@karmaniverous/jeeves-watcher 0.19.0-0 → 0.19.0-2

package/dist/cli/jeeves-watcher/{index-BVfdWEhb.js → index-CD0v-oGg.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createConfigApplyHandler, createConfigQueryHandler as createConfigQueryHandler$1, createStatusHandler, DEFAULT_PORTS, getBindAddress } from '@karmaniverous/jeeves';
-import { n as normalizeSlashes, a as normalizeError, e as execFileAsync, G as GIT_TIMEOUT_STANDARD, b as GIT_TIMEOUT_CHERRY_PICK, c as buildAuthenticatedPushUrl, d as GIT_TIMEOUT_PUSH, g as getExecErrorFields, r as retry, f as gitAddViaStdin, h as normalizePathCase, i as findRootForPath, j as GitignoreFilter, k as executeReindex, V as VALID_REINDEX_SCOPES, m as mergeInferenceRules, l as isPathWatched, o as getWatchRootBases, C as CONFIG_WATCH_VALID_SCOPES, s as sleep, p as loadConfig } from './index.js';
-export { q as startFromConfig } from './index.js';
+import { n as normalizeSlashes, a as normalizeError, e as execFileAsync, G as GIT_TIMEOUT_STANDARD, b as GIT_TIMEOUT_CHERRY_PICK, c as GIT_TIMEOUT_PUSH, g as getExecErrorFields, r as retry, d as gitAddViaStdin, f as normalizePathCase, h as findRootForPath, i as GitignoreFilter, j as executeReindex, V as VALID_REINDEX_SCOPES, m as mergeInferenceRules, k as isPathWatched, l as getWatchRootBases, C as CONFIG_WATCH_VALID_SCOPES, s as sleep, o as loadConfig } from './index.js';
+export { p as startFromConfig } from './index.js';
 import { mkdirSync, existsSync, readFileSync, writeFileSync, rmSync, renameSync, readdirSync, statSync } from 'node:fs';
 import { join, dirname, resolve, extname, basename, sep, isAbsolute, relative } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
@@ -1064,6 +1064,206 @@ class CommitMessageBuilder {
     }
 }
 
+/**
+ * @module vcs/gitNetwork
+ * Non-interactive, credential-safe execution of git commands that touch the
+ * network.
+ *
+ * A background service must never wait on a human. `GIT_TERMINAL_PROMPT=0`
+ * alone is not enough: credential helpers configured at system, global, or
+ * local level (notably Git Credential Manager, the Git for Windows default)
+ * ignore it and block waiting for an interactive sign-in when the remote
+ * rejects the credentials. Every git network call in the service (currently
+ * push and squash force push) therefore goes through {@link execGitNetwork}.
+ *
+ * An access token is never placed on the command line (Node's exec errors
+ * echo the full command, and those errors reach logs and the API). It is
+ * passed to git as an HTTP `Authorization` header through
+ * `GIT_CONFIG_*` environment variables, for that one invocation only. As
+ * defence in depth, every error is passed through {@link sanitizeGitError}
+ * before it leaves this module.
+ */
+/** Leading git arguments that disable the askpass prompt path. */
+const NO_ASKPASS_ARGS = ['-c', 'core.askPass='];
+/**
+ * Leading git arguments that discard every configured credential helper.
+ *
+ * An empty `credential.helper` value resets the helper list for this one
+ * invocation, discarding helpers from system, global, and local config
+ * (command-line config is read last).
+ */
+const NO_CREDENTIAL_HELPER_ARGS = [
+    '-c',
+    'credential.helper=',
+];
+/** HTTP Basic user name paired with a token (accepted by GitHub). */
+const TOKEN_USER = 'x-access-token';
+/** Replacement for redacted secrets. */
+const REDACTED = '***';
+/**
+ * Build the leading git arguments for a network call.
+ *
+ * @param clearCredentialHelpers - Discard configured credential helpers. Use
+ *   when an injected token is the credential; otherwise keep helpers so
+ *   stored credentials still work.
+ * @returns Arguments to place before the git subcommand.
+ */
+function buildGitNetworkArgs(clearCredentialHelpers) {
+    return clearCredentialHelpers
+        ? [...NO_ASKPASS_ARGS, ...NO_CREDENTIAL_HELPER_ARGS]
+        : [...NO_ASKPASS_ARGS];
+}
+/**
+ * Build the environment for a git network call.
+ *
+ * Config entries are appended via `GIT_CONFIG_COUNT` /
+ * `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` (after any entries
+ * already in `baseEnv`), which keeps their values off the command line.
+ *
+ * @param baseEnv - Environment to extend (default: `process.env`).
+ * @param config - Git config entries for this invocation only.
+ * @returns A copy of `baseEnv` with every interactive prompt path disabled.
+ */
+function buildGitNetworkEnv(baseEnv = process.env, config = []) {
+    const env = {
+        ...baseEnv,
+        // Never prompt on the terminal.
+        GIT_TERMINAL_PROMPT: '0',
+        // Git Credential Manager: fail instead of showing sign-in UI.
+        GCM_INTERACTIVE: 'never',
+        // Empty askpass programs are treated as unset, so no dialog is spawned.
+        GIT_ASKPASS: '',
+        SSH_ASKPASS: '',
+    };
+    if (config.length === 0)
+        return env;
+    const existing = Number.parseInt(baseEnv.GIT_CONFIG_COUNT ?? '', 10);
+    const offset = Number.isInteger(existing) && existing > 0 ? existing : 0;
+    config.forEach(([key, value], i) => {
+        env[`GIT_CONFIG_KEY_${String(offset + i)}`] = key;
+        env[`GIT_CONFIG_VALUE_${String(offset + i)}`] = value;
+    });
+    env.GIT_CONFIG_COUNT = String(offset + config.length);
+    return env;
+}
+/**
+ * Build the HTTP header value that authenticates a token.
+ *
+ * @param accessToken - The token.
+ * @returns `Authorization: Basic <base64(x-access-token:token)>`.
+ */
+function buildAuthHeader(accessToken) {
+    const basic = Buffer.from(`${TOKEN_USER}:${accessToken}`).toString('base64');
+    return `Authorization: Basic ${basic}`;
+}
+/**
+ * Build the git config entry that sends a token to one remote URL.
+ *
+ * Scoping the header to `http.<url>.extraHeader` keeps it from being sent
+ * to any other URL (e.g. a redirect target).
+ *
+ * @param remoteUrl - Remote URL the header applies to.
+ * @param accessToken - The token.
+ * @returns The config entry.
+ */
+function buildAuthHeaderConfig(remoteUrl, accessToken) {
+    return [`http.${remoteUrl}.extraHeader`, buildAuthHeader(accessToken)];
+}
+/**
+ * Replace every known encoding of a secret in a string.
+ *
+ * Covers the raw value, its URL encoding, its base64 encoding, and the base64
+ * Basic credential sent in the auth header.
+ *
+ * @param text - Text to redact.
+ * @param secret - Secret to remove; no-op when empty or undefined.
+ * @returns The redacted text.
+ */
+function redactSecret(text, secret) {
+    if (!secret)
+        return text;
+    const forms = [
+        Buffer.from(`${TOKEN_USER}:${secret}`).toString('base64'),
+        Buffer.from(secret).toString('base64'),
+        encodeURIComponent(secret),
+        secret,
+    ].sort((a, b) => b.length - a.length);
+    return forms.reduce((out, form) => out.split(form).join(REDACTED), text);
+}
+/**
+ * Strip a secret from a thrown git error before it is logged or stored.
+ *
+ * Returns a new `Error` whose message, stack, and string properties
+ * (`cmd`, `stderr`, `stdout`, ...) are redacted; non-string properties
+ * other than the cause are copied as-is. The original error (and its cause) is
+ * not referenced.
+ *
+ * @param error - The caught value.
+ * @param secret - Secret to remove.
+ * @returns A redacted error.
+ */
+function sanitizeGitError(error, secret) {
+    if (!(error instanceof Error)) {
+        return new Error(redactSecret(String(error), secret));
+    }
+    const clean = new Error(redactSecret(error.message, secret));
+    clean.name = error.name;
+    clean.stack = redactSecret(error.stack ?? '', secret);
+    const target = clean;
+    for (const [key, value] of Object.entries(error)) {
+        if (key === 'cause')
+            continue;
+        target[key] =
+            typeof value === 'string' ? redactSecret(value, secret) : value;
+    }
+    return clean;
+}
+/**
+ * Run a git network command non-interactively.
+ *
+ * @param args - Git arguments, e.g. `['push', url, 'HEAD']`.
+ * @param options - Working directory, timeout, credential policy, and secrets.
+ * @returns The child's stdout and stderr.
+ * @throws A {@link sanitizeGitError | sanitized} error on failure.
+ */
+async function execGitNetwork(args, options) {
+    try {
+        return await execFileAsync('git', [...buildGitNetworkArgs(options.clearCredentialHelpers), ...args], {
+            cwd: options.cwd,
+            env: buildGitNetworkEnv(process.env, options.config),
+            timeout: options.timeout,
+        });
+    }
+    catch (error) {
+        throw sanitizeGitError(error, options.secret);
+    }
+}
+/**
+ * Push `HEAD` to a remote non-interactively.
+ *
+ * For an HTTPS remote with a token, the token is sent as an auth header
+ * (never in the URL) and configured credential helpers are discarded, since
+ * the token is the credential. Otherwise helpers are kept so stored
+ * credentials still work.
+ *
+ * @param options - Push target and behaviour.
+ * @throws A sanitized error (token redacted) on failure.
+ */
+async function gitPushNonInteractive(options) {
+    const { remoteUrl, accessToken } = options;
+    const token = accessToken && /^https:\/\//i.test(remoteUrl) ? accessToken : undefined;
+    const args = options.force
+        ? ['push', '--force', remoteUrl, 'HEAD']
+        : ['push', remoteUrl, 'HEAD'];
+    await execGitNetwork(args, {
+        cwd: options.cwd,
+        timeout: options.timeout,
+        clearCredentialHelpers: token !== undefined,
+        config: token ? [buildAuthHeaderConfig(remoteUrl, token)] : [],
+        secret: accessToken,
+    });
+}
+
 /**
  * @module vcs/SquashManager
  * Handles scheduled squash retention for git-backed VCS roots.
@@ -1365,10 +1565,11 @@ class SquashManager {
         if (!this.remoteUrl)
             return;
         try {
-            const pushUrl = buildAuthenticatedPushUrl(this.remoteUrl, this.accessToken);
-            await execFileAsync('git', ['push', '--force', pushUrl, 'HEAD'], {
+            await gitPushNonInteractive({
                 cwd: this.rootPath,
-                env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+                remoteUrl: this.remoteUrl,
+                accessToken: this.accessToken,
+                force: true,
                 timeout: GIT_TIMEOUT_PUSH,
             });
             this.logger.info({ root: this.rootPath, remote: this.remoteUrl }, 'Squash force push succeeded');
@@ -1527,10 +1728,10 @@ async function pushToRemote(rootPath, remoteUrl, accessToken, pushErrors, logger
     if (!remoteUrl)
         return undefined;
     try {
-        const pushUrl = buildAuthenticatedPushUrl(remoteUrl, accessToken);
-        await execFileAsync('git', ['push', pushUrl, 'HEAD'], {
+        await gitPushNonInteractive({
             cwd: rootPath,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+            remoteUrl,
+            accessToken,
             timeout: GIT_TIMEOUT_PUSH,
         });
         const timestamp = new Date().toISOString();

package/dist/cli/jeeves-watcher/index.js

@@ -265,7 +265,7 @@ async function startFromConfig(configPath, descriptor) {
     const config = await loadConfig(resolvedPath);
     // Dynamic import breaks the circular dependency between this module
     // and app/index.ts (which defines JeevesWatcher and re-exports startFromConfig).
-    const { JeevesWatcher } = await import('./index-BVfdWEhb.js');
+    const { JeevesWatcher } = await import('./index-CD0v-oGg.js');
     const app = new JeevesWatcher(config, resolvedPath, descriptor);
     installShutdownHandlers(() => app.stop());
     await app.start();
@@ -680,19 +680,6 @@ function getExecErrorFields(error) {
     const stdout = typeof rec['stdout'] === 'string' ? rec['stdout'] : '';
     return { message: error.message || '', stderr, stdout };
 }
-/**
- * Build an authenticated push URL by injecting a token into an HTTPS remote.
- * Non-HTTPS URLs are returned as-is.
- *
- * @param remoteUrl - The remote repository URL.
- * @param accessToken - Optional access token to inject.
- * @returns The URL with the token injected if applicable.
- */
-function buildAuthenticatedPushUrl(remoteUrl, accessToken) {
-    if (!accessToken)
-        return remoteUrl;
-    return remoteUrl.replace(/^https:\/\//, `https://${encodeURIComponent(accessToken)}@`);
-}
 /**
  * Stage files via stdin to avoid ENAMETOOLONG on Windows.
  *
@@ -1652,4 +1639,4 @@ const watcherDescriptor = {
 const program = createServiceCli(watcherDescriptor);
 program.parse();
 
-export { CONFIG_WATCH_VALID_SCOPES as C, GIT_TIMEOUT_STANDARD as G, VALID_REINDEX_SCOPES as V, normalizeError as a, GIT_TIMEOUT_CHERRY_PICK as b, buildAuthenticatedPushUrl as c, GIT_TIMEOUT_PUSH as d, execFileAsync as e, gitAddViaStdin as f, getExecErrorFields as g, normalizePathCase as h, findRootForPath as i, GitignoreFilter as j, executeReindex as k, isPathWatched as l, mergeInferenceRules as m, normalizeSlashes as n, getWatchRootBases as o, loadConfig as p, startFromConfig as q, retry as r, sleep as s };
+export { CONFIG_WATCH_VALID_SCOPES as C, GIT_TIMEOUT_STANDARD as G, VALID_REINDEX_SCOPES as V, normalizeError as a, GIT_TIMEOUT_CHERRY_PICK as b, GIT_TIMEOUT_PUSH as c, gitAddViaStdin as d, execFileAsync as e, normalizePathCase as f, getExecErrorFields as g, findRootForPath as h, GitignoreFilter as i, executeReindex as j, isPathWatched as k, getWatchRootBases as l, mergeInferenceRules as m, normalizeSlashes as n, loadConfig as o, startFromConfig as p, retry as r, sleep as s };

package/dist/index.js

@@ -447,19 +447,6 @@ function getExecErrorFields(error) {
     const stdout = typeof rec['stdout'] === 'string' ? rec['stdout'] : '';
     return { message: error.message || '', stderr, stdout };
 }
-/**
- * Build an authenticated push URL by injecting a token into an HTTPS remote.
- * Non-HTTPS URLs are returned as-is.
- *
- * @param remoteUrl - The remote repository URL.
- * @param accessToken - Optional access token to inject.
- * @returns The URL with the token injected if applicable.
- */
-function buildAuthenticatedPushUrl(remoteUrl, accessToken) {
-    if (!accessToken)
-        return remoteUrl;
-    return remoteUrl.replace(/^https:\/\//, `https://${encodeURIComponent(accessToken)}@`);
-}
 /**
  * Stage files via stdin to avoid ENAMETOOLONG on Windows.
  *
@@ -4455,6 +4442,206 @@ class CommitMessageGenerator {
     }
 }
 
+/**
+ * @module vcs/gitNetwork
+ * Non-interactive, credential-safe execution of git commands that touch the
+ * network.
+ *
+ * A background service must never wait on a human. `GIT_TERMINAL_PROMPT=0`
+ * alone is not enough: credential helpers configured at system, global, or
+ * local level (notably Git Credential Manager, the Git for Windows default)
+ * ignore it and block waiting for an interactive sign-in when the remote
+ * rejects the credentials. Every git network call in the service (currently
+ * push and squash force push) therefore goes through {@link execGitNetwork}.
+ *
+ * An access token is never placed on the command line (Node's exec errors
+ * echo the full command, and those errors reach logs and the API). It is
+ * passed to git as an HTTP `Authorization` header through
+ * `GIT_CONFIG_*` environment variables, for that one invocation only. As
+ * defence in depth, every error is passed through {@link sanitizeGitError}
+ * before it leaves this module.
+ */
+/** Leading git arguments that disable the askpass prompt path. */
+const NO_ASKPASS_ARGS = ['-c', 'core.askPass='];
+/**
+ * Leading git arguments that discard every configured credential helper.
+ *
+ * An empty `credential.helper` value resets the helper list for this one
+ * invocation, discarding helpers from system, global, and local config
+ * (command-line config is read last).
+ */
+const NO_CREDENTIAL_HELPER_ARGS = [
+    '-c',
+    'credential.helper=',
+];
+/** HTTP Basic user name paired with a token (accepted by GitHub). */
+const TOKEN_USER = 'x-access-token';
+/** Replacement for redacted secrets. */
+const REDACTED = '***';
+/**
+ * Build the leading git arguments for a network call.
+ *
+ * @param clearCredentialHelpers - Discard configured credential helpers. Use
+ *   when an injected token is the credential; otherwise keep helpers so
+ *   stored credentials still work.
+ * @returns Arguments to place before the git subcommand.
+ */
+function buildGitNetworkArgs(clearCredentialHelpers) {
+    return clearCredentialHelpers
+        ? [...NO_ASKPASS_ARGS, ...NO_CREDENTIAL_HELPER_ARGS]
+        : [...NO_ASKPASS_ARGS];
+}
+/**
+ * Build the environment for a git network call.
+ *
+ * Config entries are appended via `GIT_CONFIG_COUNT` /
+ * `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` (after any entries
+ * already in `baseEnv`), which keeps their values off the command line.
+ *
+ * @param baseEnv - Environment to extend (default: `process.env`).
+ * @param config - Git config entries for this invocation only.
+ * @returns A copy of `baseEnv` with every interactive prompt path disabled.
+ */
+function buildGitNetworkEnv(baseEnv = process.env, config = []) {
+    const env = {
+        ...baseEnv,
+        // Never prompt on the terminal.
+        GIT_TERMINAL_PROMPT: '0',
+        // Git Credential Manager: fail instead of showing sign-in UI.
+        GCM_INTERACTIVE: 'never',
+        // Empty askpass programs are treated as unset, so no dialog is spawned.
+        GIT_ASKPASS: '',
+        SSH_ASKPASS: '',
+    };
+    if (config.length === 0)
+        return env;
+    const existing = Number.parseInt(baseEnv.GIT_CONFIG_COUNT ?? '', 10);
+    const offset = Number.isInteger(existing) && existing > 0 ? existing : 0;
+    config.forEach(([key, value], i) => {
+        env[`GIT_CONFIG_KEY_${String(offset + i)}`] = key;
+        env[`GIT_CONFIG_VALUE_${String(offset + i)}`] = value;
+    });
+    env.GIT_CONFIG_COUNT = String(offset + config.length);
+    return env;
+}
+/**
+ * Build the HTTP header value that authenticates a token.
+ *
+ * @param accessToken - The token.
+ * @returns `Authorization: Basic <base64(x-access-token:token)>`.
+ */
+function buildAuthHeader(accessToken) {
+    const basic = Buffer.from(`${TOKEN_USER}:${accessToken}`).toString('base64');
+    return `Authorization: Basic ${basic}`;
+}
+/**
+ * Build the git config entry that sends a token to one remote URL.
+ *
+ * Scoping the header to `http.<url>.extraHeader` keeps it from being sent
+ * to any other URL (e.g. a redirect target).
+ *
+ * @param remoteUrl - Remote URL the header applies to.
+ * @param accessToken - The token.
+ * @returns The config entry.
+ */
+function buildAuthHeaderConfig(remoteUrl, accessToken) {
+    return [`http.${remoteUrl}.extraHeader`, buildAuthHeader(accessToken)];
+}
+/**
+ * Replace every known encoding of a secret in a string.
+ *
+ * Covers the raw value, its URL encoding, its base64 encoding, and the base64
+ * Basic credential sent in the auth header.
+ *
+ * @param text - Text to redact.
+ * @param secret - Secret to remove; no-op when empty or undefined.
+ * @returns The redacted text.
+ */
+function redactSecret(text, secret) {
+    if (!secret)
+        return text;
+    const forms = [
+        Buffer.from(`${TOKEN_USER}:${secret}`).toString('base64'),
+        Buffer.from(secret).toString('base64'),
+        encodeURIComponent(secret),
+        secret,
+    ].sort((a, b) => b.length - a.length);
+    return forms.reduce((out, form) => out.split(form).join(REDACTED), text);
+}
+/**
+ * Strip a secret from a thrown git error before it is logged or stored.
+ *
+ * Returns a new `Error` whose message, stack, and string properties
+ * (`cmd`, `stderr`, `stdout`, ...) are redacted; non-string properties
+ * other than the cause are copied as-is. The original error (and its cause) is
+ * not referenced.
+ *
+ * @param error - The caught value.
+ * @param secret - Secret to remove.
+ * @returns A redacted error.
+ */
+function sanitizeGitError(error, secret) {
+    if (!(error instanceof Error)) {
+        return new Error(redactSecret(String(error), secret));
+    }
+    const clean = new Error(redactSecret(error.message, secret));
+    clean.name = error.name;
+    clean.stack = redactSecret(error.stack ?? '', secret);
+    const target = clean;
+    for (const [key, value] of Object.entries(error)) {
+        if (key === 'cause')
+            continue;
+        target[key] =
+            typeof value === 'string' ? redactSecret(value, secret) : value;
+    }
+    return clean;
+}
+/**
+ * Run a git network command non-interactively.
+ *
+ * @param args - Git arguments, e.g. `['push', url, 'HEAD']`.
+ * @param options - Working directory, timeout, credential policy, and secrets.
+ * @returns The child's stdout and stderr.
+ * @throws A {@link sanitizeGitError | sanitized} error on failure.
+ */
+async function execGitNetwork(args, options) {
+    try {
+        return await execFileAsync('git', [...buildGitNetworkArgs(options.clearCredentialHelpers), ...args], {
+            cwd: options.cwd,
+            env: buildGitNetworkEnv(process.env, options.config),
+            timeout: options.timeout,
+        });
+    }
+    catch (error) {
+        throw sanitizeGitError(error, options.secret);
+    }
+}
+/**
+ * Push `HEAD` to a remote non-interactively.
+ *
+ * For an HTTPS remote with a token, the token is sent as an auth header
+ * (never in the URL) and configured credential helpers are discarded, since
+ * the token is the credential. Otherwise helpers are kept so stored
+ * credentials still work.
+ *
+ * @param options - Push target and behaviour.
+ * @throws A sanitized error (token redacted) on failure.
+ */
+async function gitPushNonInteractive(options) {
+    const { remoteUrl, accessToken } = options;
+    const token = accessToken && /^https:\/\//i.test(remoteUrl) ? accessToken : undefined;
+    const args = options.force
+        ? ['push', '--force', remoteUrl, 'HEAD']
+        : ['push', remoteUrl, 'HEAD'];
+    await execGitNetwork(args, {
+        cwd: options.cwd,
+        timeout: options.timeout,
+        clearCredentialHelpers: token !== undefined,
+        config: token ? [buildAuthHeaderConfig(remoteUrl, token)] : [],
+        secret: accessToken,
+    });
+}
+
 /**
  * @module vcs/SquashManager
  * Handles scheduled squash retention for git-backed VCS roots.
@@ -4756,10 +4943,11 @@ class SquashManager {
         if (!this.remoteUrl)
             return;
         try {
-            const pushUrl = buildAuthenticatedPushUrl(this.remoteUrl, this.accessToken);
-            await execFileAsync('git', ['push', '--force', pushUrl, 'HEAD'], {
+            await gitPushNonInteractive({
                 cwd: this.rootPath,
-                env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+                remoteUrl: this.remoteUrl,
+                accessToken: this.accessToken,
+                force: true,
                 timeout: GIT_TIMEOUT_PUSH,
             });
             this.logger.info({ root: this.rootPath, remote: this.remoteUrl }, 'Squash force push succeeded');
@@ -5184,10 +5372,10 @@ async function pushToRemote(rootPath, remoteUrl, accessToken, pushErrors, logger
     if (!remoteUrl)
         return undefined;
     try {
-        const pushUrl = buildAuthenticatedPushUrl(remoteUrl, accessToken);
-        await execFileAsync('git', ['push', pushUrl, 'HEAD'], {
+        await gitPushNonInteractive({
             cwd: rootPath,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+            remoteUrl,
+            accessToken,
             timeout: GIT_TIMEOUT_PUSH,
         });
         const timestamp = new Date().toISOString();

package/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@commander-js/extra-typings": "^15.0.0",
-    "@karmaniverous/jeeves": "0.6.0-7",
-    "@karmaniverous/jeeves-watcher-core": "^0.2.5 || ^0.2.6-0",
+    "@karmaniverous/jeeves": "0.6.0-8",
+    "@karmaniverous/jeeves-watcher-core": "^0.2.6-1",
     "@karmaniverous/jsonmap": "^2.1.1",
     "@langchain/textsplitters": "*",
     "@qdrant/js-client-rest": "^1.19.0",
@@ -107,6 +107,10 @@
       "release": true
     },
     "hooks": {
+      "after:bump": [
+        "npm install --package-lock-only --ignore-scripts",
+        "git add ../../package-lock.json"
+      ],
       "after:init": [
         "npm run lint",
         "npm run typecheck",
@@ -133,7 +137,7 @@
     "url": "git+https://github.com/karmaniverous/jeeves-watcher.git"
   },
   "scripts": {
-    "build": "npm run generate:schema && rimraf dist && cross-env NO_COLOR=1 rollup --config rollup.config.ts --configPlugin @rollup/plugin-typescript",
+    "build": "npm run generate:schema && rimraf dist && cross-env NO_COLOR=1 rollup --config rollup.config.ts --configPlugin \"@rollup/plugin-typescript={paths:{}}\"",
     "changelog": "git-cliff -o CHANGELOG.md",
     "diagrams": "cd diagrams && plantuml -tpng -o ../assets -r .",
     "generate:schema": "tsx src/config/generate-schema.ts",
@@ -146,5 +150,5 @@
   },
   "type": "module",
   "types": "dist/index.d.ts",
-  "version": "0.19.0-0"
+  "version": "0.19.0-2"
 }