renovate-mcp 0.9.4 → 0.11.0

package/README.md

@@ -48,7 +48,7 @@ See [Design notes](#design-notes) for implementation details (timeouts, safety c
 - **Not a Renovate replacement.** This server doesn't open PRs, run scheduled updates, or execute in CI — it's a design-time companion for a local `renovate.json`. Use the real Renovate for the actual dependency-update pipeline.
 - **`resolve_config` is preview-quality.** Preset expansion runs against a committed snapshot, and template substitution implements only positional `{{argN}}` placeholders — non-positional tokens and Handlebars helpers are flagged in `warnings` and pass through verbatim. For authoritative output, run `dry_run`.
 - **`preview_custom_manager` is a subset of Renovate's regex manager.** It covers `customType: "regex"`, `matchStringsStrategy` of `any` / `combination` / `recursive`, and `{{groupName}}` template substitution only — other custom types and full Handlebars (helpers, conditionals) are not implemented. Use it for fast regex iteration; confirm with `dry_run`.
-- **`validate_config` / `dry_run` aren't exercised in CI.** CI deliberately doesn't install Renovate, so tools that shell out to it are only covered by unit/integration tests that don't require the binary. Run them locally against the Renovate install you intend to deploy with.
+- **`validate_config` / `dry_run` aren't exercised end-to-end in CI.** The bundled Renovate is available (it's a runtime dep), but the integration tests use fake binaries via `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env overrides for determinism and speed. Run the tools locally against a real config to validate behaviour.
 
 ## Requirements
 
@@ -56,11 +56,12 @@ See [Design notes](#design-notes) for implementation details (timeouts, safety c
 
 - Linux or macOS. Windows is not supported — `package.json` declares `"os": ["darwin", "linux"]`, so `npm i` surfaces an `EBADPLATFORM` warning on Windows, and the server exits with a clear stderr message at startup. Run on WSL2 or a Linux/macOS host instead.
 - Node.js ≥ 24 (aligns with Renovate's own engine requirement).
-- Renovate on your `PATH` — either a global install (`npm i -g renovate`) or a project-local install that exposes `renovate` + `renovate-config-validator` via `npm exec`. Only needed for `validate_config`, `dry_run`, and `write_config`; the offline tools (`read_config`, `resolve_config`, `preview_custom_manager`, `lint_config`) work without it.
+
+Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `resolve_config`, `explain_config`, `preview_custom_manager`, `lint_config`) never spawn Renovate at all.
 
 **Optional**
 
-- `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override binary locations.
+- `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override the bundled binaries (e.g., to point at a different Renovate install). When set, the override always wins.
 - `RENOVATE_MCP_REQUIRE_CLI=false` — suppress the startup "partial availability" notice when you only intend to use the offline tools.
 - Platform env vars — `RENOVATE_PLATFORM`, `RENOVATE_ENDPOINT`, and a token (`RENOVATE_TOKEN` / `GITHUB_TOKEN` / `GITLAB_TOKEN`). Needed for `dry_run` against a remote platform and for `resolve_config` with `externalPresets: true`. See [Platform setup](#platform-setup) for the matrix and a worked example.
 - Private-registry credentials for `dry_run` — whatever Renovate itself would need at lookup time (`COMPOSER_AUTH`, `NPM_TOKEN` / `.npmrc`, Docker registry creds, or a `RENOVATE_HOST_RULES` JSON blob). Alternatively encode these as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on `dry_run` (no MCP restart needed). Per-call `hostRules` are appended to whatever the repo's own config declares. Values reach Renovate as JSON through the tool-call transport, so the calling LLM sees them in its context — prefer the env route if that matters. Without any of these, Renovate's lookup often returns 0 updates silently; `dry_run` scans its logs for auth failures and surfaces them under `problems`.
@@ -255,6 +256,7 @@ Secrets required on the repo: `RELEASE_PLEASE_TOKEN` (a PAT for release-please).
 Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); this section covers implementation decisions behind the scope that *is* supported.
 
 - `validate_config`, `dry_run`, and `write_config` shell out to the Renovate CLI rather than importing Renovate as a library — this decouples our Node version from Renovate's (currently Node 24).
+- The `renovate` package is bundled as a runtime dependency so users don't need a separate `npm i -g renovate`. We still spawn the binary as a child process (via `node node_modules/renovate/dist/renovate.js`) — never `import "renovate"` from `src/`. Resolution order is `RENOVATE_BIN` env override → bundled JS entry resolved via `require.resolve("renovate/package.json")` → bare tool name on `PATH`. The env override is the supported escape hatch when a user wants a different Renovate version.
 - `resolve_config`, `preview_custom_manager`, and `lint_config` are fully in-process and never invoke the Renovate CLI, so they work without a Renovate install.
 - `lint_config` is a semantic lint pass that sits alongside `validate_config` rather than replacing it: schema validation catches structural bugs, the linter catches Renovate-specific footguns that schema validation declares valid — most commonly a pattern like `"matchPackageNames": ["/devops\\/pipelines\\/.+"]` where a trailing `/` is missing and Renovate silently degrades the value to an exact-string match that never hits, or a typo like `"matchManagers": ["npmm"]` that silently applies the rule to zero packages. The ruleset is intentionally small (three rules: `dead-regex-missing-slash`, `unwrapped-regex`, `matchManagers-unknown-name`), scoped to the four regex-aware fields plus `matchManagers` / `excludeManagers`, and tuned to avoid false positives on benign exact strings containing a `.`. The valid-manager list is snapshotted from the `renovate` devDep at `src/data/managers.generated.ts` (regenerate with `npm run generate:managers`), and unknown names get a Damerau-Levenshtein "did you mean?" suggestion when something close enough exists. Rule IDs are stable so findings can be suppressed by callers.
 - `preview_custom_manager` honors `.gitignore` (including nested `.gitignore`s and `.git/info/exclude`) when walking the repo, so generated/vendored directories like `dist/`, `.next/`, `target/`, `__pycache__/` don't crowd out real hits against the `maxFilesWalked` cap. `node_modules/` and `.git/` are always skipped as a safety net even when no `.gitignore` is present.
@@ -274,3 +276,4 @@ Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); thi
 - `dry_run` emits MCP progress notifications only when the caller's `tools/call` includes `_meta.progressToken` — no-op otherwise, so legacy clients see zero overhead. A 5-second heartbeat ticks while the child runs; each tick's message is best-effort enriched with the latest Renovate JSON-log `msg` seen on stdout. Notifications are also emitted at start and completion. We deliberately don't couple to Renovate's log schema beyond reading `msg`, since that schema isn't a stable API.
 - `dry_run_diff` is stateless on purpose: both reports are passed as inputs, no per-repo state is kept on the server. Updates are keyed by `(manager, packageFile, depName)` so a version bump on the same dep shows up once under `changed` rather than twice as `removed + added`. Compared per identity: `newValue`, `newVersion`, `updateType`, `branchName`, `groupName`, `schedule`. Either input can be the raw Renovate report or the full `dry_run` summary (with the `report` key) — the tool unwraps `report` automatically.
 - `write_config` writes to a temp file, validates, then atomically renames — so a failed validation never leaves a broken config on disk. The `force: true` escape hatch is gated behind a separate `confirmForce: "YES_OVERRIDE_VALIDATION"` literal: a single boolean is too easy for a prompt-injected agent to flip, but emitting an unusual sentinel string is a deliberate step that's harder to navigate accidentally.
+- `check_setup` and the shell-out tools (`validate_config`, `write_config`, `dry_run`) detect Renovate runtime conditions that degrade the tool silently — currently the bundled `re2` native module failing to load (typically after a Node major-version upgrade leaves a prebuilt `re2.node` compiled against the old ABI). When the WARN appears in Renovate's stderr, the tool response carries a `warnings: [{ kind: "re2-unusable", … }]` entry alongside its normal output and `check_setup` aggregates the same warning into `SetupStatus.warnings` plus the startup `instructions` banner. Renovate keeps running on JavaScript `RegExp` so calls don't fail, but regex-heavy operations (custom managers, validation, lookups) are noticeably slower; the fix hint is to reinstall renovate-mcp (which reinstalls the bundled `renovate` and rebuilds its native deps), or run `npm rebuild re2` inside the renovate-mcp install's `node_modules/renovate`. This is passive detection only — the server doesn't rebuild anything itself.

package/dist/lib/renovateCli.d.ts

@@ -1,7 +1,15 @@
+import { type RuntimeWarning } from "./runtimeWarnings.js";
 export interface RunResult {
     stdout: string;
     stderr: string;
     exitCode: number;
+    /**
+     * Renovate runtime conditions detected from stderr that the caller benefits
+     * from knowing about even though the run itself may have succeeded (e.g. RE2
+     * native-module dlopen failure causing a silent slow-path fallback). Always
+     * present — empty array when nothing was detected.
+     */
+    runtimeWarnings: RuntimeWarning[];
 }
 export interface RunOptions {
     cwd?: string;
@@ -23,17 +31,41 @@ export interface RunOptions {
  * timeouts.
  */
 export declare function run(cmd: string, args: string[], opts?: RunOptions): Promise<RunResult>;
+export interface ResolvedRenovateTool {
+    /** Process to spawn. */
+    cmd: string;
+    /** Args prepended to the caller's args (e.g., the JS file path when `cmd` is `node`). */
+    prefixArgs: string[];
+    /** Where the binary came from — drives setup-status messaging. */
+    source: "env" | "bundled" | "path";
+    /**
+     * Raw user-visible identifier for the resolved binary. For `env` it's the
+     * env-var value (often an absolute path); for `bundled` and `path` it's the
+     * tool name. Callers compose this with `source` when rendering a label —
+     * keeping it raw avoids producing nested parens in error messages like
+     * `MISSING — <err> (<command>)`.
+     */
+    command: string;
+}
 /**
- * Resolve how to invoke a Renovate CLI tool. Users can override via env:
- *   RENOVATE_BIN                  — path to the `renovate` binary
- *   RENOVATE_CONFIG_VALIDATOR_BIN — path to the validator binary
- * Otherwise we rely on PATH resolution (globally installed Renovate, or a
- * `npm exec` from a project with Renovate installed locally).
+ * Resolve how to invoke a Renovate CLI tool. Resolution order:
+ *   1. `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env override — if set,
+ *      always wins (even if it points at a broken path; we surface the spawn
+ *      error rather than silently falling through).
+ *   2. Bundled binary — the `renovate` package is a runtime dep, so its
+ *      `bin/renovate.js` / `bin/config-validator.js` ship with the install.
+ *      Spawned as `node <jsPath>` to sidestep shebang/permission concerns.
+ *   3. Bare tool name on `PATH` — last-resort fallback for the unusual case
+ *      where the bundled lookup fails (e.g. a corrupted node_modules). Only
+ *      manually tested; unit-testing this branch would require monkey-patching
+ *      `require.resolve` to fake a bundled-lookup failure.
  */
-export declare function resolveRenovateTool(tool: "renovate" | "renovate-config-validator"): string;
+export declare function resolveRenovateTool(tool: "renovate" | "renovate-config-validator"): ResolvedRenovateTool;
 /**
  * Centralized message for when a Renovate CLI binary can't be spawned (ENOENT,
  * permission denied, etc.). Used by all tools that shell out so users get
- * consistent, actionable hints instead of raw spawn errors.
+ * consistent, actionable hints instead of raw spawn errors. Renovate ships
+ * bundled with the server, so the most likely cause of failure here is a
+ * deliberately broken `RENOVATE_BIN` override or a corrupted install.
  */
 export declare function formatMissingBinaryError(tool: "renovate" | "renovate-config-validator", cause: Error): string;

package/dist/lib/renovateCli.js

@@ -1,4 +1,9 @@
 import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import path from "node:path";
+import fs from "node:fs";
+import { detectRuntimeWarnings } from "./runtimeWarnings.js";
+const requireFromHere = createRequire(import.meta.url);
 /**
  * Spawn a command and capture stdout/stderr. Never throws on non-zero exit —
  * caller inspects exitCode. Throws only for spawn errors (ENOENT etc.) and
@@ -78,7 +83,12 @@ export function run(cmd, args, opts = {}) {
                 reject(new Error(`Command timed out after ${opts.timeoutMs}ms: ${cmd} ${args.join(" ")}`));
                 return;
             }
-            resolve({ stdout, stderr, exitCode: code ?? -1 });
+            resolve({
+                stdout,
+                stderr,
+                exitCode: code ?? -1,
+                runtimeWarnings: detectRuntimeWarnings(stderr),
+            });
         });
         if (opts.stdin != null) {
             child.stdin.end(opts.stdin);
@@ -89,26 +99,66 @@ export function run(cmd, args, opts = {}) {
     });
 }
 /**
- * Resolve how to invoke a Renovate CLI tool. Users can override via env:
- *   RENOVATE_BIN                  — path to the `renovate` binary
- *   RENOVATE_CONFIG_VALIDATOR_BIN — path to the validator binary
- * Otherwise we rely on PATH resolution (globally installed Renovate, or a
- * `npm exec` from a project with Renovate installed locally).
+ * Locate the JS entry-point for one of Renovate's CLI tools inside the
+ * `renovate` npm package shipped as a runtime dep. Returns `null` if the
+ * package can't be resolved or its `bin` field doesn't list the tool —
+ * callers fall back to PATH lookup so a user with a deliberately broken
+ * `renovate` install (or an unusual install topology that hides it from
+ * `require.resolve`) still has an escape hatch.
+ */
+function resolveBundledBinary(tool) {
+    try {
+        const pkgPath = requireFromHere.resolve("renovate/package.json");
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+        const binEntry = pkg.bin?.[tool];
+        if (typeof binEntry !== "string")
+            return null;
+        const binAbs = path.join(path.dirname(pkgPath), binEntry);
+        if (!fs.existsSync(binAbs))
+            return null;
+        return binAbs;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve how to invoke a Renovate CLI tool. Resolution order:
+ *   1. `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env override — if set,
+ *      always wins (even if it points at a broken path; we surface the spawn
+ *      error rather than silently falling through).
+ *   2. Bundled binary — the `renovate` package is a runtime dep, so its
+ *      `bin/renovate.js` / `bin/config-validator.js` ship with the install.
+ *      Spawned as `node <jsPath>` to sidestep shebang/permission concerns.
+ *   3. Bare tool name on `PATH` — last-resort fallback for the unusual case
+ *      where the bundled lookup fails (e.g. a corrupted node_modules). Only
+ *      manually tested; unit-testing this branch would require monkey-patching
+ *      `require.resolve` to fake a bundled-lookup failure.
  */
 export function resolveRenovateTool(tool) {
     const envKey = tool === "renovate" ? "RENOVATE_BIN" : "RENOVATE_CONFIG_VALIDATOR_BIN";
-    return process.env[envKey] || tool;
+    const envValue = process.env[envKey];
+    if (envValue) {
+        return { cmd: envValue, prefixArgs: [], source: "env", command: envValue };
+    }
+    const bundled = resolveBundledBinary(tool);
+    if (bundled) {
+        return { cmd: process.execPath, prefixArgs: [bundled], source: "bundled", command: tool };
+    }
+    return { cmd: tool, prefixArgs: [], source: "path", command: tool };
 }
 /**
  * Centralized message for when a Renovate CLI binary can't be spawned (ENOENT,
  * permission denied, etc.). Used by all tools that shell out so users get
- * consistent, actionable hints instead of raw spawn errors.
+ * consistent, actionable hints instead of raw spawn errors. Renovate ships
+ * bundled with the server, so the most likely cause of failure here is a
+ * deliberately broken `RENOVATE_BIN` override or a corrupted install.
  */
 export function formatMissingBinaryError(tool, cause) {
     const envKey = tool === "renovate" ? "RENOVATE_BIN" : "RENOVATE_CONFIG_VALIDATOR_BIN";
     return [
         `Failed to run \`${tool}\`: ${cause.message}.`,
-        `Install Renovate globally with \`npm i -g renovate\`, or set ${envKey} to point at an existing binary.`,
+        `Renovate ships bundled with renovate-mcp; if the bundled binary fails to load, set ${envKey} to a working binary or reinstall renovate-mcp.`,
         "Call the `check_setup` tool for a full diagnostic.",
     ].join(" ");
 }

package/dist/lib/runtimeWarnings.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Detect Renovate runtime warnings emitted to stderr that callers benefit from
+ * knowing about even though Renovate itself keeps running. Currently the only
+ * detected condition is the RE2 native-module dlopen failure: when the bundled
+ * `re2.node` was compiled against a different Node ABI than the one currently
+ * running, Renovate logs a single WARN and silently falls back to JavaScript
+ * `RegExp`. The fallback is functional but significantly slower for
+ * regex-heavy operations (custom managers, validation, lookups), and the
+ * degradation is otherwise invisible to MCP callers.
+ *
+ * Mirrors the parsing pattern in `lookupProblems.ts`: line-by-line scan,
+ * try-JSON-then-plain-text per line, dedupe, and cap the output. We also keep
+ * the parser narrow on purpose — Renovate emits many benign WARNs during
+ * normal runs (preset deprecations, etc.) and a generic capture would leak
+ * them into our responses.
+ */
+export type RuntimeWarningKind = "re2-unusable";
+export interface RuntimeWarning {
+    kind: RuntimeWarningKind;
+    message: string;
+    detail?: string;
+    fix: string;
+}
+export declare function detectRuntimeWarnings(stderr: string): RuntimeWarning[];
+export declare function dedupeRuntimeWarnings(warnings: RuntimeWarning[]): RuntimeWarning[];

package/dist/lib/runtimeWarnings.js

@@ -0,0 +1,106 @@
+/**
+ * Detect Renovate runtime warnings emitted to stderr that callers benefit from
+ * knowing about even though Renovate itself keeps running. Currently the only
+ * detected condition is the RE2 native-module dlopen failure: when the bundled
+ * `re2.node` was compiled against a different Node ABI than the one currently
+ * running, Renovate logs a single WARN and silently falls back to JavaScript
+ * `RegExp`. The fallback is functional but significantly slower for
+ * regex-heavy operations (custom managers, validation, lookups), and the
+ * degradation is otherwise invisible to MCP callers.
+ *
+ * Mirrors the parsing pattern in `lookupProblems.ts`: line-by-line scan,
+ * try-JSON-then-plain-text per line, dedupe, and cap the output. We also keep
+ * the parser narrow on purpose — Renovate emits many benign WARNs during
+ * normal runs (preset deprecations, etc.) and a generic capture would leak
+ * them into our responses.
+ */
+const MAX_DETAIL_LENGTH = 300;
+const MAX_WARNINGS = 10;
+const RE2_FIX_HINT = "The RE2 native module bundled with Renovate failed to load (likely after a Node version upgrade). Renovate is falling back to JavaScript `RegExp`, which is significantly slower for regex-heavy operations. To restore vectorized regex: reinstall renovate-mcp (which reinstalls the bundled `renovate` and rebuilds its native deps), or run `npm rebuild re2` inside the renovate-mcp install's `node_modules/renovate`. If `RENOVATE_BIN` points at a different Renovate install, run `npm rebuild re2` there instead.";
+const RE2_MESSAGE = "Renovate's RE2 native module is unusable; falling back to JavaScript `RegExp` (slower).";
+function truncate(s) {
+    if (s.length <= MAX_DETAIL_LENGTH)
+        return s;
+    return `${s.slice(0, MAX_DETAIL_LENGTH - 1)}…`;
+}
+function isRe2DlopenFailure(err) {
+    if (!err || typeof err !== "object")
+        return null;
+    const obj = err;
+    const code = typeof obj.code === "string" ? obj.code : undefined;
+    const message = typeof obj.message === "string" ? obj.message : undefined;
+    if (code !== "ERR_DLOPEN_FAILED")
+        return null;
+    if (!message || !/re2\.node/.test(message))
+        return null;
+    return { detail: truncate(message) };
+}
+export function detectRuntimeWarnings(stderr) {
+    if (!stderr)
+        return [];
+    const warnings = [];
+    const seen = new Set();
+    const pushRe2 = (detail) => {
+        if (seen.has("re2-unusable"))
+            return;
+        if (warnings.length >= MAX_WARNINGS)
+            return;
+        seen.add("re2-unusable");
+        const w = { kind: "re2-unusable", message: RE2_MESSAGE, fix: RE2_FIX_HINT };
+        if (detail)
+            w.detail = detail;
+        warnings.push(w);
+    };
+    for (const rawLine of stderr.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        if (warnings.length >= MAX_WARNINGS)
+            break;
+        if (line.startsWith("{")) {
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed && typeof parsed === "object") {
+                    const msg = typeof parsed.msg === "string" ? parsed.msg : "";
+                    if (msg.includes("RE2 not usable")) {
+                        const detail = parsed.err && typeof parsed.err === "object" && parsed.err !== null
+                            ? typeof parsed.err.message === "string"
+                                ? truncate(parsed.err.message)
+                                : undefined
+                            : undefined;
+                        pushRe2(detail);
+                        continue;
+                    }
+                    const re2Err = isRe2DlopenFailure(parsed.err);
+                    if (re2Err) {
+                        pushRe2(re2Err.detail);
+                        continue;
+                    }
+                }
+            }
+            catch {
+                // fall through to plain-text matching below
+            }
+        }
+        if (/\bRE2 not usable\b/.test(line)) {
+            pushRe2();
+            continue;
+        }
+        if (/\bERR_DLOPEN_FAILED\b/.test(line) && /re2\.node/.test(line)) {
+            pushRe2(truncate(line));
+            continue;
+        }
+    }
+    return warnings;
+}
+export function dedupeRuntimeWarnings(warnings) {
+    const seen = new Set();
+    const out = [];
+    for (const w of warnings) {
+        if (seen.has(w.kind))
+            continue;
+        seen.add(w.kind);
+        out.push(w);
+    }
+    return out;
+}

package/dist/lib/setupCheck.d.ts

@@ -1,10 +1,23 @@
+import { type RuntimeWarning } from "./runtimeWarnings.js";
 export type RenovateBinary = "renovate" | "renovate-config-validator";
 export interface BinaryStatus {
     tool: RenovateBinary;
     command: string;
+    /**
+     * Where the resolved binary came from. `bundled` means renovate-mcp's own
+     * `node_modules/renovate` was used (the default); `env` means the user set
+     * `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN`; `path` means the bundled
+     * lookup failed and we fell through to the bare tool name on `PATH`.
+     */
+    source: "env" | "bundled" | "path";
     found: boolean;
     version?: string;
     error?: string;
+    /**
+     * Runtime warnings parsed from this binary's `--version` stderr (e.g. RE2
+     * dlopen failure). Present only when at least one warning was detected.
+     */
+    runtimeWarnings?: RuntimeWarning[];
 }
 export type DryRunPlatform = "local" | "github" | "gitlab";
 export interface PlatformContext {
@@ -36,6 +49,13 @@ export interface SetupStatus {
     platformContext: PlatformContext;
     ok: boolean;
     hints: string[];
+    /**
+     * Deduped union of `runtimeWarnings` from every binary's `--version` probe.
+     * Distinct from `hints`: hints are "things you need to install / fix to use
+     * this server"; warnings are "Renovate is running but degraded." Empty array
+     * when nothing was detected.
+     */
+    warnings: RuntimeWarning[];
 }
 export declare function checkSetup(): Promise<SetupStatus>;
 /**
@@ -56,7 +76,9 @@ export declare function unavailableTools(status: SetupStatus): string[];
 /**
  * Concise startup banner appended to the server's MCP `instructions` so the
  * LLM is primed to treat CLI-missing as a partial-availability signal rather
- * than a setup error. Returns `null` when every tool is available.
+ * than a setup error. Also emits a banner — independent of binary availability
+ * — when Renovate runtime warnings are detected (e.g. RE2 dlopen failure
+ * causing a slow-path fallback). Returns `null` when nothing needs surfacing.
  */
 export declare function startupBanner(status: SetupStatus): string | null;
 export declare function describeSetup(status: SetupStatus): string;

package/dist/lib/setupCheck.js

@@ -1,30 +1,40 @@
 import { run, resolveRenovateTool } from "./renovateCli.js";
+import { dedupeRuntimeWarnings } from "./runtimeWarnings.js";
 const DRY_RUN_PLATFORMS = ["local", "github", "gitlab"];
 const VERSION_TIMEOUT_MS = 10_000;
-const INSTALL_HINT = "Install Renovate globally with `npm i -g renovate`, or set RENOVATE_BIN / RENOVATE_CONFIG_VALIDATOR_BIN to existing binaries.";
+const INSTALL_HINT = "Renovate ships bundled with renovate-mcp; if that fails to load, set RENOVATE_BIN / RENOVATE_CONFIG_VALIDATOR_BIN to a working binary or reinstall renovate-mcp.";
 async function checkBinary(tool) {
-    const command = resolveRenovateTool(tool);
+    const resolved = resolveRenovateTool(tool);
+    const command = resolved.command;
     try {
-        const result = await run(command, ["--version"], { timeoutMs: VERSION_TIMEOUT_MS });
+        const result = await run(resolved.cmd, [...resolved.prefixArgs, "--version"], {
+            timeoutMs: VERSION_TIMEOUT_MS,
+        });
+        const runtimeWarnings = result.runtimeWarnings.length ? result.runtimeWarnings : undefined;
         if (result.exitCode !== 0) {
             return {
                 tool,
                 command,
+                source: resolved.source,
                 found: false,
                 error: (result.stderr || result.stdout).trim() || `exit code ${result.exitCode}`,
+                runtimeWarnings,
             };
         }
         return {
             tool,
             command,
+            source: resolved.source,
             found: true,
             version: result.stdout.trim() || undefined,
+            runtimeWarnings,
         };
     }
     catch (err) {
         return {
             tool,
             command,
+            source: resolved.source,
             found: false,
             error: err.message,
         };
@@ -48,6 +58,10 @@ export async function checkSetup() {
     if (!renovateConfigValidator.found) {
         hints.push(`renovate-config-validator not reachable at \`${renovateConfigValidator.command}\`. ${INSTALL_HINT}`);
     }
+    const warnings = dedupeRuntimeWarnings([
+        ...(renovate.runtimeWarnings ?? []),
+        ...(renovateConfigValidator.runtimeWarnings ?? []),
+    ]);
     return {
         node: process.version,
         renovate,
@@ -56,6 +70,7 @@ export async function checkSetup() {
         platformContext: inspectPlatformContext(process.env),
         ok: renovate.found && renovateConfigValidator.found,
         hints,
+        warnings,
     };
 }
 /**
@@ -139,21 +154,34 @@ export function unavailableTools(status) {
 /**
  * Concise startup banner appended to the server's MCP `instructions` so the
  * LLM is primed to treat CLI-missing as a partial-availability signal rather
- * than a setup error. Returns `null` when every tool is available.
+ * than a setup error. Also emits a banner — independent of binary availability
+ * — when Renovate runtime warnings are detected (e.g. RE2 dlopen failure
+ * causing a slow-path fallback). Returns `null` when nothing needs surfacing.
  */
 export function startupBanner(status) {
     const unavailable = unavailableTools(status);
-    if (unavailable.length === 0)
-        return null;
-    const unavailList = unavailable.map((n) => `\`${n}\``).join(", ");
-    const offlineList = OFFLINE_TOOLS.map((n) => `\`${n}\``).join(", ");
-    return [
-        "Partial availability:",
-        `  Renovate CLI not found — only blocks: ${unavailList}.`,
-        `  Offline tools (${offlineList}) still work; do not flag this as a setup problem when the task only needs those.`,
-        "  Install Renovate (`npm i -g renovate`) before calling the blocked tools, or call `check_setup` for a full diagnostic.",
-        "  Set `RENOVATE_MCP_REQUIRE_CLI=false` to suppress this notice if you have consciously chosen the offline subset.",
-    ].join("\n");
+    const sections = [];
+    if (unavailable.length > 0) {
+        const unavailList = unavailable.map((n) => `\`${n}\``).join(", ");
+        const offlineList = OFFLINE_TOOLS.map((n) => `\`${n}\``).join(", ");
+        sections.push([
+            "Partial availability:",
+            `  Renovate CLI not reachable — only blocks: ${unavailList}.`,
+            `  Offline tools (${offlineList}) still work; do not flag this as a setup problem when the task only needs those.`,
+            "  Renovate ships bundled with renovate-mcp; if you see this banner, the bundled binary failed to spawn or `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` points at a broken binary. Call `check_setup` for a full diagnostic.",
+            "  Set `RENOVATE_MCP_REQUIRE_CLI=false` to suppress this notice if you have consciously chosen the offline subset.",
+        ].join("\n"));
+    }
+    if (status.warnings.length > 0) {
+        const lines = ["Renovate runtime warnings:"];
+        for (const w of status.warnings) {
+            lines.push(`  - ${w.message}`);
+            lines.push(`    Fix: ${w.fix}`);
+        }
+        lines.push("  These do not block tool calls. Surface this if a user reports unexpectedly slow runs.");
+        sections.push(lines.join("\n"));
+    }
+    return sections.length === 0 ? null : sections.join("\n\n");
 }
 export function describeSetup(status) {
     const lines = [];
@@ -187,10 +215,27 @@ export function describeSetup(status) {
         for (const h of status.hints)
             lines.push(`  - ${h}`);
     }
+    if (status.warnings.length > 0) {
+        lines.push("");
+        lines.push("Warnings:");
+        for (const w of status.warnings) {
+            lines.push(`  - ${w.message}`);
+            if (w.detail)
+                lines.push(`    Detail: ${w.detail}`);
+            lines.push(`    Fix: ${w.fix}`);
+        }
+    }
     return lines.join("\n");
 }
 function formatBinary(s) {
-    if (s.found)
-        return `${s.version ?? "(version unknown)"} (${s.command})`;
-    return `MISSING — ${s.error ?? "unknown error"}`;
+    if (s.found) {
+        const version = s.version ?? "(version unknown)";
+        if (s.source === "bundled")
+            return `${version} (bundled)`;
+        const prefix = s.source === "env" ? "env" : "PATH";
+        return `${version} (${prefix}: ${s.command})`;
+    }
+    if (s.source === "bundled")
+        return `MISSING — ${s.error ?? "unknown error"} (bundled)`;
+    return `MISSING — ${s.error ?? "unknown error"} (${s.command})`;
 }

package/dist/lib/version.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVER_VERSION = "0.9.4";
+export declare const SERVER_VERSION = "0.11.0";
 export type BuildMode = "local" | "released";
 export interface VersionInfo {
     version: string;

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "0.9.4"; // x-release-please-version
+export const SERVER_VERSION = "0.11.0"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/tools/dryRun.js

@@ -132,7 +132,7 @@ export function registerDryRun(server) {
             }
         }
         const reportPath = path.join(tmpdir(), `renovate-mcp-report-${randomUUID()}.json`);
-        const bin = resolveRenovateTool("renovate");
+        const tool = resolveRenovateTool("renovate");
         const ruleList = hostRules ?? [];
         // When the caller doesn't pass `platform`, fall back to RENOVATE_PLATFORM
         // from the MCP server's env before defaulting to `local`. Without this,
@@ -291,7 +291,7 @@ export function registerDryRun(server) {
                 emit(`Starting Renovate dry-run (${dryRunMode})`);
                 heartbeat = setInterval(() => emit(buildDryRunHeartbeatMessage(Date.now() - startedAt, lastLogMsg)), HEARTBEAT_MS);
             }
-            const result = await run(bin, args, {
+            const result = await run(tool.cmd, [...tool.prefixArgs, ...args], {
                 cwd: repoPath,
                 env: childEnv,
                 timeoutMs,
@@ -337,6 +337,9 @@ export function registerDryRun(server) {
             if (reportErrors.length > 0) {
                 summary.reportErrors = reportErrors;
             }
+            if (result.runtimeWarnings.length > 0) {
+                summary.warnings = result.runtimeWarnings;
+            }
             // If no structured report, surface the last bit of stderr so Claude can
             // debug without blowing up the context with Renovate's verbose logs.
             if (!report) {

package/dist/tools/validateConfig.js

@@ -37,19 +37,23 @@ export function registerValidateConfig(server) {
             };
         }
         try {
-            const bin = resolveRenovateTool("renovate-config-validator");
+            const tool = resolveRenovateTool("renovate-config-validator");
             const args = [];
             if (strict)
                 args.push("--strict");
             args.push(target);
-            const result = await run(bin, args, { timeoutMs: 30_000 });
+            const result = await run(tool.cmd, [...tool.prefixArgs, ...args], { timeoutMs: 30_000 });
             const valid = result.exitCode === 0;
             const output = (result.stdout + result.stderr).trim();
+            const payload = { valid, output };
+            if (result.runtimeWarnings.length > 0) {
+                payload.warnings = result.runtimeWarnings;
+            }
             return {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ valid, output }, null, 2),
+                        text: JSON.stringify(payload, null, 2),
                     },
                 ],
                 isError: !valid,

package/dist/tools/writeConfig.js

@@ -84,46 +84,54 @@ export function registerWriteConfig(server) {
             let valid = false;
             let validationOutput = "";
             let validatorMissing = false;
+            let runtimeWarnings = [];
             try {
-                const bin = resolveRenovateTool("renovate-config-validator");
-                const v = await run(bin, [tmp], { timeoutMs: 30_000 });
+                const tool = resolveRenovateTool("renovate-config-validator");
+                const v = await run(tool.cmd, [...tool.prefixArgs, tmp], { timeoutMs: 30_000 });
                 validationOutput = (v.stdout + v.stderr).trim();
                 valid = v.exitCode === 0;
+                runtimeWarnings = v.runtimeWarnings;
             }
             catch (err) {
                 validatorMissing = true;
                 validationOutput = formatMissingBinaryError("renovate-config-validator", err);
             }
             if (!valid && !force) {
+                const failPayload = {
+                    wrote: false,
+                    reason: validatorMissing ? "validator-unavailable" : "validation-failed",
+                    validationOutput,
+                    hint: validatorMissing
+                        ? "The bundled renovate-config-validator failed to spawn. Set RENOVATE_CONFIG_VALIDATOR_BIN to a working binary or reinstall renovate-mcp, then retry. Pass force=true to skip validation entirely."
+                        : "Pass force=true to write anyway.",
+                };
+                if (runtimeWarnings.length > 0)
+                    failPayload.warnings = runtimeWarnings;
                 return {
                     isError: true,
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({
-                                wrote: false,
-                                reason: validatorMissing ? "validator-unavailable" : "validation-failed",
-                                validationOutput,
-                                hint: validatorMissing
-                                    ? "Install renovate-config-validator (or set RENOVATE_CONFIG_VALIDATOR_BIN), then retry. Pass force=true to skip validation entirely."
-                                    : "Pass force=true to write anyway.",
-                            }, null, 2),
+                            text: JSON.stringify(failPayload, null, 2),
                         },
                     ],
                 };
             }
             await fs.rename(tmp, target);
+            const okPayload = {
+                wrote: true,
+                path: rel,
+                bytes: payload.length,
+                valid,
+                validationOutput: valid ? undefined : validationOutput,
+            };
+            if (runtimeWarnings.length > 0)
+                okPayload.warnings = runtimeWarnings;
             return {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
-                            wrote: true,
-                            path: rel,
-                            bytes: payload.length,
-                            valid,
-                            validationOutput: valid ? undefined : validationOutput,
-                        }, null, 2),
+                        text: JSON.stringify(okPayload, null, 2),
                     },
                 ],
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "0.9.4",
+  "version": "0.11.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -59,12 +59,17 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "ignore": "^7.0.5",
     "json5": "^2.2.3",
+    "renovate": "^43.139.5",
     "zod": "^4.0.0"
   },
+  "overrides": {
+    "fast-uri": "^3.1.2",
+    "fast-xml-builder": "^1.1.7",
+    "simple-git": "^3.36.0"
+  },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@vitest/coverage-v8": "^4.1.0",
-    "renovate": "^43.139.5",
     "typescript": "^6.0.0",
     "vitest": "^4.1.0"
   },