Installs inherit only the server env — projects needing GITHUB_TOKEN cannot be patched

[alamb-hex]

lockfile-resolver.ts:67-72 spawns the install with:

execSync(cmd, {
  cwd: projectPath,
  stdio: "pipe",
  timeout: 120_000,
  env: { ...process.env, NODE_ENV: "development" },
});

Child installs inherit only the hexops server process env. There is no per-project env-var support anywhere in src/ — grep -rn "GITHUB_TOKEN" src/ returns nothing.

Failure mode

The do868 projects authenticate the private @do868 scope via .npmrc:

@do868:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

If GITHUB_TOKEN is unset, pnpm cannot expand the variable and discards the entire .npmrc — including the @do868:registry line. It then falls back to npmjs and 404s on @do868/shared.

This blocks every remediation on do868.com, admin.do868.com, and manage.do868.com regardless of which package is being patched, because resolveLockfile runs at update/route.ts:83 before any package or override change is applied.

Verified: same install with GITHUB_TOKEN exported succeeds in 13.5s.

Proposed fix

Per-project env vars in project settings, merged into the install child process env. Touches types.ts, settings.ts, lockfile-resolver.ts, and the settings UI.

Storage needs thought: hexops.config.json is gitignored but plaintext, and would then hold a PAT. Options worth weighing — reference an env var name to pull from the server env rather than storing the value, or read from a file path.

Workaround

Launch the server with the token in its environment. Applies the secret process-wide to all registered projects, and must be redone every launch.

[alamb-hex]

Fixed on branch fix/install-env-and-lockfile-rollback (33a81c0), not yet pushed.

Verified end-to-end against do868-com with the server launched without the credential:

• preflight now returns .npmrc references unset variable(s): GITHUB_TOKEN instead of a 404 on @do868/shared
• clean-slate refuses before deleting: lock file md5 and node_modules both unchanged across the failed call
• with the credential present, all three do868 projects return success: true

437 tests passing, tsc --noEmit clean, no new lint diagnostics.