@dpesch/mantisbt-mcp-server 1.10.2 → 1.10.6

package/CHANGELOG.md

@@ -11,6 +11,40 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.10.6] – 2026-06-29
+
+### Changed
+
+- Restored automatic npm publishing via Gitea CI pipeline (triggered on version tags). The manual `--provenance` approach was reverted as Sigstore local signing is not supported outside CI environments with OIDC providers.
+
+---
+
+## [1.10.5] – 2026-06-29
+
+### Security
+
+- Fixed `.npmignore` to explicitly exclude sensitive files (`.env*`, `.mcpregistry_*`) and dev artifacts (`src/`, `tests/`, `scripts/`, `.claude/`, `.gitea/`, `.github/`, `.idea/`). Previously, when `.npmignore` exists, npm ignores `.gitignore` entirely — requiring all exclusions to be duplicated. v1.10.4 was unpublished due to accidental inclusion of local credential files; this patch corrects the root cause.
+
+---
+
+## [1.10.4] – 2026-06-29
+
+### Changed
+
+- npm releases are now published with `--provenance`, creating a Sigstore attestation that cryptographically links each package to its source commit. Verifiable with `npm audit signatures @dpesch/mantisbt-mcp-server`.
+
+---
+
+## [1.10.3] – 2026-05-15
+
+### Fixed
+- `upload_file`: file uploads previously used `multipart/form-data` via a now-removed `postFormData` helper. The MantisBT REST API does not accept `multipart/form-data` for file uploads — it expects a JSON body with Base64-encoded content. The tool now sends `POST issues/{id}/files` with a JSON body containing `{ files: [{ name, type, content }] }`. The caller-facing API is unchanged: `file_path` and `content` continue to work as before; the server handles Base64 encoding internally when `file_path` is used.
+
+### Changed
+- `upload_file` tool and parameter descriptions updated: `file_path` is now explicitly marked as the preferred input mode (use whenever the file exists on disk — the server reads and encodes it automatically); `content` is marked as a fallback to be used only when `file_path` is not available (e.g. in-memory data or files not accessible via the server filesystem).
+
+---
+
 ## [1.10.2] – 2026-05-03
 
 ### Changed

package/README.de.md

@@ -2,6 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@dpesch/mantisbt-mcp-server)](https://www.npmjs.com/package/@dpesch/mantisbt-mcp-server)
 [![license](https://img.shields.io/npm/l/@dpesch/mantisbt-mcp-server)](LICENSE)
+[![MCP compatible](https://img.shields.io/badge/MCP-compatible-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
 [![MCP Badge](https://lobehub.com/badge/mcp/dpesch-mantisbt-mcp-server)](https://lobehub.com/mcp/dpesch-mantisbt-mcp-server)
 [![MantisBT MCP Server](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server/badges/card.svg)](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server)
 
@@ -106,7 +107,7 @@ npm run build
 | Tool | Beschreibung |
 |---|---|
 | `list_issue_files` | Anhänge eines Issues auflisten |
-| `upload_file` | Datei an ein Issue anhängen – entweder per lokalem `file_path` oder Base64-kodiertem `content` + `filename` |
+| `upload_file` | Datei an ein Issue anhängen – bevorzugt: lokaler `file_path` (der Server liest und kodiert die Datei automatisch); Fallback: Base64-kodiertes `content` + `filename` (nur verwenden, wenn `file_path` nicht verfügbar ist) |
 
 ### Beziehungen
 

package/README.md

@@ -2,6 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@dpesch/mantisbt-mcp-server)](https://www.npmjs.com/package/@dpesch/mantisbt-mcp-server)
 [![license](https://img.shields.io/npm/l/@dpesch/mantisbt-mcp-server)](LICENSE)
+[![MCP compatible](https://img.shields.io/badge/MCP-compatible-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
 [![MCP Badge](https://lobehub.com/badge/mcp/dpesch-mantisbt-mcp-server)](https://lobehub.com/mcp/dpesch-mantisbt-mcp-server)
 [![MantisBT MCP Server](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server/badges/card.svg)](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server)
 
@@ -106,7 +107,7 @@ npm run build
 | Tool | Description |
 |---|---|
 | `list_issue_files` | List attachments of an issue |
-| `upload_file` | Upload a file to an issue — either by local `file_path` or Base64-encoded `content` + `filename` |
+| `upload_file` | Upload a file to an issue — preferred: local `file_path` (server reads and encodes automatically); fallback: Base64-encoded `content` + `filename` (use only when `file_path` is not available) |
 
 ### Relationships
 

package/dist/client.js

@@ -140,21 +140,6 @@ export class MantisClient {
         });
         return this.handleResponse(response);
     }
-    async postFormData(path, formData) {
-        // Note: Content-Type must NOT be set here — fetch sets it automatically
-        // with the correct multipart/form-data boundary.
-        const { apiKey } = await this.getCredentials();
-        const response = await fetch(await this.buildUrl(path), {
-            method: 'POST',
-            headers: {
-                'Authorization': apiKey,
-                'Accept': 'application/json',
-            },
-            body: formData,
-            signal: AbortSignal.timeout(MantisClient.TIMEOUT_MS),
-        });
-        return this.handleResponse(response);
-    }
     async getVersion() {
         const response = await fetch(await this.buildUrl('users/me'), {
             method: 'GET',

package/dist/tools/files.js

@@ -46,17 +46,17 @@ Use this tool when you need to inspect or enumerate files attached to an issue.
         title: 'Upload File Attachment',
         description: `Upload a file as an attachment to a MantisBT issue. Adds the file to the issue without modifying any issue fields or status. Returns the created attachment metadata on success.
 
-Two input modes — exactly one must be provided:
-- file_path: absolute path to a local file; filename is derived from the path automatically
-- content: Base64-encoded file content; filename must be supplied explicitly via the filename parameter
+Provide exactly one of the two input modes:
+- file_path (preferred): absolute path to a local file — use this whenever the file exists on disk; the server reads and encodes it automatically; filename is derived from the path
+- content: Base64-encoded file content — only use this when the file is not accessible via a path (e.g. in-memory data); filename must be supplied explicitly via the filename parameter
 
 The optional content_type sets the MIME type (e.g. "image/png"); defaults to "application/octet-stream". Use the optional description to annotate the attachment.
 
 Use this tool to attach files such as logs, screenshots, or patches to an existing issue. To list existing attachments, use list_issue_files. To retrieve issue details, use get_issue.`,
         inputSchema: z.object({
             issue_id: z.coerce.number().int().positive().describe('Numeric issue ID'),
-            file_path: z.string().min(1).optional().describe('Absolute path to the local file to upload (mutually exclusive with content)'),
-            content: z.string().min(1).optional().describe('Base64-encoded file content (mutually exclusive with file_path)'),
+            file_path: z.string().min(1).optional().describe('Preferred: absolute path to the local file to upload — use this whenever the file exists on disk (mutually exclusive with content)'),
+            content: z.string().min(1).optional().describe('Fallback: Base64-encoded file content — only use when file_path is not available (mutually exclusive with file_path)'),
             filename: z.string().min(1).optional().describe('File name for the attachment (required when using content; overrides the derived name when using file_path)'),
             content_type: z.string().optional().describe('MIME type of the file, e.g. "image/png" (default: "application/octet-stream")'),
             description: z.string().optional().describe('Optional description for the attachment'),
@@ -74,7 +74,7 @@ Use this tool to attach files such as logs, screenshots, or patches to an existi
             if (file_path && content) {
                 return { content: [{ type: 'text', text: 'Error: Only one of file_path or content may be provided' }], isError: true };
             }
-            let fileBuffer;
+            let base64Content;
             let fileName;
             if (file_path) {
                 if (normalizedUploadDir) {
@@ -83,23 +83,22 @@ Use this tool to attach files such as logs, screenshots, or patches to an existi
                         return { content: [{ type: 'text', text: errorText('file_path is not allowed — access restricted to the designated upload directory') }], isError: true };
                     }
                 }
-                fileBuffer = await readFile(file_path);
+                const fileBuffer = await readFile(file_path);
+                base64Content = fileBuffer.toString('base64');
                 fileName = filename ?? basename(file_path);
             }
             else {
                 if (!filename) {
                     return { content: [{ type: 'text', text: 'Error: filename is required when using content' }], isError: true };
                 }
-                fileBuffer = Buffer.from(content, 'base64');
+                base64Content = content;
                 fileName = filename;
             }
-            const blob = new Blob([new Uint8Array(fileBuffer)], { type: content_type ?? 'application/octet-stream' });
-            const formData = new FormData();
-            formData.append('file', blob, fileName);
-            if (description) {
-                formData.append('description', description);
-            }
-            const result = await client.postFormData(`issues/${issue_id}/files`, formData);
+            const body = {
+                files: [{ name: fileName, type: content_type ?? 'application/octet-stream', content: base64Content }],
+                ...(description && { description }),
+            };
+            const result = await client.post(`issues/${issue_id}/files`, body);
             return {
                 content: [{ type: 'text', text: JSON.stringify(result ?? { success: true }, null, 2) }],
             };

package/docs/cookbook.de.md

@@ -821,7 +821,7 @@ Hängt eine Datei aus dem lokalen Dateisystem an ein Issue an.
 
 ### Dateiinhalt hochladen (Base64)
 
-Hängt eine Datei an, indem ihr base64-kodierter Inhalt direkt übergeben wird. Verwenden, wenn die Datei nicht auf einem lokal zugänglichen Dateisystem liegt.
+Hängt eine Datei an, indem ihr base64-kodierter Inhalt direkt übergeben wird. Nur als **Fallback** verwenden, wenn die Datei nicht über einen Pfad im Server-Dateisystem erreichbar ist (z.B. im Speicher erzeugte Daten oder Dateien, die nur auf der Client-Seite vorliegen). `file_path` bevorzugen, wenn die Datei auf der Festplatte existiert – der Server liest und kodiert sie automatisch.
 
 **Tool:** `upload_file`
 

package/docs/cookbook.md

@@ -821,7 +821,7 @@ Attaches a file from the local filesystem to an issue.
 
 ### Upload file content (base64)
 
-Attaches a file by passing its base64-encoded content directly. Use this when the file is not on a local filesystem accessible to the server.
+Attaches a file by passing its base64-encoded content directly. Use this **only** as a fallback when the file is not accessible via a path on the server filesystem (e.g. in-memory data or files generated on the client side). Prefer `file_path` whenever the file exists on disk — the server reads and encodes it automatically.
 
 **Tool:** `upload_file`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dpesch/mantisbt-mcp-server",
-  "version": "1.10.2",
+  "version": "1.10.6",
   "mcpName": "io.github.dpesch/mantisbt-mcp-server",
   "description": "MCP server for MantisBT REST API – read and manage bug tracker issues",
   "author": "Dominik Pesch",

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.dpesch/mantisbt-mcp-server",
   "title": "MantisBT MCP Server",
   "description": "MantisBT MCP server – manage issues, notes, files, tags, and relationships. With semantic search.",
-  "version": "1.10.2",
+  "version": "1.10.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dpesch/mantisbt-mcp-server",
-      "version": "1.10.2",
+      "version": "1.10.6",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/.gitea/PULL_REQUEST_TEMPLATE.md

@@ -1,17 +0,0 @@
-## Description
-
-<!-- Why is this change needed? What problem does it solve? -->
-
-## Changes
-
-<!-- Brief summary of what was changed -->
-
-## Testing
-
-<!-- How did you test this? -->
-
----
-
-> **Note:** This repository is a public mirror. Your PR will be reviewed and
-> integrated via cherry-pick — it will not be merged directly through Codeberg.
-> You will be credited in the commit message and CHANGELOG.

package/.gitea/workflows/ci.yml

@@ -1,95 +0,0 @@
-name: CI / Publish
-
-on:
-  push:
-    branches: [main]
-    tags:
-      - 'v*'
-  pull_request:
-    branches: [main]
-
-jobs:
-  ci:
-    runs-on: codeberg-small
-    if: |
-      github.event_name == 'pull_request' ||
-      startsWith(github.ref, 'refs/tags/') ||
-      !startsWith(github.event.head_commit.message, 'chore: release')
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Typecheck
-        run: npm run typecheck
-
-      - name: Test
-        run: npm test
-
-      - name: Build
-        run: npm run build
-
-  publish:
-    runs-on: codeberg-small
-    needs: ci
-    if: startsWith(github.ref, 'refs/tags/v')
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build
-        run: npm run build
-
-      - name: Publish to npm
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Extract release notes from CHANGELOG
-        run: |
-          VERSION="${{ github.ref_name }}"
-          VERSION_NUM="${VERSION#v}"
-          awk "/^## \[${VERSION_NUM}\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md \
-            | sed '/^[[:space:]]*$/d' > /tmp/release_notes.md
-          echo "Release notes:"
-          cat /tmp/release_notes.md
-
-      - name: Create Codeberg release
-        run: |
-          curl -s -X POST "https://codeberg.org/api/v1/repos/dpesch/mantisbt-mcp-server/releases" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n \
-              --arg tag "${{ github.ref_name }}" \
-              --arg name "${{ github.ref_name }}" \
-              --rawfile body /tmp/release_notes.md \
-              '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')"
-
-      - name: Create GitHub release
-        run: |
-          curl -s -X POST "https://api.github.com/repos/dpesch/mantisbt-mcp-server/releases" \
-            -H "Authorization: Bearer ${{ secrets.GH_RELEASE_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n \
-              --arg tag "${{ github.ref_name }}" \
-              --arg name "${{ github.ref_name }}" \
-              --rawfile body /tmp/release_notes.md \
-              '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')"

package/.github/workflows/ci.yml

@@ -1,32 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Type check
-        run: npm run typecheck
-
-      - name: Build
-        run: npm run build
-
-      - name: Test
-        run: npm test

package/scripts/hooks/pre-push.mjs

@@ -1,220 +0,0 @@
-#!/usr/bin/env node
-// pre-push hook — typecheck gate + Codeberg .claude/ filter
-//
-// Typecheck runs for every push (origin and upstream) to catch type errors
-// before they reach CI.
-//
-// Codeberg filter handles multi-commit pushes correctly:
-//   1. Fetches the actual Codeberg tip via ls-remote
-//   2. Finds the local commit whose filtered tree matches that tip (anchor)
-//   3. Filters every commit between anchor and tip in order (oldest first)
-//   4. Builds a proper filtered chain anchored to the actual remote tip
-//   5. Pushes the filtered tip with --force
-//   6. Exits 2 to block git's unfiltered push
-//      Exit codes: 0 = no Codeberg refs, 1 = error, 2 = success (filtered push done)
-//
-// Branches are processed before tags so the shaMap is available for tags
-// that point to commits already processed as part of the branch.
-//
-// ⚠ IMPORTANT: upstream (Codeberg) is a filtered mirror — push-only.
-// Never run git pull, git fetch + merge, or git rebase against upstream.
-// Filtered commits have different SHAs; pulling them back creates duplicate
-// history. Use origin (Gitolite) as the authoritative source.
-//
-// --force is always required for Codeberg: filtered SHAs structurally diverge
-// from local SHAs, so git rejects main as non-fast-forward before the hook
-// runs unless --force bypasses that check.
-
-import { execSync } from 'node:child_process';
-import { createInterface } from 'node:readline';
-
-// Recursion guard — must be first to avoid running typecheck during recursive pushes
-if (process.env._PREPUSH_FILTER_ACTIVE) process.exit(0);
-
-// Run typecheck before every push (catches type errors before they hit CI)
-try {
-  execSync('npm run typecheck', { stdio: 'inherit' });
-} catch {
-  console.error('✗ Typecheck failed — push aborted. Fix type errors first.');
-  process.exit(1);
-}
-
-const [,, , remoteUrl] = process.argv;
-
-// Only intercept Codeberg pushes for the filter step
-if (!remoteUrl?.includes('codeberg.org')) process.exit(0);
-
-console.log('→ Codeberg push detected — filtering .claude/ directory...');
-
-const ZERO_SHA = '0'.repeat(40);
-
-const git = (cmd, opts = {}) => {
-  try {
-    return execSync(`git ${cmd}`, { encoding: 'utf8', ...opts }).trim();
-  } catch (err) {
-    console.error(`✗ git ${cmd}\n${err.stderr || err.message}`);
-    process.exit(1);
-  }
-};
-
-const gitOptional = (cmd, opts = {}) => {
-  try { return execSync(`git ${cmd}`, { encoding: 'utf8', ...opts }).trim(); }
-  catch { return ''; }
-};
-
-const isSha = s => /^[0-9a-f]{40}$/.test(s);
-
-// Remove .claude/ from the root tree of a commit and return the new tree SHA.
-const filterTree = commitSha => {
-  const entries = git(`ls-tree "${commitSha}^{tree}"`);
-  const filtered = entries.split('\n').filter(e => !e.match(/\t\.claude$/)).join('\n');
-  const tree = git('mktree', { input: filtered });
-  if (!isSha(tree)) { console.error(`✗ mktree failed for ${commitSha}`); process.exit(1); }
-  return tree;
-};
-
-// Create a filtered commit object preserving all original metadata.
-const makeFilteredCommit = (commitSha, filteredTree, mappedParents) => {
-  const log = git(`log -1 --format=%an%n%ae%n%aI%n%cn%n%ce%n%cI%n%n%B "${commitSha}"`);
-  const [an, ae, aI, cn, ce, cI, , ...msgLines] = log.split('\n');
-  const commitMsg = msgLines.join('\n').trimEnd();
-  const parentFlags = mappedParents.map(p => `-p ${p}`).join(' ');
-  const env = {
-    ...process.env,
-    GIT_AUTHOR_NAME: an,    GIT_AUTHOR_EMAIL: ae,    GIT_AUTHOR_DATE: aI,
-    GIT_COMMITTER_NAME: cn, GIT_COMMITTER_EMAIL: ce, GIT_COMMITTER_DATE: cI,
-  };
-  const result = git(`commit-tree "${filteredTree}" ${parentFlags}`, { env, input: commitMsg });
-  if (!isSha(result)) { console.error(`✗ commit-tree failed for ${commitSha}`); process.exit(1); }
-  return result;
-};
-
-// Scan ancestors of tipSha (newest first) and return the most recent one whose
-// filtered root tree equals the tree of remoteSha. Returns null if not found.
-const findLocalAnchor = (tipSha, remoteSha, maxDepth = 100) => {
-  const remoteTree = gitOptional(`rev-parse "${remoteSha}^{tree}"`);
-  if (!remoteTree) return null;
-  const candidates = gitOptional(`rev-list --max-count=${maxDepth} "${tipSha}"`);
-  if (!candidates) return null;
-  for (const sha of candidates.split('\n').filter(Boolean)) {
-    if (filterTree(sha) === remoteTree) return sha;
-  }
-  return null;
-};
-
-const rl = createInterface({ input: process.stdin });
-const lines = [];
-rl.on('line', line => { if (line.trim()) lines.push(line.trim()); });
-
-rl.on('close', () => {
-  // Process branches before tags so shaMap is populated when tags are handled.
-  const branches = lines.filter(l => l.split(' ')[2]?.startsWith('refs/heads/'));
-  const others   = lines.filter(l => !l.split(' ')[2]?.startsWith('refs/heads/'));
-
-  // Batch-fetch all tags from Codeberg (single ls-remote call, ref → sha).
-  const remoteTagsRaw = gitOptional(`ls-remote --tags "${remoteUrl}"`);
-  const remoteTagMap = new Map(
-    remoteTagsRaw
-      ? remoteTagsRaw.split('\n').filter(Boolean)
-          .map(l => { const [sha, ref] = l.split(/\s+/); return [ref, sha]; })
-          .filter(([ref]) => ref)
-      : []
-  );
-
-  // localSha → filteredSha, accumulated across all refs in this push.
-  const shaMap = {};
-  let pushed = 0;
-
-  for (const line of [...branches, ...others]) {
-    const parts = line.split(' ');
-    if (parts.length < 3) { console.error(`✗ Malformed push input: ${line}`); process.exit(1); }
-    const [, localSha, remoteRef] = parts;
-
-    if (localSha === ZERO_SHA) continue; // deletion — skip
-
-    const label = remoteRef.replace('refs/heads/', '').replace('refs/tags/', '');
-
-    if (remoteRef.startsWith('refs/tags/')) {
-      if (remoteTagMap.has(remoteRef)) {
-        console.log(`  ↷ ${label} already on Codeberg — skipping`);
-        continue;
-      }
-      if (!gitOptional(`rev-parse --verify "${localSha}"`)) {
-        console.warn(`  ⚠ ${label} — commit ${localSha.slice(0, 8)} not found locally, skipping`);
-        continue;
-      }
-    }
-
-    // If this commit was already filtered as part of a branch push, reuse it.
-    if (localSha in shaMap) {
-      try {
-        execSync(`git push "${remoteUrl}" "${shaMap[localSha]}:${remoteRef}" --force`,
-          { env: { ...process.env, _PREPUSH_FILTER_ACTIVE: '1' }, stdio: 'inherit' });
-      } catch {
-        console.error(`✗ Push failed for ${label}`); process.exit(1);
-      }
-      console.log(`✓ ${label} pushed to Codeberg (without .claude/)`);
-      pushed++;
-      continue;
-    }
-
-    // Tags: existing ones were skipped above, so only new tags reach here — no remote anchor.
-    // Branches: query individually to find the incremental anchor for filtered chain building.
-    const actualRemoteSha = remoteRef.startsWith('refs/tags/')
-      ? ''
-      : (gitOptional(`ls-remote "${remoteUrl}" "${remoteRef}"`)?.split(/\s+/)[0] ?? '');
-
-    if (!actualRemoteSha) {
-      // New ref on Codeberg — filter the tip with no parent.
-      shaMap[localSha] = makeFilteredCommit(localSha, filterTree(localSha), []);
-    } else {
-      // Find the local commit that corresponds to the current Codeberg tip.
-      const localAnchor = findLocalAnchor(localSha, actualRemoteSha);
-
-      if (localAnchor) {
-        shaMap[localAnchor] = actualRemoteSha;
-
-        // Filter all commits between anchor and tip, oldest first.
-        const revList = gitOptional(`rev-list --reverse "${localAnchor}..${localSha}"`);
-        const commits = revList ? revList.split('\n').filter(Boolean) : [];
-
-        for (const sha of commits) {
-          const filteredTree = filterTree(sha);
-          const parents = gitOptional(`log -1 --format=%P "${sha}"`);
-          const parentShas = parents ? parents.split(' ').filter(Boolean) : [];
-          // Map each parent through shaMap; fall back to actualRemoteSha for
-          // parents outside the current range (already on the remote).
-          const mappedParents = parentShas
-            .map(p => shaMap[p] ?? actualRemoteSha)
-            .filter(Boolean);
-          shaMap[sha] = makeFilteredCommit(sha, filteredTree, mappedParents);
-        }
-      } else {
-        // Fallback: anchor not found — branch only (tags exit early above).
-        const remoteExists = !!gitOptional(`rev-parse --verify "${actualRemoteSha}"`);
-        console.warn(`  ⚠ Could not find local base for ${label}, filtering tip only`);
-        shaMap[localSha] = makeFilteredCommit(localSha, filterTree(localSha), remoteExists ? [actualRemoteSha] : []);
-      }
-    }
-
-    const filteredTip = shaMap[localSha];
-    if (!filteredTip) {
-      console.error(`✗ Could not compute filtered SHA for ${localSha}`);
-      process.exit(1);
-    }
-
-    try {
-      execSync(`git push "${remoteUrl}" "${filteredTip}:${remoteRef}" --force`,
-        { env: { ...process.env, _PREPUSH_FILTER_ACTIVE: '1' }, stdio: 'inherit' });
-    } catch {
-      console.error(`✗ Push to Codeberg failed for ${label}`); process.exit(1);
-    }
-
-    console.log(`✓ ${label} pushed to Codeberg (without .claude/)`);
-    pushed++;
-  }
-
-  if (pushed === 0) process.exit(0);
-  console.log('→ Filtered push complete. Blocking unfiltered push.');
-  process.exit(2); // 2 = success (filtered push done, unfiltered blocked); 1 = error
-});