renovate-mcp 1.8.2 → 2.0.0

package/README.md

@@ -45,7 +45,7 @@ Nineteen tools, seven resources, and four workflow prompts. Each tool name below
 | [`preview_custom_manager`](docs/tools.md#preview_custom_manager) | Preview a `customManagers` entry (regex or JSONata) against a local repo. Offline. |
 | [`validate_config`](docs/tools.md#validate_config) | Run `renovate-config-validator` against a file or inline object. |
 | [`lint_config`](docs/tools.md#lint_config) | Semantic lint pass for Renovate-specific footguns the schema validator declares valid. Offline. |
-| [`dry_run`](docs/tools.md#dry_run) | Run Renovate with `--dry-run` and return the structured JSON report. Local-by-default; remote with `platform` + `endpoint` + `token` + `repository`. No PRs, no pushes. |
+| [`dry_run`](docs/tools.md#dry_run) | Run Renovate with `--dry-run` and return the structured JSON report. Local-by-default, flattening `local>` presets with Renovate's own resolver into a temporary copy first; remote with `platform` + `endpoint` + `token` + `repository`. No PRs, no pushes. |
 | [`dry_run_diff`](docs/tools.md#dry_run_diff) | Stateless semantic diff between two `dry_run` reports — added / removed / changed updates. |
 | [`annotate_dry_run`](docs/tools.md#annotate_dry_run) | Attribute each proposed update in a `dry_run` report to the `packageRules` that caused it; flags rules that never matched and report fields the matchers needed but the report lacked. Stateless + offline. |
 | [`explain_dependency`](docs/tools.md#explain_dependency) | Answer "why was/wasn't dependency X updated?" from a `dry_run` report: per-occurrence `skipReason`, proposed `updates`, `warnings`, a one-line verdict and remedy hints; optionally the `packageRules` that matched it. Stateless + offline. |
@@ -81,7 +81,8 @@ Renovate ships bundled — the `renovate` package is a runtime dependency, so `v
 
 - `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override the bundled binaries. When set, the override always wins.
 - `RENOVATE_MCP_REQUIRE_CLI=false` — suppress the startup "partial availability" notice when you only intend to use the offline tools.
-- Platform + token env vars — see [`docs/platform-setup.md`](docs/platform-setup.md) for the per-platform matrix.
+- Platform + token env vars — see [`docs/platform-setup.md`](docs/platform-setup.md) for the per-platform matrix. Preset fetching and `dry_run` bind every token to its own host; `RENOVATE_TOKEN` only covers the home host named by `RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT`. A `platform` / `endpoint` passed on a call routes requests but never moves a token.
+- `RENOVATE_MCP_HOST_TOKENS` — JSON array of `{matchHost, hostType, tokenEnv}` naming the env var that holds the token for an extra host (never the value itself). See [`docs/security.md`](docs/security.md#token-resolution).
 - `GITHUB_COM_TOKEN` — authenticates github.com *datasource* lookups (release notes, `github-tags` / `github-releases` / `github-actions`). Distinct from the platform token and never auto-derived from it; set it when github.com-hosted deps are resolved under the default `dry_run` `platform: local`. See [`docs/security.md`](docs/security.md#github_com_token--a-separate-role).
 
 > Heads up: MCP servers do **not** inherit your shell env. Set every env var via the `env` key in `.mcp.json` / `claude_desktop_config.json`. See [`docs/security.md`](docs/security.md#where-env-vars-must-live).
@@ -139,8 +140,9 @@ The offline tools need nothing. Add env vars only for what you use:
 | Local `dry_run` on a repo with github.com dependencies | `GITHUB_COM_TOKEN` (read-only PAT, avoids anonymous rate limits) |
 | `dry_run` against GitHub, or private `github>` presets | `RENOVATE_PLATFORM=github` + `GITHUB_TOKEN` |
 | `dry_run` against GitLab, or private `gitlab>` presets | `RENOVATE_PLATFORM=gitlab` + `GITLAB_TOKEN` |
+| Private presets on another host | `RENOVATE_MCP_HOST_TOKENS` + the variable it names |
 
-Self-hosted GitLab and GitHub Enterprise also need `RENOVATE_ENDPOINT` — see [Platform setup](#platform-setup).
+Self-hosted GitLab and GitHub Enterprise also need `RENOVATE_ENDPOINT` — see [Platform setup](#platform-setup). Each token is only sent to its own platform's host.
 
 In Claude Code, re-register with `-e`:
 
@@ -169,11 +171,11 @@ For `dry_run` against a remote platform or `resolve_config` with `externalPreset
 | GitHub Enterprise | `github` | `https://github.example.com/api/v3/` | `RENOVATE_TOKEN` *or* `GITHUB_TOKEN` |
 | gitlab.com | `gitlab` | (omit) | `RENOVATE_TOKEN` *or* `GITLAB_TOKEN` |
 | Self-hosted GitLab | `gitlab` | `https://gitlab.example.com/api/v4/` | `RENOVATE_TOKEN` *or* `GITLAB_TOKEN` |
-| gitea.com / Forgejo (code.forgejo.org) | — | (omit) | `RENOVATE_TOKEN` *or* `GITEA_TOKEN` / `FORGEJO_TOKEN` |
-| Self-hosted Gitea / Forgejo | — | `https://forgejo.example.com/api/v1/` | `RENOVATE_TOKEN` *or* `GITEA_TOKEN` / `FORGEJO_TOKEN` |
-| Bitbucket Cloud | — | (omit) | `RENOVATE_TOKEN` *or* `BITBUCKET_TOKEN` |
+| gitea.com / Forgejo (code.forgejo.org) | — | (omit) | `GITEA_TOKEN` / `FORGEJO_TOKEN` |
+| Self-hosted Gitea / Forgejo | `gitea` / `forgejo` | `https://forgejo.example.com/api/v1` | `RENOVATE_TOKEN` *or* `GITEA_TOKEN` / `FORGEJO_TOKEN` |
+| Bitbucket Cloud | — | (omit) | `BITBUCKET_TOKEN` |
 
-The Gitea / Forgejo / Bitbucket Cloud rows apply to the `resolve_config` family only: `dry_run` runs Renovate as `local` / `github` / `gitlab` and never reads those tokens. Pass `platform` (`gitea` / `forgejo` / `bitbucket`) and `endpoint` as tool inputs instead of `RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT`.
+The Gitea / Forgejo / Bitbucket Cloud rows apply to the `resolve_config` family only: `dry_run` runs Renovate as `local` / `github` / `gitlab` and only passes those tokens on as host rules for their hosts. `platform` (`gitea` / `forgejo` / `bitbucket`) and `endpoint` can also be passed as tool inputs, but they only route `local>` presets: a token goes only to its platform's public host or to the env home (`RENOVATE_PLATFORM` at `RENOVATE_ENDPOINT`, where `RENOVATE_TOKEN` comes first), so an endpoint passed only per call needs a `RENOVATE_MCP_HOST_TOKENS` entry. `endpoint` routes `local>` presets only, as in Renovate.
 
 See [`docs/platform-setup.md`](docs/platform-setup.md) for a worked self-hosted GitLab example, `local>` preset handling, and private-registry credentials.
 
@@ -196,8 +198,8 @@ Once the server is wired up, try prompts like these. Written for Claude but work
 
 **Self-hosted GitLab / GitHub Enterprise** (env set per [Platform setup](#platform-setup))
 
-- "Resolve my config with external presets enabled, fetching `gitlab>platform/renovate-presets` from our self-hosted GitLab at `https://gitlab.example.com/api/v4`. Route `local>` presets through the same host."
-- "Expand `github>acme/renovate-config//base` from our GitHub Enterprise at `https://github.acme.corp/api/v3`."
+- "Resolve my config with external presets enabled. Its `local>platform/renovate-presets` presets live on our self-hosted GitLab at `https://gitlab.example.com/api/v4`."
+- "Resolve my config with external presets enabled. Its `local>acme/renovate-config//base` preset lives on our GitHub Enterprise at `https://github.acme.corp/api/v3`."
 - "Dry-run `infrastructure/kubernetes/our-platform` (a nested-group GitLab project) so Renovate can fetch the `local>` presets the config extends."
 
 **Authoring a custom manager (regex or JSONata)**

package/dist/lib/credentialResolver.js

@@ -1,15 +1 @@
-/**
- * Resolve a credential by checking each env var name in order and returning
- * the first one that's set. Used by both `resolve_config` (for `github>` /
- * `gitlab>` preset fetches) and `dry_run` (when picking which token to export
- * as `RENOVATE_TOKEN` to the spawned Renovate CLI). Keeping the precedence in
- * one place ensures the two tools cannot drift out of sync.
- */
-export function resolveCredential(vars) {
-    for (const envVar of vars) {
-        const value = process.env[envVar];
-        if (value)
-            return { envVar, token: value, triedVars: vars };
-    }
-    return { envVar: null, token: undefined, triedVars: vars };
-}
+export {};

package/dist/lib/externalPresetFetcher.js

@@ -1,6 +1,6 @@
 import JSON5 from "json5";
-import { resolveCredential } from "./credentialResolver.js";
 import { validateEndpoint } from "./endpointValidator.js";
+import { selectToken } from "./hostTokens.js";
 import { classifyExternalSource, } from "./presetResolver.js";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const DEFAULT_API_BASE = {
@@ -45,19 +45,19 @@ function dispatch(parsed, options) {
             return Promise.resolve({ ok: false, reason: blocked });
         endpoint = trimTrailingSlash(options.endpoint);
     }
-    switch (parsed.source) {
+    // `classifyExternalSource` refused local / npm above, so only the hosted
+    // platforms remain and the switch is exhaustive.
+    const source = parsed.source;
+    switch (source) {
         case "github":
             return fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint);
         case "gitlab":
             return fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint);
         case "gitea":
         case "forgejo":
-            return fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, parsed.source);
+            return fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, source);
         case "bitbucket":
             return fetchBitbucket(parsed, timeoutMs, fetchImpl, endpoint);
-        default:
-            // Unreachable: `classifyExternalSource` already refused local / npm.
-            return Promise.resolve({ ok: false, reason: `Unknown preset source: ${parsed.source}` });
     }
 }
 /** GitHub, Gitea and Bitbucket address repositories as exactly two path segments (nested groups are a GitLab thing). */
@@ -84,7 +84,7 @@ async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
     const ref = parsed.ref ?? "HEAD";
     const apiBase = endpoint ?? DEFAULT_API_BASE.github;
     const url = `${apiBase}/repos/${encodeFilePath(parsed.repoPath)}/contents/${encodeFilePath(file)}?ref=${encodeURIComponent(ref)}`;
-    const credential = resolveCredential(["RENOVATE_TOKEN", "GITHUB_TOKEN"]);
+    const credential = selectToken(url, "github");
     const headers = {
         Accept: "application/vnd.github.raw",
         "User-Agent": "renovate-mcp",
@@ -105,7 +105,7 @@ async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
     const ref = parsed.ref ?? "HEAD";
     const apiBase = endpoint ?? DEFAULT_API_BASE.gitlab;
     const url = `${apiBase}/projects/${encodeURIComponent(parsed.repoPath)}/repository/files/${encodeURIComponent(file)}/raw?ref=${encodeURIComponent(ref)}`;
-    const credential = resolveCredential(["RENOVATE_TOKEN", "GITLAB_TOKEN"]);
+    const credential = selectToken(url, "gitlab");
     const headers = { "User-Agent": "renovate-mcp" };
     const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
     if (sendAuth)
@@ -125,10 +125,7 @@ async function fetchGitea(parsed, timeoutMs, fetchImpl, endpoint, platform) {
     // No `ref` means the repository's default branch, as in Renovate.
     const refQuery = parsed.ref ? `?ref=${encodeURIComponent(parsed.ref)}` : "";
     const url = `${apiBase}/repos/${encodeFilePath(parsed.repoPath)}/raw/${encodeFilePath(file)}${refQuery}`;
-    const credential = resolveCredential([
-        "RENOVATE_TOKEN",
-        platform === "gitea" ? "GITEA_TOKEN" : "FORGEJO_TOKEN",
-    ]);
+    const credential = selectToken(url, platform);
     const headers = { "User-Agent": "renovate-mcp" };
     const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
     if (sendAuth)
@@ -160,7 +157,7 @@ async function fetchBitbucket(parsed, timeoutMs, fetchImpl, endpoint) {
     const apiBase = endpoint ?? DEFAULT_API_BASE.bitbucket;
     const ref = encodeURIComponent(rawRef);
     const url = `${apiBase}/2.0/repositories/${encodeFilePath(parsed.repoPath)}/src/${ref}/${encodeFilePath(file)}`;
-    const credential = resolveCredential(["RENOVATE_TOKEN", "BITBUCKET_TOKEN"]);
+    const credential = selectToken(url, "bitbucket");
     const headers = { "User-Agent": "renovate-mcp" };
     const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
     if (sendAuth)
@@ -338,7 +335,7 @@ async function discardBody(res) {
 function formatAuthFailure(status, presetName, url, credential, body) {
     const lines = [`HTTP ${status} when fetching ${presetName}`];
     lines.push(`  URL:         ${url}`);
-    lines.push(`  Credential:  ${formatCredential(credential)}`);
+    lines.push(`  Credential:  ${formatCredential(credential, url)}`);
     const trimmed = body.trim();
     if (trimmed) {
         const snippet = trimmed.length > AUTH_BODY_MAX
@@ -348,9 +345,11 @@ function formatAuthFailure(status, presetName, url, credential, body) {
     }
     return lines.join("\n");
 }
-function formatCredential(credential) {
+function formatCredential(credential, url) {
     if (credential.envVar)
         return `${credential.envVar} (present)`;
+    if (credential.triedVars.length === 0)
+        return `none (no token is bound to ${new URL(url).hostname})`;
     return `none (tried ${credential.triedVars.join(", ")})`;
 }
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);

package/dist/lib/gitRemote.js

@@ -40,15 +40,38 @@ export function parseRemoteUrl(url) {
     return { host, scheme: "ssh", owner, repo };
 }
 /**
- * Read the `[remote "origin"] url = …` field from a repo's `.git/config`
- * without spawning `git`. Returns `null` for non-git directories, missing
- * config, missing origin remote, or unreadable files (no exceptions thrown).
+ * Read the `[remote "origin"] url = …` field from a repo's git config without
+ * spawning `git`. A `.git` file (worktree, submodule) is followed through its
+ * `gitdir:` line, and a worktree's `commondir` to the shared config. The
+ * gitdir must look like one git writes (`…/.git`, `…/.git/worktrees/<name>`
+ * or `…/.git/modules/…`), and a worktree's common dir must be a `…/.git`;
+ * any other target is no origin, so a crafted `.git` file cannot point the
+ * origin at an arbitrary config. Returns `null` for
+ * non-git directories, missing config, missing origin remote, or unreadable
+ * files (no exceptions thrown).
  */
+/** A `.git` dir, a worktree's `.git/worktrees/<name>`, or a submodule's `.git/modules/<path>`. */
+const GITDIR_SHAPE = /\/\.git(?:\/worktrees\/[^/]+|\/modules\/.+)?$/;
 export async function readOriginRemote(repoPath) {
-    const configPath = path.join(repoPath, ".git", "config");
+    const dotGit = path.join(repoPath, ".git");
+    // Reading a `.git` directory fails (EISDIR): then it is the git dir itself.
+    const pointer = await fs.readFile(dotGit, "utf8").catch(() => "");
+    const gitdirLine = /^gitdir:\s*(.+)$/m.exec(pointer);
+    let gitDir = dotGit;
+    if (gitdirLine) {
+        gitDir = path.resolve(repoPath, gitdirLine[1].trim());
+        if (!GITDIR_SHAPE.test(gitDir.split(path.sep).join("/")))
+            return null;
+        const commonDir = await fs.readFile(path.join(gitDir, "commondir"), "utf8").catch(() => null);
+        if (commonDir) {
+            gitDir = path.resolve(gitDir, commonDir.trim());
+            if (!/\/\.git$/.test(gitDir.split(path.sep).join("/")))
+                return null;
+        }
+    }
     let raw;
     try {
-        raw = await fs.readFile(configPath, "utf8");
+        raw = await fs.readFile(path.join(gitDir, "config"), "utf8");
     }
     catch {
         return null;

package/dist/lib/hostRulesConfig.js

@@ -1,25 +1,30 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
 /**
- * Write a throwaway Renovate config containing just `{ hostRules: [...] }` to
- * `os.tmpdir()` with mode 0600, and return the absolute path. The caller is
- * responsible for unlinking the file (in a `finally` block) once Renovate has
- * consumed it — we do not keep a reference here.
+ * Write a throwaway Renovate config containing just `{ hostRules: [...] }` and
+ * return its absolute path. The file sits alone in a fresh `mkdtemp`
+ * directory (mode 0700) under `os.tmpdir()` and is created with `wx` and mode
+ * 0600: it holds env tokens on most runs, so no other local user may read it
+ * or plant a file at the path first. The caller removes it with
+ * `removeHostRulesConfig` (in a `finally` block) once Renovate has consumed it.
  *
- * The caller points Renovate at this file via the `RENOVATE_CONFIG_FILE` env
- * var (not a CLI flag — `--config-file` is not a real Renovate option).
- * Renovate merges its rules with any repo-level `hostRules` via array
- * concatenation (most-specific match wins), so callers can combine
- * per-invocation credentials with whatever the repo itself already declares.
+ * The caller points Renovate at this file via the `RENOVATE_CONFIG_FILE` (or
+ * `RENOVATE_ADDITIONAL_CONFIG_FILE`) env var, not a CLI flag — `--config-file`
+ * is not a real Renovate option. Renovate concatenates its rules with any
+ * other `hostRules`, so callers can combine per-invocation credentials with
+ * whatever the repo itself already declares.
  */
 export async function writeHostRulesConfig(hostRules) {
-    const tmpPath = path.join(tmpdir(), `renovate-mcp-hostrules-${randomUUID()}.json`);
-    const body = JSON.stringify({ hostRules }, null, 2);
-    await fs.writeFile(tmpPath, body, { mode: 0o600 });
+    const dir = await fs.mkdtemp(path.join(tmpdir(), "renovate-mcp-hostrules-"));
+    const tmpPath = path.join(dir, "config.json");
+    await fs.writeFile(tmpPath, JSON.stringify({ hostRules }, null, 2), { flag: "wx", mode: 0o600 });
     return tmpPath;
 }
+/** Remove a file written by `writeHostRulesConfig` together with its directory. */
+export async function removeHostRulesConfig(filePath) {
+    await fs.rm(path.dirname(filePath), { recursive: true, force: true });
+}
 const SECRET_KEYS = ["token", "password"];
 /**
  * Pull the token/password values out of the provided hostRules so callers can

package/dist/lib/hostTokens.js

@@ -0,0 +1,229 @@
+import { HOSTED_PLATFORMS } from "./gitRemote.js";
+import { HOST_RULES_MAX_ITEMS } from "./inputLimits.js";
+export const PLATFORM_TOKEN_ENV = {
+    github: "GITHUB_TOKEN",
+    gitlab: "GITLAB_TOKEN",
+    gitea: "GITEA_TOKEN",
+    forgejo: "FORGEJO_TOKEN",
+    bitbucket: "BITBUCKET_TOKEN",
+};
+/** Each platform's public host; a bare domain also covers its subdomains (api.github.com). */
+export const PUBLIC_HOST = {
+    github: "github.com",
+    gitlab: "gitlab.com",
+    gitea: "gitea.com",
+    forgejo: "code.forgejo.org",
+    bitbucket: "bitbucket.org",
+};
+export const HOST_TOKENS_ENV = "RENOVATE_MCP_HOST_TOKENS";
+const ENTRY_KEYS = ["hostType", "matchHost", "tokenEnv"];
+const TOKEN_ENV_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const HOST_TYPE_RE = /^[a-z0-9-]+$/;
+const BARE_HOST_RE = /^\.?[a-z0-9-]+(\.[a-z0-9-]+)*$/;
+/** Parse `RENOVATE_MCP_HOST_TOKENS`. Any malformed entry rejects the whole var; errors never echo its value. */
+export function parseHostTokens(env = process.env) {
+    const raw = env[HOST_TOKENS_ENV]?.trim();
+    if (!raw)
+        return { ok: true, entries: [] };
+    const fail = (what) => ({
+        ok: false,
+        error: `${HOST_TOKENS_ENV}${what.startsWith("[") ? "" : " "}${what}`,
+    });
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return fail("is not valid JSON.");
+    }
+    if (!Array.isArray(parsed)) {
+        return fail("must be a JSON array of {matchHost, hostType, tokenEnv} objects.");
+    }
+    if (parsed.length > HOST_RULES_MAX_ITEMS) {
+        return fail(`has ${parsed.length} entries; the limit is ${HOST_RULES_MAX_ITEMS}.`);
+    }
+    for (const [i, e] of parsed.entries()) {
+        const at = `[${i}]`;
+        if (!e || typeof e !== "object" || Array.isArray(e)) {
+            return fail(`${at} must be an object with exactly the keys matchHost, hostType, tokenEnv.`);
+        }
+        if (Object.keys(e).sort().join() !== ENTRY_KEYS.join()) {
+            return fail(`${at} must be an object with exactly the keys matchHost, hostType, tokenEnv.`);
+        }
+        const { matchHost, hostType, tokenEnv } = e;
+        if (typeof tokenEnv !== "string" || !TOKEN_ENV_RE.test(tokenEnv)) {
+            return fail(`${at}.tokenEnv must be an environment variable name (letters, digits, underscore).`);
+        }
+        if (typeof hostType !== "string" || !HOST_TYPE_RE.test(hostType)) {
+            return fail(`${at}.hostType must be a lowercase Renovate hostType such as gitlab or npm.`);
+        }
+        if (typeof matchHost !== "string" || !isValidMatchHost(matchHost)) {
+            return fail(`${at}.matchHost must be a bare lowercase host (gitlab.example.com) or an https:// URL prefix without credentials.`);
+        }
+    }
+    return { ok: true, entries: parsed };
+}
+function isValidMatchHost(matchHost) {
+    if (BARE_HOST_RE.test(matchHost))
+        return true;
+    const url = parseUrl(matchHost);
+    return url !== null && url.protocol === "https:" && !url.username && !url.password;
+}
+/** Renovate's `matchesHost`: URL-form `matchHost` is a prefix match, a bare host matches itself and its subdomains. */
+export function matchesHost(matchHost, url) {
+    const parsedUrl = parseUrl(url);
+    if (!parsedUrl)
+        return false;
+    const parsedMatch = parseUrl(matchHost);
+    if (isHttp(parsedUrl) && parsedMatch && isHttp(parsedMatch)) {
+        const { href } = parsedMatch;
+        const bare = new URL(parsedUrl.href);
+        bare.username = "";
+        bare.password = "";
+        if (bare.href.startsWith(href))
+            return true;
+        return `${parsedUrl.origin}${parsedUrl.pathname}`.replace(/\/?$/, "/") === href;
+    }
+    return domainMatches(parsedUrl.hostname, matchHost);
+}
+/**
+ * Resolve the `local>` route (ADR-0008): platform = the tool's `platform`
+ * input, else `RENOVATE_PLATFORM`; endpoint = the `endpoint` input, else
+ * `RENOVATE_ENDPOINT`, but the env endpoint only when there is no platform
+ * input or it equals `RENOVATE_PLATFORM` (an env endpoint belongs to the env
+ * platform). Unlike Renovate, a missing platform does not default to github:
+ * without a hosted platform there is no scope and `local>` has no route.
+ * Routing only: token binding reads the env scope, `homeScope({}, env)`.
+ */
+export function homeScope(input, env = process.env) {
+    const platform = input.platform || env.RENOVATE_PLATFORM;
+    if (!HOSTED_PLATFORMS.includes(platform))
+        return {};
+    const envEndpointApplies = !input.platform || input.platform === env.RENOVATE_PLATFORM;
+    const endpoint = input.endpoint || (envEndpointApplies ? env.RENOVATE_ENDPOINT : undefined);
+    return endpoint ? { platform: platform, endpoint } : { platform: platform };
+}
+/** Renovate turns `GITHUB_COM_TOKEN` into this rule itself, after the file config's rules. */
+const GITHUB_COM_RULE = { hostType: "github", matchHost: "github.com", vars: ["GITHUB_COM_TOKEN"] };
+/**
+ * The rule list in the order `buildHostTokenRules` writes it: one rule per
+ * hosted platform on its bound bare host, then the host-token entries. The
+ * env home platform's rule carries `RENOVATE_TOKEN` first, as Renovate's own
+ * platform rule does (it deletes `GITLAB_TOKEN` and friends from its env), and
+ * its own token as the fallback. Only env vars shape the list: a call input or
+ * the repo's origin can never bind a token to another host (ADR-0008).
+ */
+function candidateRules(env, entries) {
+    const home = homeScope({}, env);
+    const rules = [];
+    for (const platform of HOSTED_PLATFORMS) {
+        const matchHost = boundHost(platform, home);
+        if (!matchHost)
+            continue;
+        const vars = platform === home.platform ? ["RENOVATE_TOKEN", PLATFORM_TOKEN_ENV[platform]] : [PLATFORM_TOKEN_ENV[platform]];
+        rules.push({ hostType: platform, matchHost, vars });
+    }
+    for (const { matchHost, hostType, tokenEnv } of entries)
+        rules.push({ hostType, matchHost, vars: [tokenEnv], entry: true });
+    return rules;
+}
+/**
+ * Pick the token for a request to `url` of `hostType` the way Renovate's
+ * `hostRules.find()` does over the exact rule list `buildHostTokenRules`
+ * emits, followed by the `GITHUB_COM_TOKEN` rule Renovate appends from env.
+ * Every rule here has a hostType and a matchHost, so Renovate's rank ties and
+ * the longer raw `matchHost` wins, then the later rule. A rule whose variables
+ * are all unset does not exist for Renovate and is skipped. `triedVars` lists
+ * the variables of every matching rule, most specific first.
+ * `githubComToken: false` leaves the `GITHUB_COM_TOKEN` rule out.
+ * A malformed `RENOVATE_MCP_HOST_TOKENS` contributes no entries; callers refuse it first.
+ */
+export function selectToken(url, hostType, env = process.env, options = {}) {
+    const parsed = parseHostTokens(env);
+    const rules = candidateRules(env, parsed.ok ? parsed.entries : []);
+    if (options.githubComToken !== false)
+        rules.push(GITHUB_COM_RULE);
+    const ranked = rules
+        .filter((r) => r.hostType === hostType && matchesHost(r.matchHost, url))
+        // Renovate sorts ascending (stable) and the last match wins; reversed,
+        // that is longest first and, on a tie, the later rule first.
+        .sort((a, b) => a.matchHost.length - b.matchHost.length)
+        .reverse();
+    const triedVars = [...new Set(ranked.flatMap((r) => r.vars))];
+    for (const rule of ranked) {
+        const envVar = rule.vars.find((v) => env[v]);
+        if (envVar)
+            return { envVar, token: env[envVar], triedVars };
+    }
+    return { envVar: null, token: undefined, triedVars };
+}
+/**
+ * Host rules for a spawned Renovate, in find() order: each per-platform token
+ * on its bound bare host (`RENOVATE_TOKEN` first on the env home platform's
+ * host, its own token when that is unset), then every host-token entry, so entries win
+ * an equal-length tie. `GITHUB_COM_TOKEN` is left to Renovate, which reads it
+ * from env. Rules a `covered` entry (per-call hostRules, the platform rule)
+ * must win over are left out. Renovate's `find()` ranks hostType + matchHost
+ * over matchHost alone over hostType alone, then the longer matchHost, then
+ * the later rule, so an env rule goes when the entry has no other hostType and
+ * the env rule sits on the entry's host or below it (a tie the env rule would
+ * win or lose to the later entry anyway), or when the entry has no hostType
+ * and sits below the env rule's host (the env rule outranks it). An entry
+ * without a matchHost covers every host of its hostType. Entries whose
+ * variable is unset are skipped with a warning; a malformed var yields `error`
+ * and no rules.
+ */
+export function buildHostTokenRules(env = process.env, covered = []) {
+    const parsed = parseHostTokens(env);
+    if (!parsed.ok)
+        return { rules: [], secrets: [], warnings: [], error: parsed.error };
+    const rules = [];
+    const warnings = [];
+    /** `host` (bare or URL form) is `matchHost` or falls under it. */
+    const under = (host, matchHost) => host === matchHost || matchesHost(matchHost, parseUrl(host) ? host : `https://${host}`);
+    const isCovered = (r) => covered.some((c) => {
+        if (c.hostType !== undefined && c.hostType !== r.hostType)
+            return false;
+        if (c.matchHost === undefined)
+            return true;
+        if (under(r.matchHost, c.matchHost))
+            return true;
+        return c.hostType === undefined && under(c.matchHost, r.matchHost);
+    });
+    for (const rule of candidateRules(env, parsed.entries)) {
+        const envVar = rule.vars.find((v) => env[v]);
+        if (envVar && !isCovered(rule))
+            rules.push({ hostType: rule.hostType, matchHost: rule.matchHost, token: env[envVar] });
+        else if (!envVar && rule.entry) {
+            warnings.push(`${HOST_TOKENS_ENV} entry for ${rule.matchHost} (${rule.hostType}) names ${rule.vars[0]}, which is not set; skipped.`);
+        }
+    }
+    return { rules, secrets: [...new Set(rules.map((r) => r.token))], warnings };
+}
+/** The bare host the env token rule for `platform` is bound to; undefined for an unparseable `RENOVATE_ENDPOINT`. */
+export function tokenHost(platform, env = process.env) {
+    return boundHost(platform, homeScope({}, env));
+}
+function boundHost(platform, scope) {
+    if (scope.platform === platform && scope.endpoint)
+        return parseUrl(scope.endpoint)?.hostname || undefined;
+    return PUBLIC_HOST[platform];
+}
+function domainMatches(host, domain) {
+    if (!host)
+        return false;
+    if (host === domain)
+        return true;
+    return host.endsWith(domain.startsWith(".") ? domain : `.${domain}`);
+}
+function parseUrl(url) {
+    try {
+        return new URL(url);
+    }
+    catch {
+        return null;
+    }
+}
+function isHttp(url) {
+    return url.protocol === "http:" || url.protocol === "https:";
+}

package/dist/lib/inputLimits.js

@@ -16,6 +16,10 @@ export const HOST_RULES_MAX_ITEMS = 256;
 export const HOST_RULE_JSON_MAX_BYTES = 64_000;
 export const BASE_BRANCHES_MAX_ITEMS = 50;
 export const BRANCH_NAME_MAX_BYTES = 256;
+// dry_run's temporary repo copy for local-preset flattening (ADR-0009):
+// checked against the listing and an lstat sum before anything is copied.
+export const REPO_COPY_MAX_FILES = 50_000;
+export const REPO_COPY_MAX_BYTES = 512 * 1024 * 1024;
 export const pathString = (description) => z.string().max(PATH_MAX_BYTES).describe(description);
 export const tokenString = (description) => z.string().max(TOKEN_MAX_BYTES).describe(description);
 export const endpointString = (description) => z.string().max(ENDPOINT_MAX_BYTES).describe(description);