naiad-cli 0.2.36 → 0.2.37

package/extensions/naiad-extension.ts

@@ -882,7 +882,7 @@ When you're done, provide a clear, actionable summary the caller can act on.`;
 
         // Set git identity and commit
         execFileSync("git", ["config", "user.name", "naiad-bot"]);
-        execFileSync("git", ["config", "user.email", "bot@naiad.dev"]);
+        execFileSync("git", ["config", "user.email", "266131081+naiad-bot@users.noreply.github.com"]);
         execFileSync("git", ["commit", "-m", params.message]);
 
         const headSha = execFileSync("git", ["rev-parse", "HEAD"]).toString().trim();
@@ -935,27 +935,33 @@ When you're done, provide a clear, actionable summary the caller can act on.`;
 
           const basicAuth = Buffer.from(`x-access-token:${pushToken}`).toString("base64");
 
-          // Clean-room push
-          execFileSync(
-            "git",
-            [
-              "-c", "core.hooksPath=/dev/null",
-              "-c", "credential.helper=",
-              "-c", "include.path=",
-              `-c`, `http.extraheader=Authorization: Basic ${basicAuth}`,
-              "push", pushUrl, `HEAD:refs/heads/${branch}`, "--no-force",
-            ],
-            {
-              env: {
-                PATH: process.env.PATH,
-                HOME: process.env.HOME,
-                GIT_CONFIG_NOSYSTEM: "1",
-                GIT_CONFIG_GLOBAL: "/dev/null",
-                GIT_CONFIG: "/dev/null",
-                GIT_TERMINAL_PROMPT: "0",
+          // Clean-room push — env vars (GIT_CONFIG_NOSYSTEM, GIT_CONFIG_GLOBAL,
+          // GIT_CONFIG) already neutralize system/global/local config includes.
+          try {
+            execFileSync(
+              "git",
+              [
+                "-c", "core.hooksPath=/dev/null",
+                "-c", "credential.helper=",
+                `-c`, `http.extraheader=Authorization: Basic ${basicAuth}`,
+                "push", pushUrl, `HEAD:refs/heads/${branch}`, "--no-force",
+              ],
+              {
+                env: {
+                  PATH: process.env.PATH,
+                  HOME: process.env.HOME,
+                  GIT_CONFIG_NOSYSTEM: "1",
+                  GIT_CONFIG_GLOBAL: "/dev/null",
+                  GIT_CONFIG: "/dev/null",
+                  GIT_TERMINAL_PROMPT: "0",
+                },
               },
-            },
-          );
+            );
+          } catch (pushErr: any) {
+            // Sanitize error — execFileSync includes the full command with credentials
+            const stderr = pushErr.stderr?.toString() || "";
+            throw new Error(`git push failed: ${stderr.replace(/Authorization:[^\s]*/g, "Authorization: [REDACTED]")}`);
+          }
 
           // Post-push verification (defense-in-depth: server checks for merge commits)
           const verifyResult = await callToolEndpoint("POST", "post-push-verify", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naiad-cli",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "type": "module",
   "bin": {
     "naiad": "./dist/index.js"