.env;
+    const platform = options.platform || process.platform;
+    if (platform !== "win32") {
+      return "PATH";
+    }
+    return Object.keys(environment).reverse().find((key) => key.toUpperCase() === "PATH") || "Path";
+  };
+  module.exports = pathKey;
+  module.exports.default = pathKey;
+});
+
+// node_modules/cross-spawn/lib/util/resolveCommand.js
+var require_resolveCommand = __commonJS((exports, module) => {
+  var path2 = __require("path");
+  var which = require_which();
+  var getPathKey = require_path_key();
+  function resolveCommandAttempt(parsed, withoutPathExt) {
+    const env = parsed.options.env || process.env;
+    const cwd = process.cwd();
+    const hasCustomCwd = parsed.options.cwd != null;
+    const shouldSwitchCwd = hasCustomCwd && process.chdir !== undefined && !process.chdir.disabled;
+    if (shouldSwitchCwd) {
+      try {
+        process.chdir(parsed.options.cwd);
+      } catch (err) {}
+    }
+    let resolved;
+    try {
+      resolved = which.sync(parsed.command, {
+        path: env[getPathKey({ env })],
+        pathExt: withoutPathExt ? path2.delimiter : undefined
+      });
+    } catch (e) {} finally {
+      if (shouldSwitchCwd) {
+        process.chdir(cwd);
+      }
+    }
+    if (resolved) {
+      resolved = path2.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+    }
+    return resolved;
+  }
+  function resolveCommand(parsed) {
+    return resolveCommandAttempt(parsed) || resolveCommandAttempt(parsed, true);
+  }
+  module.exports = resolveCommand;
+});
+
+// node_modules/cross-spawn/lib/util/escape.js
+var require_escape3 = __commonJS((exports, module) => {
+  var metaCharsRegExp = /([()\][%!^"`<>&|;, *?])/g;
+  function escapeCommand(arg) {
+    arg = arg.replace(metaCharsRegExp, "^$1");
+    return arg;
+  }
+  function escapeArgument(arg, doubleEscapeMetaChars) {
+    arg = `${arg}`;
+    arg = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"");
+    arg = arg.replace(/(?=(\\+?)?)\1$/, "$1$1");
+    arg = `"${arg}"`;
+    arg = arg.replace(metaCharsRegExp, "^$1");
+    if (doubleEscapeMetaChars) {
+      arg = arg.replace(metaCharsRegExp, "^$1");
+    }
+    return arg;
+  }
+  exports.command = escapeCommand;
+  exports.argument = escapeArgument;
+});
+
+// node_modules/shebang-regex/index.js
+var require_shebang_regex = __commonJS((exports, module) => {
+  module.exports = /^#!(.*)/;
+});
+
+// node_modules/shebang-command/index.js
+var require_shebang_command = __commonJS((exports, module) => {
+  var shebangRegex = require_shebang_regex();
+  module.exports = (string4 = "") => {
+    const match = string4.match(shebangRegex);
+    if (!match) {
+      return null;
+    }
+    const [path2, argument] = match[0].replace(/#! ?/, "").split(" ");
+    const binary2 = path2.split("/").pop();
+    if (binary2 === "env") {
+      return argument;
+    }
+    return argument ? `${binary2} ${argument}` : binary2;
+  };
+});
+
+// node_modules/cross-spawn/lib/util/readShebang.js
+var require_readShebang = __commonJS((exports, module) => {
+  var fs = __require("fs");
+  var shebangCommand = require_shebang_command();
+  function readShebang(command) {
+    const size = 150;
+    const buffer = Buffer.alloc(size);
+    let fd;
+    try {
+      fd = fs.openSync(command, "r");
+      fs.readSync(fd, buffer, 0, size, 0);
+      fs.closeSync(fd);
+    } catch (e) {}
+    return shebangCommand(buffer.toString());
+  }
+  module.exports = readShebang;
+});
+
+// node_modules/cross-spawn/lib/parse.js
+var require_parse5 = __commonJS((exports, module) => {
+  var path2 = __require("path");
+  var resolveCommand = require_resolveCommand();
+  var escape2 = require_escape3();
+  var readShebang = require_readShebang();
+  var isWin = process.platform === "win32";
+  var isExecutableRegExp = /\.(?:com|exe)$/i;
+  var isCmdShimRegExp = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i;
+  function detectShebang(parsed) {
+    parsed.file = resolveCommand(parsed);
+    const shebang = parsed.file && readShebang(parsed.file);
+    if (shebang) {
+      parsed.args.unshift(parsed.file);
+      parsed.command = shebang;
+      return resolveCommand(parsed);
+    }
+    return parsed.file;
+  }
+  function parseNonShell(parsed) {
+    if (!isWin) {
+      return parsed;
+    }
+    const commandFile = detectShebang(parsed);
+    const needsShell = !isExecutableRegExp.test(commandFile);
+    if (parsed.options.forceShell || needsShell) {
+      const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
+      parsed.command = path2.normalize(parsed.command);
+      parsed.command = escape2.command(parsed.command);
+      parsed.args = parsed.args.map((arg) => escape2.argument(arg, needsDoubleEscapeMetaChars));
+      const shellCommand = [parsed.command].concat(parsed.args).join(" ");
+      parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`];
+      parsed.command = process.env.comspec || "cmd.exe";
+      parsed.options.windowsVerbatimArguments = true;
+    }
+    return parsed;
+  }
+  function parse6(command, args, options) {
+    if (args && !Array.isArray(args)) {
+      options = args;
+      args = null;
+    }
+    args = args ? args.slice(0) : [];
+    options = Object.assign({}, options);
+    const parsed = {
+      command,
+      args,
+      options,
+      file: undefined,
+      original: {
+        command,
+        args
+      }
+    };
+    return options.shell ? parsed : parseNonShell(parsed);
+  }
+  module.exports = parse6;
+});
+
+// node_modules/cross-spawn/lib/enoent.js
+var require_enoent = __commonJS((exports, module) => {
+  var isWin = process.platform === "win32";
+  function notFoundError(original, syscall) {
+    return Object.assign(new Error(`${syscall} ${original.command} ENOENT`), {
+      code: "ENOENT",
+      errno: "ENOENT",
+      syscall: `${syscall} ${original.command}`,
+      path: original.command,
+      spawnargs: original.args
+    });
+  }
+  function hookChildProcess(cp, parsed) {
+    if (!isWin) {
+      return;
+    }
+    const originalEmit = cp.emit;
+    cp.emit = function(name, arg1) {
+      if (name === "exit") {
+        const err = verifyENOENT(arg1, parsed);
+        if (err) {
+          return originalEmit.call(cp, "error", err);
+        }
+      }
+      return originalEmit.apply(cp, arguments);
+    };
+  }
+  function verifyENOENT(status, parsed) {
+    if (isWin && status === 1 && !parsed.file) {
+      return notFoundError(parsed.original, "spawn");
+    }
+    return null;
+  }
+  function verifyENOENTSync(status, parsed) {
+    if (isWin && status === 1 && !parsed.file) {
+      return notFoundError(parsed.original, "spawnSync");
+    }
+    return null;
+  }
+  module.exports = {
+    hookChildProcess,
+    verifyENOENT,
+    verifyENOENTSync,
+    notFoundError
+  };
+});
+
+// node_modules/cross-spawn/index.js
+var require_cross_spawn = __commonJS((exports, module) => {
+  var cp = __require("child_process");
+  var parse6 = require_parse5();
+  var enoent = require_enoent();
+  function spawn(command, args, options) {
+    const parsed = parse6(command, args, options);
+    const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
+    enoent.hookChildProcess(spawned, parsed);
+    return spawned;
+  }
+  function spawnSync(command, args, options) {
+    const parsed = parse6(command, args, options);
+    const result = cp.spawnSync(parsed.command, parsed.args, parsed.options);
+    result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
+    return result;
+  }
+  module.exports = spawn;
+  module.exports.spawn = spawn;
+  module.exports.sync = spawnSync;
+  module.exports._parse = parse6;
+  module.exports._enoent = enoent;
+});
+
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -168033,7 +168491,7 @@ function isGitNotFoundError(error46) {
 }
 
 // src/services/git/providers/cli/utils/runtime-adapter.ts
-import { spawn } from "node:child_process";
+var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 function detectRuntime2() {
   if (typeof globalThis.Bun !== "undefined") {
     return "bun";
@@ -168091,11 +168549,15 @@ async function spawnWithNode(args, cwd, env, timeout, signal) {
       reject(new Error(`Git command cancelled before execution: ${args.join(" ")}`));
       return;
     }
-    const proc = spawn("git", args, {
+    const proc = import_cross_spawn.default("git", args, {
       cwd,
       env,
       stdio: ["ignore", "pipe", "pipe"]
     });
+    if (!proc.stdout || !proc.stderr) {
+      reject(new Error("Failed to capture process streams"));
+      return;
+    }
     const stdoutChunks = [];
     const stderrChunks = [];
     proc.stdout.on("data", (chunk) => {
@@ -186014,7 +186476,7 @@ var SuccessResponseSchema = exports_external.object({
 var FilePathSchema = exports_external.string().min(1).regex(/^[^/].*$/, "File path must be relative to repository root").regex(/^(?!.*\.\.).*$/, "File path cannot contain directory traversal").describe("File path relative to repository root.");
 var TagNameSchema = exports_external.string().min(1).max(255).regex(/^[^~^:?*\[\\]+$/, "Invalid tag name format").describe("Tag name (must follow git naming conventions).");
 var CommitMessageSchema = exports_external.string().min(1, "Commit message cannot be empty").max(1e4, "Commit message too long").describe("Commit message.");
-var LimitSchema = exports_external.number().int().positive().max(1000).optional().describe("Maximum number of items to return (1-1000).");
+var LimitSchema = exports_external.number().int().min(1).max(1000).optional().describe("Maximum number of items to return (1-1000).");
 var SkipSchema = exports_external.number().int().nonnegative().optional().describe("Number of items to skip for pagination.");
 var VerboseSchema = exports_external.boolean().default(false).describe("Include verbose/detailed information in output.");
 var QuietSchema = exports_external.boolean().default(false).describe("Suppress informational output (errors only).");
@@ -186022,7 +186484,7 @@ var RecursiveSchema = exports_external.boolean().default(false).describe("Operat
 var AllSchema = exports_external.boolean().default(false).describe("Include all items (varies by operation).");
 var MergeStrategySchema = exports_external.enum(["ort", "recursive", "octopus", "ours", "subtree"]).optional().describe("Merge strategy to use (ort, recursive, octopus, ours, subtree).");
 var PruneSchema = exports_external.boolean().default(false).describe("Prune remote-tracking references that no longer exist on remote.");
-var DepthSchema = exports_external.number().int().positive().optional().describe("Create a shallow clone with history truncated to N commits.");
+var DepthSchema = exports_external.number().int().min(1).optional().describe("Create a shallow clone with history truncated to N commits.");
 var SignSchema = exports_external.boolean().optional().describe("Sign the commit/tag with GPG.");
 var NoVerifySchema = exports_external.boolean().default(false).describe("Bypass pre-commit and commit-msg hooks.");
 
@@ -187867,7 +188329,7 @@ var InputSchema17 = exports_external.object({
   noCommit: exports_external.boolean().default(false).describe("Don't create commit (stage changes only)."),
   continueOperation: exports_external.boolean().default(false).describe("Continue cherry-pick after resolving conflicts."),
   abort: exports_external.boolean().default(false).describe("Abort cherry-pick operation."),
-  mainline: exports_external.number().int().positive().optional().describe("For merge commits, specify which parent to follow (1 for first parent, 2 for second, etc.)."),
+  mainline: exports_external.number().int().min(1).optional().describe("For merge commits, specify which parent to follow (1 for first parent, 2 for second, etc.)."),
   strategy: MergeStrategySchema.describe("Merge strategy to use for cherry-pick."),
   signoff: exports_external.boolean().default(false).describe("Add Signed-off-by line to the commit message.")
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/git-mcp-server",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "mcpName": "io.github.cyanheads/git-mcp-server",
   "description": "A secure and scalable Git MCP server enabling AI agents to perform comprehensive Git version control operations via STDIO and Streamable HTTP.",
   "main": "dist/index.js",
@@ -84,6 +84,7 @@
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@supabase/supabase-js": "^2.87.1",
     "@types/bun": "^1.3.4",
+    "@types/cross-spawn": "^6.0.6",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.0.1",
     "@types/node-cron": "^3.0.11",
@@ -174,6 +175,7 @@
     }
   ],
   "dependencies": {
+    "cross-spawn": "^7.0.6",
     "pino": "^10.1.0",
     "pino-pretty": "^13.1.3"
   },