From 223f7b9a2d12e30b88f28e08bfcc02a484d9c873 Mon Sep 17 00:00:00 2001 From: Xavier Hamel Date: Tue, 4 Aug 2026 14:18:09 -0400 Subject: [PATCH 1/2] fix(overwatch): Make the package loadable from CommonJS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `octokit` mega-package eagerly imports `@octokit/app`, whose exports map exposes only `import` conditions with no `require`-resolvable target. Since this package ships a CJS build, any consumer whose loader resolves under the `require` condition — notably a loop file run through tsx, which transpiles octokit's ESM bundle down to CJS — dies with ERR_PACKAGE_PATH_NOT_EXPORTED before the loop starts. Compose `@octokit/core` with the rest-endpoint-methods and paginate-rest plugins instead. That covers everything `github.ts` uses (rest, paginate, graphql, auth), never pulls in `@octokit/app`, and drops the unused OAuth/App/webhooks surface from the install. Co-Authored-By: Claude Opus 5 (1M context) --- overwatch/package.json | 8 ++- overwatch/pnpm-lock.yaml | 134 +++------------------------------------ overwatch/src/github.ts | 15 ++++- 3 files changed, 28 insertions(+), 129 deletions(-) diff --git a/overwatch/package.json b/overwatch/package.json index cabe6c1c..7c905d28 100644 --- a/overwatch/package.json +++ b/overwatch/package.json @@ -1,6 +1,6 @@ { "name": "@bpinternal/overwatch", - "version": "0.3.5", + "version": "0.3.6", "description": "Headless library for building control loops: scheduled bots that scan a repo for a class of anomaly, fix a few instances with a coding agent, and open a PR — no server, UI, or persistent process.", "keywords": [ "control-loop", @@ -58,8 +58,10 @@ "dependencies": { "@daytona/sdk": "^0.195.0", "@octokit/auth-app": "^8.2.0", + "@octokit/core": "^7.0.6", + "@octokit/plugin-paginate-rest": "^14.0.0", + "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "@slack/web-api": "^8.0.0", - "commander": "^15.0.0", - "octokit": "^5.0.5" + "commander": "^15.0.0" } } diff --git a/overwatch/pnpm-lock.yaml b/overwatch/pnpm-lock.yaml index 56d5374e..af3530b8 100644 --- a/overwatch/pnpm-lock.yaml +++ b/overwatch/pnpm-lock.yaml @@ -14,15 +14,21 @@ importers: '@octokit/auth-app': specifier: ^8.2.0 version: 8.2.0 + '@octokit/core': + specifier: ^7.0.6 + version: 7.0.6 + '@octokit/plugin-paginate-rest': + specifier: ^14.0.0 + version: 14.0.0(@octokit/core@7.0.6) + '@octokit/plugin-rest-endpoint-methods': + specifier: ^17.0.0 + version: 17.0.0(@octokit/core@7.0.6) '@slack/web-api': specifier: ^8.0.0 version: 8.0.0 commander: specifier: ^15.0.0 version: 15.0.0 - octokit: - specifier: ^5.0.5 - version: 5.0.5 devDependencies: '@types/node': specifier: ^22.9.0 @@ -471,10 +477,6 @@ packages: resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==} engines: {node: '>= 8'} - '@octokit/app@16.1.2': - resolution: {integrity: sha512-8j7sEpUYVj18dxvh0KWj6W/l6uAiVRBl1JBDVRqH1VHKAO/G5eRVl4yEoYACjakWers1DjUkcCHyJNQK47JqyQ==} - engines: {node: '>= 20'} - '@octokit/auth-app@8.2.0': resolution: {integrity: sha512-vVjdtQQwomrZ4V46B9LaCsxsySxGoHsyw6IYBov/TqJVROrlYdyNgw5q6tQbB7KZt53v1l1W53RiqTvpzL907g==} engines: {node: '>= 20'} @@ -495,10 +497,6 @@ packages: resolution: {integrity: sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==} engines: {node: '>= 20'} - '@octokit/auth-unauthenticated@7.0.3': - resolution: {integrity: sha512-8Jb1mtUdmBHL7lGmop9mU9ArMRUTRhg8vp0T1VtZ4yd9vEm3zcLwmjQkhNEduKawOOORie61xhtYIhTDN+ZQ3g==} - engines: {node: '>= 20'} - '@octokit/core@7.0.6': resolution: {integrity: sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==} engines: {node: '>= 20'} @@ -511,10 +509,6 @@ packages: resolution: {integrity: sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==} engines: {node: '>= 20'} - '@octokit/oauth-app@8.0.3': - resolution: {integrity: sha512-jnAjvTsPepyUaMu9e69hYBuozEPgYqP4Z3UnpmvoIzHDpf8EXDGvTY1l1jK0RsZ194oRd+k6Hm13oRU8EoDFwg==} - engines: {node: '>= 20'} - '@octokit/oauth-authorization-url@8.0.0': resolution: {integrity: sha512-7QoLPRh/ssEA/HuHBHdVdSgF8xNLz/Bc5m9fZkArJE5bb6NmVkDm3anKxXPmN1zh6b5WKZPRr3697xKT/yM3qQ==} engines: {node: '>= 20'} @@ -526,15 +520,6 @@ packages: '@octokit/openapi-types@27.0.0': resolution: {integrity: sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==} - '@octokit/openapi-webhooks-types@12.1.0': - resolution: {integrity: sha512-WiuzhOsiOvb7W3Pvmhf8d2C6qaLHXrWiLBP4nJ/4kydu+wpagV5Fkz9RfQwV2afYzv3PB+3xYgp4mAdNGjDprA==} - - '@octokit/plugin-paginate-graphql@6.0.0': - resolution: {integrity: sha512-crfpnIoFiBtRkvPqOyLOsw12XsveYuY2ieP6uYDosoUegBJpSVxGwut9sxUgFFcll3VTOTqpUf8yGd8x1OmAkQ==} - engines: {node: '>= 20'} - peerDependencies: - '@octokit/core': '>=6' - '@octokit/plugin-paginate-rest@14.0.0': resolution: {integrity: sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==} engines: {node: '>= 20'} @@ -547,18 +532,6 @@ packages: peerDependencies: '@octokit/core': '>=6' - '@octokit/plugin-retry@8.1.0': - resolution: {integrity: sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==} - engines: {node: '>= 20'} - peerDependencies: - '@octokit/core': '>=7' - - '@octokit/plugin-throttling@11.0.3': - resolution: {integrity: sha512-34eE0RkFCKycLl2D2kq7W+LovheM/ex3AwZCYN8udpi6bxsyjZidb2McXs69hZhLmJlDqTSP8cH+jSRpiaijBg==} - engines: {node: '>= 20'} - peerDependencies: - '@octokit/core': ^7.0.0 - '@octokit/request-error@7.1.0': resolution: {integrity: sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==} engines: {node: '>= 20'} @@ -570,14 +543,6 @@ packages: '@octokit/types@16.0.0': resolution: {integrity: sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==} - '@octokit/webhooks-methods@6.0.0': - resolution: {integrity: sha512-MFlzzoDJVw/GcbfzVC1RLR36QqkTLUf79vLVO3D+xn7r0QgxnFoLZgtrzxiQErAjFUOdH6fas2KeQJ1yr/qaXQ==} - engines: {node: '>= 20'} - - '@octokit/webhooks@14.2.0': - resolution: {integrity: sha512-da6KbdNCV5sr1/txD896V+6W0iamFWrvVl8cHkBSPT+YlvmT3DwXa4jxZnQc+gnuTEqSWbBeoSZYTayXH9wXcw==} - engines: {node: '>= 20'} - '@opentelemetry/api-logs@0.219.0': resolution: {integrity: sha512-FFx7YnaYJlIjqWW/AG/yAZ0L/NEY724PipXXXQLdtZPbLwBGbUMTGL1i/esI56TWfTUXxhLfpgrnWJCG8aUJyg==} engines: {node: '>=8.0.0'} @@ -976,9 +941,6 @@ packages: '@tsconfig/node16@1.0.4': resolution: {integrity: sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA==} - '@types/aws-lambda@8.10.162': - resolution: {integrity: sha512-Fn658grtLOci1oxi1391vvDWJRKNGWRSqfxRkmN/Iy3c0tQH1USMKEXcPYHLvope+ZgTFocx9FRQJx1muBL6qw==} - '@types/estree@1.0.9': resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==} @@ -1060,9 +1022,6 @@ packages: before-after-hook@4.0.0: resolution: {integrity: sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==} - bottleneck@2.19.5: - resolution: {integrity: sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==} - bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} @@ -1400,10 +1359,6 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true - octokit@5.0.5: - resolution: {integrity: sha512-4+/OFSqOjoyULo7eN7EA97DE0Xydj/PW5aIckxqQIoFjFwqXKuFCvXUJObyJfBF9Khu4RL/jlDRI9FPaMGfPnw==} - engines: {node: '>= 20'} - p-finally@1.0.0: resolution: {integrity: sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow==} engines: {node: '>=4'} @@ -2113,16 +2068,6 @@ snapshots: '@nodelib/fs.scandir': 2.1.5 fastq: 1.20.1 - '@octokit/app@16.1.2': - dependencies: - '@octokit/auth-app': 8.2.0 - '@octokit/auth-unauthenticated': 7.0.3 - '@octokit/core': 7.0.6 - '@octokit/oauth-app': 8.0.3 - '@octokit/plugin-paginate-rest': 14.0.0(@octokit/core@7.0.6) - '@octokit/types': 16.0.0 - '@octokit/webhooks': 14.2.0 - '@octokit/auth-app@8.2.0': dependencies: '@octokit/auth-oauth-app': 9.0.3 @@ -2159,11 +2104,6 @@ snapshots: '@octokit/auth-token@6.0.0': {} - '@octokit/auth-unauthenticated@7.0.3': - dependencies: - '@octokit/request-error': 7.1.0 - '@octokit/types': 16.0.0 - '@octokit/core@7.0.6': dependencies: '@octokit/auth-token': 6.0.0 @@ -2185,17 +2125,6 @@ snapshots: '@octokit/types': 16.0.0 universal-user-agent: 7.0.3 - '@octokit/oauth-app@8.0.3': - dependencies: - '@octokit/auth-oauth-app': 9.0.3 - '@octokit/auth-oauth-user': 6.0.2 - '@octokit/auth-unauthenticated': 7.0.3 - '@octokit/core': 7.0.6 - '@octokit/oauth-authorization-url': 8.0.0 - '@octokit/oauth-methods': 6.0.2 - '@types/aws-lambda': 8.10.162 - universal-user-agent: 7.0.3 - '@octokit/oauth-authorization-url@8.0.0': {} '@octokit/oauth-methods@6.0.2': @@ -2207,12 +2136,6 @@ snapshots: '@octokit/openapi-types@27.0.0': {} - '@octokit/openapi-webhooks-types@12.1.0': {} - - '@octokit/plugin-paginate-graphql@6.0.0(@octokit/core@7.0.6)': - dependencies: - '@octokit/core': 7.0.6 - '@octokit/plugin-paginate-rest@14.0.0(@octokit/core@7.0.6)': dependencies: '@octokit/core': 7.0.6 @@ -2223,19 +2146,6 @@ snapshots: '@octokit/core': 7.0.6 '@octokit/types': 16.0.0 - '@octokit/plugin-retry@8.1.0(@octokit/core@7.0.6)': - dependencies: - '@octokit/core': 7.0.6 - '@octokit/request-error': 7.1.0 - '@octokit/types': 16.0.0 - bottleneck: 2.19.5 - - '@octokit/plugin-throttling@11.0.3(@octokit/core@7.0.6)': - dependencies: - '@octokit/core': 7.0.6 - '@octokit/types': 16.0.0 - bottleneck: 2.19.5 - '@octokit/request-error@7.1.0': dependencies: '@octokit/types': 16.0.0 @@ -2253,14 +2163,6 @@ snapshots: dependencies: '@octokit/openapi-types': 27.0.0 - '@octokit/webhooks-methods@6.0.0': {} - - '@octokit/webhooks@14.2.0': - dependencies: - '@octokit/openapi-webhooks-types': 12.1.0 - '@octokit/request-error': 7.1.0 - '@octokit/webhooks-methods': 6.0.0 - '@opentelemetry/api-logs@0.219.0': dependencies: '@opentelemetry/api': 1.9.1 @@ -2688,8 +2590,6 @@ snapshots: '@tsconfig/node16@1.0.4': {} - '@types/aws-lambda@8.10.162': {} - '@types/estree@1.0.9': {} '@types/node@22.20.1': @@ -2778,8 +2678,6 @@ snapshots: before-after-hook@4.0.0: {} - bottleneck@2.19.5: {} - bowser@2.14.1: {} brace-expansion@2.1.2: @@ -3116,20 +3014,6 @@ snapshots: nanoid@3.3.16: {} - octokit@5.0.5: - dependencies: - '@octokit/app': 16.1.2 - '@octokit/core': 7.0.6 - '@octokit/oauth-app': 8.0.3 - '@octokit/plugin-paginate-graphql': 6.0.0(@octokit/core@7.0.6) - '@octokit/plugin-paginate-rest': 14.0.0(@octokit/core@7.0.6) - '@octokit/plugin-rest-endpoint-methods': 17.0.0(@octokit/core@7.0.6) - '@octokit/plugin-retry': 8.1.0(@octokit/core@7.0.6) - '@octokit/plugin-throttling': 11.0.3(@octokit/core@7.0.6) - '@octokit/request-error': 7.1.0 - '@octokit/types': 16.0.0 - '@octokit/webhooks': 14.2.0 - p-finally@1.0.0: {} p-queue@6.6.2: diff --git a/overwatch/src/github.ts b/overwatch/src/github.ts index 4e00344d..47bad4c7 100644 --- a/overwatch/src/github.ts +++ b/overwatch/src/github.ts @@ -1,6 +1,19 @@ import type { Sandbox } from "@daytona/sdk"; import { createAppAuth } from "@octokit/auth-app"; -import { Octokit } from "octokit"; +import { Octokit as OctokitCore } from "@octokit/core"; +import { paginateRest } from "@octokit/plugin-paginate-rest"; +import { restEndpointMethods } from "@octokit/plugin-rest-endpoint-methods"; + +/** + * Composed by hand instead of using the batteries-included `octokit` package, which can't be + * loaded from CommonJS: it eagerly imports `@octokit/app`, whose exports map exposes only + * `import` conditions (no `require`-resolvable target), so a `require()` anywhere in the chain + * — this package's own CJS build, or a loop file that tsx transpiles to CJS — dies with + * `ERR_PACKAGE_PATH_NOT_EXPORTED`. Core plus these two plugins covers everything used below + * (`rest`, `paginate`, `graphql`, `auth`) and never pulls `@octokit/app` in. + */ +const Octokit = OctokitCore.plugin(restEndpointMethods, paginateRest); +type Octokit = InstanceType; /** Committer identity used when the git source can't derive an account-backed one. */ const DEFAULT_BOT_NAME = "control-loop[bot]"; From 7fcd7e1424a9ddc366b6a377526d998aa7b802e3 Mon Sep 17 00:00:00 2001 From: Xavier Hamel Date: Tue, 4 Aug 2026 14:34:50 -0400 Subject: [PATCH 2/2] fix --- overwatch/src/github.ts | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/overwatch/src/github.ts b/overwatch/src/github.ts index 47bad4c7..8588e955 100644 --- a/overwatch/src/github.ts +++ b/overwatch/src/github.ts @@ -4,14 +4,6 @@ import { Octokit as OctokitCore } from "@octokit/core"; import { paginateRest } from "@octokit/plugin-paginate-rest"; import { restEndpointMethods } from "@octokit/plugin-rest-endpoint-methods"; -/** - * Composed by hand instead of using the batteries-included `octokit` package, which can't be - * loaded from CommonJS: it eagerly imports `@octokit/app`, whose exports map exposes only - * `import` conditions (no `require`-resolvable target), so a `require()` anywhere in the chain - * — this package's own CJS build, or a loop file that tsx transpiles to CJS — dies with - * `ERR_PACKAGE_PATH_NOT_EXPORTED`. Core plus these two plugins covers everything used below - * (`rest`, `paginate`, `graphql`, `auth`) and never pulls `@octokit/app` in. - */ const Octokit = OctokitCore.plugin(restEndpointMethods, paginateRest); type Octokit = InstanceType; @@ -420,7 +412,9 @@ export abstract class GithubBase implements GitSource { protected requireAuth(action: string): void { if (!this.authenticated) - throw new Error(`Github authentication is required to ${action} on ${this.owner}/${this.name}`); + throw new Error( + `Github authentication is required to ${action} on ${this.owner}/${this.name}`, + ); } }