renovate-mcp 1.8.1 → 2.0.0

package/README.md

@@ -45,7 +45,7 @@ Nineteen tools, seven resources, and four workflow prompts. Each tool name below
 | [`preview_custom_manager`](docs/tools.md#preview_custom_manager) | Preview a `customManagers` entry (regex or JSONata) against a local repo. Offline. |
 | [`validate_config`](docs/tools.md#validate_config) | Run `renovate-config-validator` against a file or inline object. |
 | [`lint_config`](docs/tools.md#lint_config) | Semantic lint pass for Renovate-specific footguns the schema validator declares valid. Offline. |
-| [`dry_run`](docs/tools.md#dry_run) | Run Renovate with `--dry-run` and return the structured JSON report. Local-by-default; remote with `platform` + `endpoint` + `token` + `repository`. No PRs, no pushes. |
+| [`dry_run`](docs/tools.md#dry_run) | Run Renovate with `--dry-run` and return the structured JSON report. Local-by-default, flattening `local>` presets with Renovate's own resolver into a temporary copy first; remote with `platform` + `endpoint` + `token` + `repository`. No PRs, no pushes. |
 | [`dry_run_diff`](docs/tools.md#dry_run_diff) | Stateless semantic diff between two `dry_run` reports — added / removed / changed updates. |
 | [`annotate_dry_run`](docs/tools.md#annotate_dry_run) | Attribute each proposed update in a `dry_run` report to the `packageRules` that caused it; flags rules that never matched and report fields the matchers needed but the report lacked. Stateless + offline. |
 | [`explain_dependency`](docs/tools.md#explain_dependency) | Answer "why was/wasn't dependency X updated?" from a `dry_run` report: per-occurrence `skipReason`, proposed `updates`, `warnings`, a one-line verdict and remedy hints; optionally the `packageRules` that matched it. Stateless + offline. |
@@ -81,7 +81,8 @@ Renovate ships bundled — the `renovate` package is a runtime dependency, so `v
 
 - `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override the bundled binaries. When set, the override always wins.
 - `RENOVATE_MCP_REQUIRE_CLI=false` — suppress the startup "partial availability" notice when you only intend to use the offline tools.
-- Platform + token env vars — see [`docs/platform-setup.md`](docs/platform-setup.md) for the per-platform matrix.
+- Platform + token env vars — see [`docs/platform-setup.md`](docs/platform-setup.md) for the per-platform matrix. Preset fetching and `dry_run` bind every token to its own host; `RENOVATE_TOKEN` only covers the home host named by `RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT`. A `platform` / `endpoint` passed on a call routes requests but never moves a token.
+- `RENOVATE_MCP_HOST_TOKENS` — JSON array of `{matchHost, hostType, tokenEnv}` naming the env var that holds the token for an extra host (never the value itself). See [`docs/security.md`](docs/security.md#token-resolution).
 - `GITHUB_COM_TOKEN` — authenticates github.com *datasource* lookups (release notes, `github-tags` / `github-releases` / `github-actions`). Distinct from the platform token and never auto-derived from it; set it when github.com-hosted deps are resolved under the default `dry_run` `platform: local`. See [`docs/security.md`](docs/security.md#github_com_token--a-separate-role).
 
 > Heads up: MCP servers do **not** inherit your shell env. Set every env var via the `env` key in `.mcp.json` / `claude_desktop_config.json`. See [`docs/security.md`](docs/security.md#where-env-vars-must-live).
@@ -139,8 +140,9 @@ The offline tools need nothing. Add env vars only for what you use:
 | Local `dry_run` on a repo with github.com dependencies | `GITHUB_COM_TOKEN` (read-only PAT, avoids anonymous rate limits) |
 | `dry_run` against GitHub, or private `github>` presets | `RENOVATE_PLATFORM=github` + `GITHUB_TOKEN` |
 | `dry_run` against GitLab, or private `gitlab>` presets | `RENOVATE_PLATFORM=gitlab` + `GITLAB_TOKEN` |
+| Private presets on another host | `RENOVATE_MCP_HOST_TOKENS` + the variable it names |
 
-Self-hosted GitLab and GitHub Enterprise also need `RENOVATE_ENDPOINT` — see [Platform setup](#platform-setup).
+Self-hosted GitLab and GitHub Enterprise also need `RENOVATE_ENDPOINT` — see [Platform setup](#platform-setup). Each token is only sent to its own platform's host.
 
 In Claude Code, re-register with `-e`:
 
@@ -169,11 +171,11 @@ For `dry_run` against a remote platform or `resolve_config` with `externalPreset
 | GitHub Enterprise | `github` | `https://github.example.com/api/v3/` | `RENOVATE_TOKEN` *or* `GITHUB_TOKEN` |
 | gitlab.com | `gitlab` | (omit) | `RENOVATE_TOKEN` *or* `GITLAB_TOKEN` |
 | Self-hosted GitLab | `gitlab` | `https://gitlab.example.com/api/v4/` | `RENOVATE_TOKEN` *or* `GITLAB_TOKEN` |
-| gitea.com / Forgejo (code.forgejo.org) | — | (omit) | `RENOVATE_TOKEN` *or* `GITEA_TOKEN` / `FORGEJO_TOKEN` |
-| Self-hosted Gitea / Forgejo | — | `https://forgejo.example.com/api/v1/` | `RENOVATE_TOKEN` *or* `GITEA_TOKEN` / `FORGEJO_TOKEN` |
-| Bitbucket Cloud | — | (omit) | `RENOVATE_TOKEN` *or* `BITBUCKET_TOKEN` |
+| gitea.com / Forgejo (code.forgejo.org) | — | (omit) | `GITEA_TOKEN` / `FORGEJO_TOKEN` |
+| Self-hosted Gitea / Forgejo | `gitea` / `forgejo` | `https://forgejo.example.com/api/v1` | `RENOVATE_TOKEN` *or* `GITEA_TOKEN` / `FORGEJO_TOKEN` |
+| Bitbucket Cloud | — | (omit) | `BITBUCKET_TOKEN` |
 
-The Gitea / Forgejo / Bitbucket Cloud rows apply to the `resolve_config` family only: `dry_run` runs Renovate as `local` / `github` / `gitlab` and never reads those tokens. Pass `platform` (`gitea` / `forgejo` / `bitbucket`) and `endpoint` as tool inputs instead of `RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT`.
+The Gitea / Forgejo / Bitbucket Cloud rows apply to the `resolve_config` family only: `dry_run` runs Renovate as `local` / `github` / `gitlab` and only passes those tokens on as host rules for their hosts. `platform` (`gitea` / `forgejo` / `bitbucket`) and `endpoint` can also be passed as tool inputs, but they only route `local>` presets: a token goes only to its platform's public host or to the env home (`RENOVATE_PLATFORM` at `RENOVATE_ENDPOINT`, where `RENOVATE_TOKEN` comes first), so an endpoint passed only per call needs a `RENOVATE_MCP_HOST_TOKENS` entry. `endpoint` routes `local>` presets only, as in Renovate.
 
 See [`docs/platform-setup.md`](docs/platform-setup.md) for a worked self-hosted GitLab example, `local>` preset handling, and private-registry credentials.
 
@@ -196,8 +198,8 @@ Once the server is wired up, try prompts like these. Written for Claude but work
 
 **Self-hosted GitLab / GitHub Enterprise** (env set per [Platform setup](#platform-setup))
 
-- "Resolve my config with external presets enabled, fetching `gitlab>platform/renovate-presets` from our self-hosted GitLab at `https://gitlab.example.com/api/v4`. Route `local>` presets through the same host."
-- "Expand `github>acme/renovate-config//base` from our GitHub Enterprise at `https://github.acme.corp/api/v3`."
+- "Resolve my config with external presets enabled. Its `local>platform/renovate-presets` presets live on our self-hosted GitLab at `https://gitlab.example.com/api/v4`."
+- "Resolve my config with external presets enabled. Its `local>acme/renovate-config//base` preset lives on our GitHub Enterprise at `https://github.acme.corp/api/v3`."
 - "Dry-run `infrastructure/kubernetes/our-platform` (a nested-group GitLab project) so Renovate can fetch the `local>` presets the config extends."
 
 **Authoring a custom manager (regex or JSONata)**

package/dist/data/presets.generated.js

@@ -22049,4 +22049,120 @@ export const PRESETS = {
         }
     }
 };
+/**
+ * Renovate's `removedPresets` map: renamed built-in presets map to their new
+ * name, removed ones map to null (Renovate resolves them to an empty config).
+ */
+export const REMOVED_PRESETS = {
+    ":app": "config:js-app",
+    ":autodetectPinVersions": null,
+    ":autodetectRangeStrategy": null,
+    ":automergeBranchMergeCommit": ":automergeBranch",
+    ":automergeBranchPush": ":automergeBranch",
+    ":base": "config:recommended",
+    ":disableLockFiles": ":skipArtifactsUpdate",
+    ":enableGradleLite": null,
+    ":js-app": "config:js-app",
+    ":library": "config:js-lib",
+    ":masterIssue": ":dependencyDashboard",
+    ":masterIssueApproval": ":dependencyDashboardApproval",
+    ":switchToGradleLite": null,
+    ":unpublishSafe": "npm:unpublishSafe",
+    "compatibility:additionalBranchPrefix": null,
+    "config:application": "config:js-app",
+    "config:base": "config:recommended",
+    "config:base-js": "config:recommended",
+    "config:library": "config:js-lib",
+    "default:app": "config:js-app",
+    "default:automergeBranchMergeCommit": ":automergeBranch",
+    "default:automergeBranchPush": ":automergeBranch",
+    "default:base": "config:recommended",
+    "default:js-app": "config:js-app",
+    "default:library": "config:js-lib",
+    "default:onlyNpm": null,
+    "default:unpublishSafe": "npm:unpublishSafe",
+    "github>whitesource/merge-confidence:beta": "mergeConfidence:all-badges",
+    "group:FontsourceMonorepo": "group:fontsourceMonorepo",
+    "group:HangfireMonorepo": "group:hangfireMonorepo",
+    "group:HotChocolateMonorepo": "group:hotchocolateMonorepo",
+    "group:MassTransitMonorepo": "group:masstransitMonorepo",
+    "group:OpenTelemetryDotnetMonorepo": "group:opentelemetry-dotnetMonorepo",
+    "group:SteeltoeMonorepo": "group:steeltoeMonorepo",
+    "group:SwashbuckleMonorepo": "group:swashbuckle-aspnetcoreMonorepo",
+    "group:System.IO.AbstractionsMonorepo": "group:system.io.abstractionsMonorepo",
+    "group:angular1Monorepo": "group:angularjsMonorepo",
+    "group:angularcliMonorepo": "group:angular-cliMonorepo",
+    "group:arcus background-jobsMonorepo": "group:arcus.background-jobsMonorepo",
+    "group:arcus event-gridMonorepo": "group:arcus.event-gridMonorepo",
+    "group:arcus messagingMonorepo": "group:arcus.messagingMonorepo",
+    "group:arcus observabilityMonorepo": "group:arcus.observabilityMonorepo",
+    "group:arcus securityMonorepo": "group:arcus.securityMonorepo",
+    "group:arcus webapiMonorepo": "group:arcus.webapiMonorepo",
+    "group:aspnet AspNetWebStackMonorepo": "group:aspnet aspnetwebstackMonorepo",
+    "group:aspnet ExtensionsMonorepo": "group:aspnet extensionsMonorepo",
+    "group:hamcrestMonorepo": "group:javahamcrestMonorepo",
+    "group:infrastructureMonorepo": "group:infrastructure-uiMonorepo",
+    "group:jsTestMonMajor": "group:jsTestNonMajor",
+    "group:junit5Monorepo": "group:junit-frameworkMonorepo",
+    "group:k8s-ioMonorepo": "group:kubernetesMonorepo",
+    "group:kubernetes": "group:kubernetesMonorepo",
+    "group:linguiMonorepo": "group:linguijsMonorepo",
+    "group:materialMonorepo": "group:material-components-webMonorepo",
+    "group:muiMonorepo": "group:material-uiMonorepo",
+    "group:nrwlMonorepo": "group:nxMonorepo",
+    "group:openfeignMonorepo": "group:feignMonorepo",
+    "group:opentelemetryMonorepo": "group:opentelemetry-jsMonorepo",
+    "group:picassoMonorepo": "group:picassojsMonorepo",
+    "group:reactrouterMonorepo": "group:react-routerMonorepo",
+    "group:sentryMonorepo": "group:sentry-javascriptMonorepo",
+    "group:strykerMonorepo": "group:stryker-jsMonorepo",
+    "helpers:oddIsUnstable": null,
+    "helpers:oddIsUnstablePackages": null,
+    "monorepo:Fontsource": "monorepo:fontsource",
+    "monorepo:Hangfire": "monorepo:hangfire",
+    "monorepo:HotChocolate": "monorepo:hotchocolate",
+    "monorepo:MassTransit": "monorepo:masstransit",
+    "monorepo:OpenTelemetryDotnet": "monorepo:opentelemetry-dotnet",
+    "monorepo:Steeltoe": "monorepo:steeltoe",
+    "monorepo:Swashbuckle": "monorepo:swashbuckle-aspnetcore",
+    "monorepo:System.IO.Abstractions": "monorepo:system.io.abstractions",
+    "monorepo:angular1": "monorepo:angularjs",
+    "monorepo:angularcli": "monorepo:angular-cli",
+    "monorepo:arcus background-jobs": "monorepo:arcus.background-jobs",
+    "monorepo:arcus event-grid": "monorepo:arcus.event-grid",
+    "monorepo:arcus messaging": "monorepo:arcus.messaging",
+    "monorepo:arcus observability": "monorepo:arcus.observability",
+    "monorepo:arcus security": "monorepo:arcus.security",
+    "monorepo:arcus webapi": "monorepo:arcus.webapi",
+    "monorepo:aspnet AspNetWebStack": "monorepo:aspnet aspnetwebstack",
+    "monorepo:aspnet Extensions": "monorepo:aspnet extensions",
+    "monorepo:hamcrest": "monorepo:javahamcrest",
+    "monorepo:infrastructure": "monorepo:infrastructure-ui",
+    "monorepo:junit5": "monorepo:junit-framework",
+    "monorepo:k8s-io": "monorepo:kubernetes",
+    "monorepo:lingui": "monorepo:linguijs",
+    "monorepo:material": "monorepo:material-components-web",
+    "monorepo:mui": "monorepo:material-ui",
+    "monorepo:nrwl": "monorepo:nx",
+    "monorepo:openfeign": "monorepo:feign",
+    "monorepo:opentelemetry": "monorepo:opentelemetry-js",
+    "monorepo:picasso": "monorepo:picassojs",
+    "monorepo:reactrouter": "monorepo:react-router",
+    "monorepo:sentry": "monorepo:sentry-javascript",
+    "monorepo:stryker": "monorepo:stryker-js",
+    "npm:unpublishSafe": "security:minimumReleaseAgeNpm",
+    "regexManagers:azurePipelinesVersions": "customManagers:azurePipelinesVersions",
+    "regexManagers:biomeVersions": "customManagers:biomeVersions",
+    "regexManagers:bitbucketPipelinesVersions": "customManagers:bitbucketPipelinesVersions",
+    "regexManagers:dockerfileVersions": "customManagers:dockerfileVersions",
+    "regexManagers:githubActionsVersions": "customManagers:githubActionsVersions",
+    "regexManagers:gitlabPipelineVersions": "customManagers:gitlabPipelineVersions",
+    "regexManagers:helmChartYamlAppVersions": "customManagers:helmChartYamlAppVersions",
+    "regexManagers:mavenPropertyVersions": "customManagers:mavenPropertyVersions",
+    "regexManagers:tfvarsVersions": "customManagers:tfvarsVersions",
+    "regexManagers:tsconfigNodeVersions": "customManagers:tsconfigNodeVersions",
+    "replacements:messageFormat-{{package}}-to-@messageformat/{{package}}": "replacements:messageFormat-to-scoped",
+    "replacements:ojdbc10-to-ojdbc11": "replacements:ojdbc-to-ojdbc11",
+    "workarounds:reduceRepologyServerLoad": null
+};
 export const PRESET_NAMES = Object.freeze(Object.keys(PRESETS));

package/dist/lib/credentialResolver.js

@@ -1,15 +1 @@
-/**
- * Resolve a credential by checking each env var name in order and returning
- * the first one that's set. Used by both `resolve_config` (for `github>` /
- * `gitlab>` preset fetches) and `dry_run` (when picking which token to export
- * as `RENOVATE_TOKEN` to the spawned Renovate CLI). Keeping the precedence in
- * one place ensures the two tools cannot drift out of sync.
- */
-export function resolveCredential(vars) {
-    for (const envVar of vars) {
-        const value = process.env[envVar];
-        if (value)
-            return { envVar, token: value, triedVars: vars };
-    }
-    return { envVar: null, token: undefined, triedVars: vars };
-}
+export {};

package/dist/lib/externalPresetFetcher.js

@@ -1,6 +1,6 @@
 import JSON5 from "json5";
-import { resolveCredential } from "./credentialResolver.js";
 import { validateEndpoint } from "./endpointValidator.js";
+import { selectToken } from "./hostTokens.js";
 import { classifyExternalSource, } from "./presetResolver.js";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const DEFAULT_API_BASE = {
@@ -45,30 +45,46 @@ function dispatch(parsed, options) {
             return Promise.resolve({ ok: false, reason: blocked });
         endpoint = trimTrailingSlash(options.endpoint);
     }
-    switch (parsed.source) {
+    // `classifyExternalSource` refused local / npm above, so only the hosted
+    // platforms remain and the switch is exhaustive.
+    const source = parsed.source;
+    switch (source) {
         case "github":
             return fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint);
         case "gitlab":
             return fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint);
         case "gitea":
         case "forgejo":
-            return fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, parsed.source);
+            return fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, source);
         case "bitbucket":
             return fetchBitbucket(parsed, timeoutMs, fetchImpl, endpoint);
-        default:
-            // Unreachable: `classifyExternalSource` already refused local / npm.
-            return Promise.resolve({ ok: false, reason: `Unknown preset source: ${parsed.source}` });
     }
 }
+/** GitHub, Gitea and Bitbucket address repositories as exactly two path segments (nested groups are a GitLab thing). */
+const OWNER_REPO_RE = /^[^/]+\/[^/]+$/;
+/** GitLab projects live under a namespace that may itself be nested (`group/sub/project`). */
+const GITLAB_PROJECT_RE = /^[^/]+(\/[^/]+)+$/;
+/**
+ * Rejects empty, `.` and `..` segments. URL parsing collapses dot segments
+ * (also when spelled `%2e`), and `encodeURIComponent` leaves `.` alone, so
+ * without this a preset string could steer a token-bearing request to any
+ * path on the API host.
+ */
+function isSafePath(path) {
+    return path.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+}
 async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
-    if (!parsed.repoPath || !parsed.repoPath.includes("/")) {
+    const file = presetFileName(parsed);
+    if (!parsed.repoPath ||
+        !OWNER_REPO_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file)) {
         return { ok: false, reason: `Invalid github preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const ref = parsed.ref ?? "HEAD";
     const apiBase = endpoint ?? DEFAULT_API_BASE.github;
-    const url = `${apiBase}/repos/${parsed.repoPath}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
-    const credential = resolveCredential(["RENOVATE_TOKEN", "GITHUB_TOKEN"]);
+    const url = `${apiBase}/repos/${encodeFilePath(parsed.repoPath)}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
+    const credential = selectToken(url, "github");
     const headers = {
         Accept: "application/vnd.github.raw",
         "User-Agent": "renovate-mcp",
@@ -79,36 +95,37 @@ async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
     return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "github", sendAuth ? credential : suppressCredential(credential));
 }
 async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
-    if (!parsed.repoPath) {
+    const file = presetFileName(parsed);
+    if (!parsed.repoPath ||
+        !GITLAB_PROJECT_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file)) {
         return { ok: false, reason: `Invalid gitlab preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const ref = parsed.ref ?? "HEAD";
     const apiBase = endpoint ?? DEFAULT_API_BASE.gitlab;
     const url = `${apiBase}/projects/${encodeURIComponent(parsed.repoPath)}/repository/files/${encodeURIComponent(file)}/raw?ref=${encodeURIComponent(ref)}`;
-    const credential = resolveCredential(["RENOVATE_TOKEN", "GITLAB_TOKEN"]);
+    const credential = selectToken(url, "gitlab");
     const headers = { "User-Agent": "renovate-mcp" };
     const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
     if (sendAuth)
         headers["PRIVATE-TOKEN"] = credential.token;
     return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "gitlab", sendAuth ? credential : suppressCredential(credential));
 }
-/** Gitea and Bitbucket address repositories as exactly two path segments (nested groups are a GitLab thing). */
-const OWNER_REPO_RE = /^[^/]+\/[^/]+$/;
 /** Gitea's raw-contents API, which Forgejo serves unchanged; the two differ only in default host and token var. */
 async function fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, platform) {
-    if (!parsed.repoPath || !OWNER_REPO_RE.test(parsed.repoPath)) {
+    const file = presetFileName(parsed);
+    if (!parsed.repoPath ||
+        !OWNER_REPO_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file)) {
         return { ok: false, reason: `Invalid ${platform} preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const apiBase = endpoint ?? DEFAULT_API_BASE[platform];
     // No `ref` means the repository's default branch, as in Renovate.
     const refQuery = parsed.ref ? `?ref=${encodeURIComponent(parsed.ref)}` : "";
     const url = `${apiBase}/repos/${encodeFilePath(parsed.repoPath)}/raw/${encodeFilePath(file)}${refQuery}`;
-    const credential = resolveCredential([
-        "RENOVATE_TOKEN",
-        platform === "gitea" ? "GITEA_TOKEN" : "FORGEJO_TOKEN",
-    ]);
+    const credential = selectToken(url, platform);
     const headers = { "User-Agent": "renovate-mcp" };
     const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
     if (sendAuth)
@@ -124,14 +141,23 @@ async function fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, platform) {
  * if anyone needs it.
  */
 async function fetchBitbucket(parsed, timeoutMs, fetchImpl, endpoint) {
-    if (!parsed.repoPath || !OWNER_REPO_RE.test(parsed.repoPath)) {
+    const file = presetFileName(parsed);
+    // The ref is a single encoded path segment here (a query parameter elsewhere), so only an
+    // empty or dot ref can shape the path.
+    const rawRef = parsed.ref ?? "HEAD";
+    if (!parsed.repoPath ||
+        !OWNER_REPO_RE.test(parsed.repoPath) ||
+        !isSafePath(parsed.repoPath) ||
+        !isSafePath(file) ||
+        rawRef === "" ||
+        rawRef === "." ||
+        rawRef === "..") {
         return { ok: false, reason: `Invalid bitbucket preset: ${parsed.original}` };
     }
-    const file = presetFileName(parsed);
     const apiBase = endpoint ?? DEFAULT_API_BASE.bitbucket;
-    const ref = encodeURIComponent(parsed.ref ?? "HEAD");
+    const ref = encodeURIComponent(rawRef);
     const url = `${apiBase}/2.0/repositories/${encodeFilePath(parsed.repoPath)}/src/${ref}/${encodeFilePath(file)}`;
-    const credential = resolveCredential(["RENOVATE_TOKEN", "BITBUCKET_TOKEN"]);
+    const credential = selectToken(url, "bitbucket");
     const headers = { "User-Agent": "renovate-mcp" };
     const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
     if (sendAuth)
@@ -309,7 +335,7 @@ async function discardBody(res) {
 function formatAuthFailure(status, presetName, url, credential, body) {
     const lines = [`HTTP ${status} when fetching ${presetName}`];
     lines.push(`  URL:         ${url}`);
-    lines.push(`  Credential:  ${formatCredential(credential)}`);
+    lines.push(`  Credential:  ${formatCredential(credential, url)}`);
     const trimmed = body.trim();
     if (trimmed) {
         const snippet = trimmed.length > AUTH_BODY_MAX
@@ -319,9 +345,11 @@ function formatAuthFailure(status, presetName, url, credential, body) {
     }
     return lines.join("\n");
 }
-function formatCredential(credential) {
+function formatCredential(credential, url) {
     if (credential.envVar)
         return `${credential.envVar} (present)`;
+    if (credential.triedVars.length === 0)
+        return `none (no token is bound to ${new URL(url).hostname})`;
     return `none (tried ${credential.triedVars.join(", ")})`;
 }
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);

package/dist/lib/gitRemote.js

@@ -40,15 +40,38 @@ export function parseRemoteUrl(url) {
     return { host, scheme: "ssh", owner, repo };
 }
 /**
- * Read the `[remote "origin"] url = …` field from a repo's `.git/config`
- * without spawning `git`. Returns `null` for non-git directories, missing
- * config, missing origin remote, or unreadable files (no exceptions thrown).
+ * Read the `[remote "origin"] url = …` field from a repo's git config without
+ * spawning `git`. A `.git` file (worktree, submodule) is followed through its
+ * `gitdir:` line, and a worktree's `commondir` to the shared config. The
+ * gitdir must look like one git writes (`…/.git`, `…/.git/worktrees/<name>`
+ * or `…/.git/modules/…`), and a worktree's common dir must be a `…/.git`;
+ * any other target is no origin, so a crafted `.git` file cannot point the
+ * origin at an arbitrary config. Returns `null` for
+ * non-git directories, missing config, missing origin remote, or unreadable
+ * files (no exceptions thrown).
  */
+/** A `.git` dir, a worktree's `.git/worktrees/<name>`, or a submodule's `.git/modules/<path>`. */
+const GITDIR_SHAPE = /\/\.git(?:\/worktrees\/[^/]+|\/modules\/.+)?$/;
 export async function readOriginRemote(repoPath) {
-    const configPath = path.join(repoPath, ".git", "config");
+    const dotGit = path.join(repoPath, ".git");
+    // Reading a `.git` directory fails (EISDIR): then it is the git dir itself.
+    const pointer = await fs.readFile(dotGit, "utf8").catch(() => "");
+    const gitdirLine = /^gitdir:\s*(.+)$/m.exec(pointer);
+    let gitDir = dotGit;
+    if (gitdirLine) {
+        gitDir = path.resolve(repoPath, gitdirLine[1].trim());
+        if (!GITDIR_SHAPE.test(gitDir.split(path.sep).join("/")))
+            return null;
+        const commonDir = await fs.readFile(path.join(gitDir, "commondir"), "utf8").catch(() => null);
+        if (commonDir) {
+            gitDir = path.resolve(gitDir, commonDir.trim());
+            if (!/\/\.git$/.test(gitDir.split(path.sep).join("/")))
+                return null;
+        }
+    }
     let raw;
     try {
-        raw = await fs.readFile(configPath, "utf8");
+        raw = await fs.readFile(path.join(gitDir, "config"), "utf8");
     }
     catch {
         return null;

package/dist/lib/hostRulesConfig.js

@@ -1,25 +1,30 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
 /**
- * Write a throwaway Renovate config containing just `{ hostRules: [...] }` to
- * `os.tmpdir()` with mode 0600, and return the absolute path. The caller is
- * responsible for unlinking the file (in a `finally` block) once Renovate has
- * consumed it — we do not keep a reference here.
+ * Write a throwaway Renovate config containing just `{ hostRules: [...] }` and
+ * return its absolute path. The file sits alone in a fresh `mkdtemp`
+ * directory (mode 0700) under `os.tmpdir()` and is created with `wx` and mode
+ * 0600: it holds env tokens on most runs, so no other local user may read it
+ * or plant a file at the path first. The caller removes it with
+ * `removeHostRulesConfig` (in a `finally` block) once Renovate has consumed it.
  *
- * The caller points Renovate at this file via the `RENOVATE_CONFIG_FILE` env
- * var (not a CLI flag — `--config-file` is not a real Renovate option).
- * Renovate merges its rules with any repo-level `hostRules` via array
- * concatenation (most-specific match wins), so callers can combine
- * per-invocation credentials with whatever the repo itself already declares.
+ * The caller points Renovate at this file via the `RENOVATE_CONFIG_FILE` (or
+ * `RENOVATE_ADDITIONAL_CONFIG_FILE`) env var, not a CLI flag — `--config-file`
+ * is not a real Renovate option. Renovate concatenates its rules with any
+ * other `hostRules`, so callers can combine per-invocation credentials with
+ * whatever the repo itself already declares.
  */
 export async function writeHostRulesConfig(hostRules) {
-    const tmpPath = path.join(tmpdir(), `renovate-mcp-hostrules-${randomUUID()}.json`);
-    const body = JSON.stringify({ hostRules }, null, 2);
-    await fs.writeFile(tmpPath, body, { mode: 0o600 });
+    const dir = await fs.mkdtemp(path.join(tmpdir(), "renovate-mcp-hostrules-"));
+    const tmpPath = path.join(dir, "config.json");
+    await fs.writeFile(tmpPath, JSON.stringify({ hostRules }, null, 2), { flag: "wx", mode: 0o600 });
     return tmpPath;
 }
+/** Remove a file written by `writeHostRulesConfig` together with its directory. */
+export async function removeHostRulesConfig(filePath) {
+    await fs.rm(path.dirname(filePath), { recursive: true, force: true });
+}
 const SECRET_KEYS = ["token", "password"];
 /**
  * Pull the token/password values out of the provided hostRules so callers can