canopycms-cdk 0.0.68-int.95 → 0.0.68-int.96

package/dist/constructs/cms-service.d.ts

@@ -61,11 +61,12 @@ export interface CanopyCmsServiceProps {
     /**
      * Environment variables for the Lambda function.
      *
-     * Two keys are not free-form here, because the construct configures the
+     * Three keys are not free-form here, because the construct configures the
      * worker from the same values and the two halves must agree:
      * `CANOPYCMS_DEPLOYMENT_NAME` is folded into `deploymentName` (validated,
-     * and mirrored into the worker's `.env`), and `CANOPY_MODE` accepts only
-     * `'prod'`. Everything else is passed through untouched.
+     * and mirrored into the worker's `.env`), `CANOPY_MODE` accepts only
+     * `'prod'`, and `CANOPYCMS_WORKSPACE_ROOT` accepts only the shared EFS mount
+     * path, `/mnt/efs`. Everything else is passed through untouched.
      */
     environment?: Record<string, string>;
     /** EFS removal policy (default: RETAIN) */

package/dist/constructs/cms-service.js

@@ -35,6 +35,15 @@ const isValidDeploymentName = (name) => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name
     !name.includes('..') &&
     !name.endsWith('.') &&
     !name.endsWith('.lock');
+/**
+ * Where the Lambda AND the worker mount the `WorkspaceAP` access point (rooted
+ * at EFS:/workspace), and so the workspace root of both.
+ *
+ * One path string, not merely one directory: git records absolute paths on
+ * EFS (a workspace clone's `origin` is `<root>/remote.git`), and a path written
+ * by one process must resolve for the other.
+ */
+const EFS_MOUNT_PATH = '/mnt/efs';
 /**
  * The heredoc delimiter user-data uses to write the worker's `.env` (see the
  * `cat > … << 'ENVEOF'` block below).
@@ -562,6 +571,14 @@ export class CanopyCmsService extends Construct {
                 `(dev mode resolves its workspace to <cwd>/.canopy-dev, which is read-only on Lambda). ` +
                 `Omit it to get the default.`);
         }
+        const envWorkspaceRootOverride = props.environment?.['CANOPYCMS_WORKSPACE_ROOT'];
+        if (envWorkspaceRootOverride !== undefined && envWorkspaceRootOverride !== EFS_MOUNT_PATH) {
+            throw new Error(`CanopyCmsService: invalid environment.CANOPYCMS_WORKSPACE_ROOT ` +
+                `${JSON.stringify(envWorkspaceRootOverride)}. The Lambda and the worker both mount the ` +
+                `workspace at ${EFS_MOUNT_PATH}, and git paths one writes on EFS must resolve for the ` +
+                `other, so the only supported value is ${JSON.stringify(EFS_MOUNT_PATH)}. ` +
+                `Omit it to get the default.`);
+        }
         this.vpc =
             props.vpc ??
                 new ec2.Vpc(this, 'Vpc', {
@@ -681,21 +698,16 @@ export class CanopyCmsService extends Construct {
             vpc: this.vpc,
             vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
             securityGroups: [lambdaSg],
-            filesystem: lambda.FileSystem.fromEfsAccessPoint(accessPoint, '/mnt/efs'),
+            filesystem: lambda.FileSystem.fromEfsAccessPoint(accessPoint, EFS_MOUNT_PATH),
             // Pass the pre-created group via `logGroup`, NOT `logRetention` (CDK
             // throws LogRetentionLogGroupConflict/ConflictingLogPolicyOptions if
             // both are set on the same function) - the removal policy lives on the
             // LogGroup construct above instead.
             logGroup: this.cmsLogGroup,
             environment: {
-                // INVARIANT: the Lambda mounts EFS through the WorkspaceAP access point
-                // above, which is already rooted at EFS:/workspace - so /mnt/efs here IS
-                // EFS:/workspace. The EC2 worker instead mounts the filesystem ROOT at
-                // /mnt/efs (see UserData below) and reaches the same directory via
-                // /mnt/efs/workspace. Both paths must resolve to EFS:/workspace, or the
-                // Lambda and worker silently operate on different directories.
-                CANOPYCMS_WORKSPACE_ROOT: '/mnt/efs',
-                CANOPY_AUTH_CACHE_PATH: '/mnt/efs/.cache',
+                // The worker's `.env` gets the same root; see EFS_MOUNT_PATH.
+                CANOPYCMS_WORKSPACE_ROOT: EFS_MOUNT_PATH,
+                CANOPY_AUTH_CACHE_PATH: `${EFS_MOUNT_PATH}/.cache`,
                 // git >= 2.35.2 refuses repos owned by another uid (the access point
                 // forces uid 1000; Lambda containers run as a different user).
                 // Env-based GIT_CONFIG_* CANNOT fix this - simple-git hard-blocks env
@@ -819,7 +831,7 @@ export class CanopyCmsService extends Construct {
         // through `assertEnvSafe` in the single `map` below, so a value added here
         // later is guarded whether or not whoever adds it remembers to.
         const envEntries = [
-            ['CANOPYCMS_WORKSPACE_ROOT', '/mnt/efs/workspace'],
+            ['CANOPYCMS_WORKSPACE_ROOT', EFS_MOUNT_PATH],
             ['CANOPYCMS_GITHUB_OWNER', props.githubOwner],
             ['CANOPYCMS_GITHUB_REPO', props.githubRepo],
             ['CANOPYCMS_BASE_BRANCH', baseBranch],
@@ -884,8 +896,9 @@ export class CanopyCmsService extends Construct {
         const envFileContent = envEntries
             .map(([name, value]) => `${name}=${assertEnvSafe(name, value)}`)
             .join('\n');
+        const efsMountOptions = `tls,accesspoint=${accessPoint.accessPointId}`;
         const userData = ec2.UserData.forLinux();
-        userData.addCommands('#!/bin/bash', 'set -euo pipefail', '', '# FAIL-FAST. Every step below is required for the worker to exist at', '# all, and until this trap existed a failure in any of them aborted', '# user-data BEFORE the systemd unit was written -- leaving an instance', "# that runs, passes the ASG's EC2-only health check indefinitely, and", '# does nothing. cfn-signal is deliberately not used here (it would', '# prove nothing about READINESS, which is the argument recorded below),', '# but that argument never covered a boot-SCRIPT failure: `cdk deploy`', '# reported success while publishes queued on EFS, the auth cache went', '# stale and PRs stopped being created, until a human noticed the admin', '# panel showing the worker absent.', '#', '# Shutting down makes the instance fail its EC2 health check, so the ASG', '# replaces it -- which is the only automatic recovery available in this', '# topology. The echo lands in the console log, readable via', '# `aws ec2 get-console-output`, because the CloudWatch agent is itself', '# configured further down and cannot be relied on to exist yet.', 'trap \'echo "canopy-worker user-data FAILED at line $LINENO (exit $?)" >&2; shutdown -h now\' ERR', '', '# Bounded retry for the network-dependent steps. Package mirrors and S3', '# have transient failures; a single flake should cost seconds, not an', '# instance replacement.', 'retry() {', '  local n=0', '  until "$@"; do', '    n=$((n + 1))', '    if [ "$n" -ge 5 ]; then', '      echo "canopy-worker: command failed after $n attempts: $*" >&2', '      return 1', '    fi', '    sleep $((n * 5))', '  done', '}', '', '# Install dependencies (unzip is not guaranteed in the AL2023 AMI)', 'retry dnf install -y git unzip', "# Node comes from AL2023's own repos, NOT a piped third-party installer.", '# The previous boot curled the NodeSource RPM setup script straight into', '# bash, so every instance replacement -- which the ASG performs on every', '# `cdk deploy`, plus every spot interruption -- depended on a third party', '# being reachable. cms-deploy.test.ts asserts that URL never comes back,', '# which is why it is not spelled out here.', '#', '# nodejs22, not 20: Node 20 reached upstream EOL on 2026-04-30, and this', '# repo declares `engines.node: ">=22"` with .nvmrc `v22`, so the worker', '# was running an EOL runtime BELOW the floor its own code is tested at.', "# 22 (EOL 2027-04-30) matches .nvmrc, CI, and the transform Lambda's", '# NODEJS_22_X, so one runtime is tested everywhere.', '#', '# ExecStart uses the NAMESPACED /usr/bin/node-22 (see the systemd unit', '# below), not the bare `node`: AL2023 installs versioned binaries and', '# points `/usr/bin/node` at one of them through `alternatives`, whose', '# selection AWS documents as able to change at any time.', 'retry dnf install -y nodejs22', '', '# Mount EFS', 'retry dnf install -y amazon-efs-utils', 'mkdir -p /mnt/efs', `mount -t efs ${this.fileSystem.fileSystemId}:/ /mnt/efs`, '# Persist the mount across instance reboots: user-data runs once per', '# instance, so without an fstab entry a plain reboot leaves /mnt/efs an', '# empty local dir and the worker would clone a divergent remote.git', '# onto the instance disk, invisible to the Lambda.', `echo '${this.fileSystem.fileSystemId}:/ /mnt/efs efs _netdev 0 0' >> /etc/fstab`, '', '# Download worker from CDK S3 Asset', `retry aws s3 cp s3://${workerAsset.s3BucketName}/${workerAsset.s3ObjectKey} /tmp/canopy-worker.zip`, 'mkdir -p /opt/canopy-worker', 'cd /opt/canopy-worker', 'unzip -o /tmp/canopy-worker.zip', '# The worker bundle is ESM (esbuild --format=esm). Without this marker a', '# .js file is CommonJS by default and the import statement fails.', '# Node >=22.7 auto-detects module syntax and would mask its absence, and', '# this instance now runs node-22 -- so the marker is kept BECAUSE that', '# auto-detection is a fallback we should not depend on, not because the', '# runtime here still needs it.', `echo '{"type":"module"}' > /opt/canopy-worker/package.json`, '', '# Write environment file for systemd service', `cat > /opt/canopy-worker/.env << 'ENVEOF'`, envFileContent, 'ENVEOF', '', '# Create systemd service', `cat > /etc/systemd/system/canopy-worker.service << 'SVCEOF'`, '[Unit]', 'Description=CanopyCMS Worker Daemon', 'After=network.target', '# Never run against an unmounted /mnt/efs (see the fstab note above).', 'RequiresMountsFor=/mnt/efs', '', '[Service]', 'Type=simple', 'User=ec2-user', 'WorkingDirectory=/opt/canopy-worker', '# Namespaced binary, not bare `node`: AL2023 points /usr/bin/node at', '# an installed version through `alternatives`, and AWS documents that', '# selection as able to change at any time. node-22 always means 22.', 'ExecStart=/usr/bin/node-22 index.js', 'Restart=always', 'RestartSec=5', 'TimeoutStartSec=300', '# File output, not journal: the CloudWatch agent cannot read journald,', '# so it tails this file instead (see the agent config below).', '# CAUTION: /var/log/canopy-worker must exist BEFORE first start. systemd', '# opens append: targets before it creates LogsDirectory= dirs', '# (systemd#27591), so without the pre-created dir the exec fails with', '# 209/STDOUT and Restart=always crash-loops forever. User-data runs', '# mkdir before systemctl start; LogsDirectory= is kept for ownership.', 'LogsDirectory=canopy-worker', 'StandardOutput=append:/var/log/canopy-worker/worker.log', 'StandardError=append:/var/log/canopy-worker/worker.log', 'EnvironmentFile=/opt/canopy-worker/.env', '', '[Install]', 'WantedBy=multi-user.target', 'SVCEOF', '', '# Set ownership for ec2-user', 'chown -R ec2-user:ec2-user /opt/canopy-worker', '# Non-recursive: EFS access point enforces UID 1000 for Lambda.', '# Only set ownership on mount point and workspace dir to avoid', '# slow recursive chown on large filesystems during ASG replacements.', 'chown ec2-user:ec2-user /mnt/efs', 'mkdir -p /mnt/efs/workspace', 'chown ec2-user:ec2-user /mnt/efs/workspace', '', '# Pre-create the worker log dir (crash-loop guard, MUST precede the', '# first systemctl start): systemd opens StandardOutput=append: files', '# BEFORE it creates LogsDirectory= dirs (systemd#27591), so on a fresh', '# instance the unit would fail exec with 209/STDOUT and crash-loop', '# forever without this. The unit keeps LogsDirectory= for ownership', '# management on subsequent starts.', 'mkdir -p /var/log/canopy-worker', 'chown ec2-user:ec2-user /var/log/canopy-worker', '', '# Start worker', 'systemctl daemon-reload', 'systemctl enable canopy-worker', 'systemctl start canopy-worker', '', '# ---- CloudWatch log shipping ----', '# Placed AFTER worker start: with set -euo pipefail, a package/agent', '# failure here must not prevent the worker from running (shipping is', '# best-effort).', '#', '# DISARM THE FAIL-FAST TRAP AND errexit FIRST. Everything above this line', '# is required for the worker to exist at all, so a failure there should', '# replace the instance. Nothing below it is: the worker is already', '# running and healthy by this point. Leaving the trap armed would let a', '# package-mirror outage during the agent install shut down a perfectly', '# good worker -- and the ASG would relaunch straight into the same', '# outage, turning degraded log shipping into a replacement loop with the', '# worker down for its duration. That is strictly worse than the', '# best-effort behaviour this section has always documented.', 'trap - ERR', 'set +e', 'retry dnf install -y amazon-cloudwatch-agent logrotate', '', '# Bound on-disk growth; copytruncate keeps the fd the CW agent tails valid', '# (tiny copy->truncate loss window is acceptable for diagnostic logs).', `cat > /etc/logrotate.d/canopy-worker << 'ROTEOF'`, '/var/log/canopy-worker/worker.log {', '    size 10M', '    rotate 5', '    compress', '    copytruncate', '    missingok', '    notifempty', '}', 'ROTEOF', '# The config above only fires when logrotate actually runs; AL2023', '# presets may leave logrotate.timer disabled, and without it the size', '# cap never triggers and worker.log grows until the nano disk fills.', '# --now is idempotent if the timer is already enabled/running.', 'systemctl enable --now logrotate.timer', '', '# No retention_in_days here: CDK owns retention on the pre-created group.', `cat > /opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json << 'CWEOF'`, '{', '  "logs": {', '    "logs_collected": {', '      "files": {', '        "collect_list": [', '          {', '            "file_path": "/var/log/canopy-worker/worker.log",', `            "log_group_name": "${this.workerLogGroup.logGroupName}",`, '            "log_stream_name": "{instance_id}",', 
+        userData.addCommands('#!/bin/bash', 'set -euo pipefail', '', '# FAIL-FAST. Every step below is required for the worker to exist at', '# all, and until this trap existed a failure in any of them aborted', '# user-data BEFORE the systemd unit was written -- leaving an instance', "# that runs, passes the ASG's EC2-only health check indefinitely, and", '# does nothing. cfn-signal is deliberately not used here (it would', '# prove nothing about READINESS, which is the argument recorded below),', '# but that argument never covered a boot-SCRIPT failure: `cdk deploy`', '# reported success while publishes queued on EFS, the auth cache went', '# stale and PRs stopped being created, until a human noticed the admin', '# panel showing the worker absent.', '#', '# Shutting down makes the instance fail its EC2 health check, so the ASG', '# replaces it -- which is the only automatic recovery available in this', '# topology. The echo lands in the console log, readable via', '# `aws ec2 get-console-output`, because the CloudWatch agent is itself', '# configured further down and cannot be relied on to exist yet.', 'trap \'echo "canopy-worker user-data FAILED at line $LINENO (exit $?)" >&2; shutdown -h now\' ERR', '', '# Bounded retry for the network-dependent steps. Package mirrors and S3', '# have transient failures; a single flake should cost seconds, not an', '# instance replacement.', 'retry() {', '  local n=0', '  until "$@"; do', '    n=$((n + 1))', '    if [ "$n" -ge 5 ]; then', '      echo "canopy-worker: command failed after $n attempts: $*" >&2', '      return 1', '    fi', '    sleep $((n * 5))', '  done', '}', '', '# Install dependencies (unzip is not guaranteed in the AL2023 AMI)', 'retry dnf install -y git unzip', "# Node comes from AL2023's own repos, NOT a piped third-party installer.", '# The previous boot curled the NodeSource RPM setup script straight into', '# bash, so every instance replacement -- which the ASG performs on every', '# `cdk deploy`, plus every spot interruption -- depended on a third party', '# being reachable. cms-deploy.test.ts asserts that URL never comes back,', '# which is why it is not spelled out here.', '#', '# nodejs22, not 20: Node 20 reached upstream EOL on 2026-04-30, and this', '# repo declares `engines.node: ">=22"` with .nvmrc `v22`, so the worker', '# was running an EOL runtime BELOW the floor its own code is tested at.', "# 22 (EOL 2027-04-30) matches .nvmrc, CI, and the transform Lambda's", '# NODEJS_22_X, so one runtime is tested everywhere.', '#', '# ExecStart uses the NAMESPACED /usr/bin/node-22 (see the systemd unit', '# below), not the bare `node`: AL2023 installs versioned binaries and', '# points `/usr/bin/node` at one of them through `alternatives`, whose', '# selection AWS documents as able to change at any time.', 'retry dnf install -y nodejs22', '', '# Mount EFS through the same access point, at the same path, as the', '# Lambda (see EFS_MOUNT_PATH). amazon-efs-utils refuses an access-point', '# mount without tls (efs_utils_common/mount_options.py).', 'retry dnf install -y amazon-efs-utils', `mkdir -p ${EFS_MOUNT_PATH}`, `mount -t efs -o ${efsMountOptions} ${this.fileSystem.fileSystemId}:/ ${EFS_MOUNT_PATH}`, '# Persist the mount across instance reboots: user-data runs once per', '# instance, so without an fstab entry a plain reboot leaves /mnt/efs an', '# empty local dir and the worker would clone a divergent remote.git', '# onto the instance disk, invisible to the Lambda.', `echo '${this.fileSystem.fileSystemId}:/ ${EFS_MOUNT_PATH} efs _netdev,${efsMountOptions} 0 0' >> /etc/fstab`, '', '# Download worker from CDK S3 Asset', `retry aws s3 cp s3://${workerAsset.s3BucketName}/${workerAsset.s3ObjectKey} /tmp/canopy-worker.zip`, 'mkdir -p /opt/canopy-worker', 'cd /opt/canopy-worker', 'unzip -o /tmp/canopy-worker.zip', '# The worker bundle is ESM (esbuild --format=esm). Without this marker a', '# .js file is CommonJS by default and the import statement fails.', '# Node >=22.7 auto-detects module syntax and would mask its absence, and', '# this instance now runs node-22 -- so the marker is kept BECAUSE that', '# auto-detection is a fallback we should not depend on, not because the', '# runtime here still needs it.', `echo '{"type":"module"}' > /opt/canopy-worker/package.json`, '', '# Write environment file for systemd service', `cat > /opt/canopy-worker/.env << 'ENVEOF'`, envFileContent, 'ENVEOF', '', '# Create systemd service', `cat > /etc/systemd/system/canopy-worker.service << 'SVCEOF'`, '[Unit]', 'Description=CanopyCMS Worker Daemon', 'After=network.target', '# Never run against an unmounted /mnt/efs (see the fstab note above).', `RequiresMountsFor=${EFS_MOUNT_PATH}`, '', '[Service]', 'Type=simple', 'User=ec2-user', 'WorkingDirectory=/opt/canopy-worker', '# Namespaced binary, not bare `node`: AL2023 points /usr/bin/node at', '# an installed version through `alternatives`, and AWS documents that', '# selection as able to change at any time. node-22 always means 22.', 'ExecStart=/usr/bin/node-22 index.js', 'Restart=always', 'RestartSec=5', 'TimeoutStartSec=300', '# File output, not journal: the CloudWatch agent cannot read journald,', '# so it tails this file instead (see the agent config below).', '# CAUTION: /var/log/canopy-worker must exist BEFORE first start. systemd', '# opens append: targets before it creates LogsDirectory= dirs', '# (systemd#27591), so without the pre-created dir the exec fails with', '# 209/STDOUT and Restart=always crash-loops forever. User-data runs', '# mkdir before systemctl start; LogsDirectory= is kept for ownership.', 'LogsDirectory=canopy-worker', 'StandardOutput=append:/var/log/canopy-worker/worker.log', 'StandardError=append:/var/log/canopy-worker/worker.log', 'EnvironmentFile=/opt/canopy-worker/.env', '', '[Install]', 'WantedBy=multi-user.target', 'SVCEOF', '', '# Set ownership for ec2-user', 'chown -R ec2-user:ec2-user /opt/canopy-worker', '', '# Pre-create the worker log dir (crash-loop guard, MUST precede the', '# first systemctl start): systemd opens StandardOutput=append: files', '# BEFORE it creates LogsDirectory= dirs (systemd#27591), so on a fresh', '# instance the unit would fail exec with 209/STDOUT and crash-loop', '# forever without this. The unit keeps LogsDirectory= for ownership', '# management on subsequent starts.', 'mkdir -p /var/log/canopy-worker', 'chown ec2-user:ec2-user /var/log/canopy-worker', '', '# Start worker', 'systemctl daemon-reload', 'systemctl enable canopy-worker', 'systemctl start canopy-worker', '', '# ---- CloudWatch log shipping ----', '# Placed AFTER worker start: with set -euo pipefail, a package/agent', '# failure here must not prevent the worker from running (shipping is', '# best-effort).', '#', '# DISARM THE FAIL-FAST TRAP AND errexit FIRST. Everything above this line', '# is required for the worker to exist at all, so a failure there should', '# replace the instance. Nothing below it is: the worker is already', '# running and healthy by this point. Leaving the trap armed would let a', '# package-mirror outage during the agent install shut down a perfectly', '# good worker -- and the ASG would relaunch straight into the same', '# outage, turning degraded log shipping into a replacement loop with the', '# worker down for its duration. That is strictly worse than the', '# best-effort behaviour this section has always documented.', 'trap - ERR', 'set +e', 'retry dnf install -y amazon-cloudwatch-agent logrotate', '', '# Bound on-disk growth; copytruncate keeps the fd the CW agent tails valid', '# (tiny copy->truncate loss window is acceptable for diagnostic logs).', `cat > /etc/logrotate.d/canopy-worker << 'ROTEOF'`, '/var/log/canopy-worker/worker.log {', '    size 10M', '    rotate 5', '    compress', '    copytruncate', '    missingok', '    notifempty', '}', 'ROTEOF', '# The config above only fires when logrotate actually runs; AL2023', '# presets may leave logrotate.timer disabled, and without it the size', '# cap never triggers and worker.log grows until the nano disk fills.', '# --now is idempotent if the timer is already enabled/running.', 'systemctl enable --now logrotate.timer', '', '# No retention_in_days here: CDK owns retention on the pre-created group.', `cat > /opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json << 'CWEOF'`, '{', '  "logs": {', '    "logs_collected": {', '      "files": {', '        "collect_list": [', '          {', '            "file_path": "/var/log/canopy-worker/worker.log",', `            "log_group_name": "${this.workerLogGroup.logGroupName}",`, '            "log_stream_name": "{instance_id}",', 
         // The worker prefixes every line with an ISO-8601 timestamp
         // (packages/canopycms/src/worker/log.ts). Parsing it here is what makes
         // CloudWatch show the time the WORKER emitted a line rather than the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canopycms-cdk",
-  "version": "0.0.68-int.95",
+  "version": "0.0.68-int.96",
   "description": "AWS CDK constructs and EC2 worker for CanopyCMS deployment",
   "license": "MIT",
   "repository": {
@@ -31,7 +31,7 @@
   "peerDependencies": {
     "aws-cdk-lib": "^2.260.0",
     "constructs": "^10.0.0",
-    "canopycms": "0.0.68-int.95"
+    "canopycms": "0.0.68-int.96"
   },
   "peerDependenciesMeta": {
     "aws-cdk-lib": {
@@ -56,8 +56,8 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.3",
     "vitest": "^4.1.0",
-    "canopycms-auth-clerk": "0.0.68-int.95",
-    "canopycms": "0.0.68-int.95"
+    "canopycms": "0.0.68-int.96",
+    "canopycms-auth-clerk": "0.0.68-int.96"
   },
   "scripts": {
     "build": "rm -rf dist && tsc && node ../../scripts/add-js-extensions.mjs dist",

package/worker/dist/index.js

@@ -48958,7 +48958,7 @@ async function writeWorkerStatus(taskDir, report) {
 }
 
 // ../canopycms/src/version.ts
-var CANOPYCMS_VERSION = "0.0.68-int.95";
+var CANOPYCMS_VERSION = "0.0.68-int.96";
 
 // ../canopycms/src/worker/log.ts
 init_logger();
@@ -49871,7 +49871,7 @@ async function forcePublishToLocalRemote(ctx, branchPath, branchRef, expectedSha
       // Real flags must precede --end-of-options; everything after it is
       // positional (see GitManager.push() for the same guard).
       "--end-of-options",
-      "origin",
+      ctx.remoteGitPath,
       `${branchRef}:${branchRef}`
     ]);
     workerLog(`  Published rebased ${branchRef} into remote.git`);
@@ -50686,7 +50686,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
       }
       const trackedState = trackedCanopyStateChanges(dirtyCheck);
       if (trackedState.length > 0) {
-        await branchGit.fetch("origin", ctx.baseBranch);
+        await branchGit.fetch(ctx.remoteGitPath, ctx.baseBranch);
         const baseTip = (await branchGit.revparse(["FETCH_HEAD"])).trim();
         const { stillTracked } = await splitByUpstreamTracking(branchGit, trackedState, baseTip);
         const reason = stillTracked.length > 0 ? `git cannot rebase over modified canopycms state the repo tracks (${trackedState.join(", ")}). To fix, ${TRACKED_CANOPY_STATE_FIX}.` : `git cannot rebase over modified canopycms state this clone still tracks (${trackedState.join(", ")}), though the base branch no longer does; the clone needs manual repair`;
@@ -50705,7 +50705,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
           marker: metaFile.branch.historyRewrittenFrom
         });
       }
-      await branchGit.fetch("origin", ctx.baseBranch);
+      await branchGit.fetch(ctx.remoteGitPath, ctx.baseBranch);
       const fetchedBaseTip = (await branchGit.revparse(["FETCH_HEAD"])).trim();
       const behindCount = parseInt(
         (await branchGit.raw(["rev-list", "--count", `HEAD..${fetchedBaseTip}`])).trim(),
@@ -51149,7 +51149,7 @@ async function refreshBaseBranchWorkspace(ctx) {
         trackedCanopyMeta
       };
     }
-    await baseGit.fetch("origin", ctx.baseBranch);
+    await baseGit.fetch(ctx.remoteGitPath, ctx.baseBranch);
     const fetchedTip = (await baseGit.revparse(["FETCH_HEAD"])).trim();
     const behindCount = parseInt(
       (await baseGit.raw(["rev-list", "--count", `HEAD..${fetchedTip}`])).trim(),