@antonbabenko/deliberation-mcp 3.6.0 → 3.6.2

package/dist/index.js

@@ -231,18 +231,71 @@ var require_provider = __commonJS({
     var VERDICT_RE = /\bverdict\b[^A-Za-z0-9]*\b(APPROVE|REJECT|REQUEST[_\s]CHANGES)\b/i;
     var BULLET_RE = /^([-*+•]|`?\[)/;
     var BRACKET_CAT_RE = /\[\s*([A-Za-z_]+)\s*\]/g;
+    var SENTINEL_RE = /^[#>*_`\s]*verdict\s*[:=]\s*[*_`\s]*(APPROVE|REJECT|REQUEST[_\s]CHANGES)\b/i;
+    var VERDICT_WORD_RE = /^[#>*_`\s]*verdict[*_`:\s]*$/i;
+    var TOKEN_LINE_RE = /^(APPROVE|REJECT|REQUEST[_\s]CHANGES)$/i;
+    var MD_EMPHASIS = /[*_`~]/g;
+    var FENCE_RE = /^\s*(```|~~~)/;
+    var ARTIFACT_RE = /^[*_`~\s:.\-]*$/;
+    var STRIP_LEAD = /^[*_`~\s:.\-]+/;
+    var STRIP_TRAIL = /[*_`~\s]+$/;
+    var HEADING_RE = /^#{1,6}\s/;
+    function normVerdict(tok) {
+      return tok.replace(/\s+/g, "_").toUpperCase();
+    }
     function parseReview(text) {
       const raw = safeString(text);
-      const lines = raw.split(/\r?\n/);
-      let verdict = null;
-      const criticalIssues = [];
-      for (const line of lines) {
-        if (verdict === null) {
-          const vm = line.match(VERDICT_RE);
-          if (vm) verdict = /** @type {ParsedReview["verdict"]} */
-          vm[1].replace(/\s+/g, "_").toUpperCase();
+      const lines = [];
+      let inFence = false;
+      for (const ln of raw.split(/\r?\n/)) {
+        if (FENCE_RE.test(ln)) {
+          inFence = !inFence;
+          continue;
         }
-        const trimmed = line.trim();
+        if (!inFence) lines.push(ln);
+      }
+      return { verdict: resolveVerdict(lines), criticalIssues: resolveIssues(lines) };
+    }
+    function resolveVerdict(lines) {
+      for (const ln of lines) {
+        const m = ln.match(SENTINEL_RE);
+        if (m) return (
+          /** @type {any} */
+          normVerdict(m[1])
+        );
+      }
+      for (const ln of lines) {
+        const m = ln.match(VERDICT_RE);
+        if (m) return (
+          /** @type {any} */
+          normVerdict(m[1])
+        );
+      }
+      for (let i = 0; i < lines.length; i++) {
+        if (!VERDICT_WORD_RE.test(lines[i].trim())) continue;
+        for (let j = i + 1; j < lines.length && j <= i + 3; j++) {
+          const t = lines[j].replace(MD_EMPHASIS, "").trim();
+          if (!t) continue;
+          if (TOKEN_LINE_RE.test(t)) return (
+            /** @type {any} */
+            normVerdict(t)
+          );
+          break;
+        }
+      }
+      const nonEmpty = lines.map((l) => l.replace(MD_EMPHASIS, "").trim()).filter((t) => t !== "");
+      for (const t of [nonEmpty[0], nonEmpty[nonEmpty.length - 1]]) {
+        if (t && TOKEN_LINE_RE.test(t)) return (
+          /** @type {any} */
+          normVerdict(t)
+        );
+      }
+      return null;
+    }
+    function resolveIssues(lines) {
+      const out = [];
+      for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
         if (!BULLET_RE.test(trimmed)) continue;
         let chosen = null;
         for (const mm of trimmed.matchAll(BRACKET_CAT_RE)) {
@@ -258,10 +311,20 @@ var require_provider = __commonJS({
           /** @type {ReviewCriticalIssue["category"]} */
           REVIEW_CATEGORIES.includes(cat) ? cat : REVIEW_FALLBACK_CATEGORY
         );
-        const description = trimmed.slice((chosen.index || 0) + chosen[0].length).replace(/^[`\s:.\-]+/, "").trim();
-        if (description) criticalIssues.push({ category, description });
+        let description = trimmed.slice(chosen.index + chosen[0].length).replace(STRIP_LEAD, "").replace(STRIP_TRAIL, "").trim();
+        if (!description || ARTIFACT_RE.test(description)) {
+          for (let j = i + 1; j < lines.length; j++) {
+            const nt = lines[j].trim();
+            if (!nt) break;
+            if (BULLET_RE.test(nt) || HEADING_RE.test(nt)) break;
+            if (SENTINEL_RE.test(nt) || VERDICT_WORD_RE.test(nt) || VERDICT_RE.test(nt)) break;
+            description = nt.replace(STRIP_LEAD, "").replace(STRIP_TRAIL, "").trim();
+            break;
+          }
+        }
+        if (description && !ARTIFACT_RE.test(description)) out.push({ category, description });
       }
-      return { verdict, criticalIssues };
+      return out;
     }
     module2.exports = {
       toErrorResult,
@@ -324,12 +387,12 @@ ${state.currentPlan}`
       const peerPrompt = [
         body,
         "Review the plan for correctness, security, scope, ambiguity, performance, and ops gaps.",
-        "End with: **Verdict**: APPROVE | REQUEST_CHANGES | REJECT, then categorized critical issues."
+        "End with a line by itself in exactly this form (no markdown, token on the SAME line): VERDICT: APPROVE   (or VERDICT: REQUEST_CHANGES, or VERDICT: REJECT). Then list any critical issues, one per line as: - [category] description   where category is one of security, correctness, scope, ambiguity, performance, ops."
       ].join("\n\n");
       const blindPrompt = [
         body,
         "Give your own independent verdict BEFORE seeing peer opinions.",
-        "End with: **Verdict**: APPROVE | REQUEST_CHANGES | REJECT, then categorized critical issues."
+        "End with a line by itself in exactly this form (no markdown, token on the SAME line): VERDICT: APPROVE   (or VERDICT: REQUEST_CHANGES, or VERDICT: REJECT). Then list any critical issues, one per line as: - [category] description   where category is one of security, correctness, scope, ambiguity, performance, ops."
       ].join("\n\n");
       return { peerPrompt, blindPrompt };
     }
@@ -1055,7 +1118,7 @@ var require_sessions = __commonJS({
     var DEFAULT_MAX_AGE_DAYS = 30;
     function scrubSecrets(text) {
       if (typeof text !== "string" || text.length === 0) return text;
-      return text.replace(/\bsk-or-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bxai-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]").replace(/\bAIza[0-9A-Za-z_-]{35,}/g, "[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Bearer [REDACTED]");
+      return text.replace(/\bsk-or-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bxai-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]").replace(/\bAIza[0-9A-Za-z_-]{35,}/g, "[REDACTED]").replace(/\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:)[^\s@/]{6,}@/gi, "$1[REDACTED]@").replace(/\bToken\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Token [REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Bearer [REDACTED]");
     }
     function capText(text) {
       if (typeof text !== "string") return text;
@@ -2139,6 +2202,7 @@ var require_gemini = __commonJS({
     var DEFAULT_RECOVERY_GRACE_MS = 12e4;
     var MAX_MS = 6e5;
     var VALID_SANDBOX_VALUES = /* @__PURE__ */ new Set(["read-only", "workspace-write"]);
+    var THREAD_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,127}$/;
     function goDuration(ms) {
       return Math.ceil(ms / 1e3) + "s";
     }
@@ -2162,10 +2226,14 @@ ${prompt}`;
       return args;
     }
     var ADVISORY_ENV_SCRUB = ["GITHUB_TOKEN", "GH_TOKEN", "GIT_ASKPASS", "SSH_AUTH_SOCK"];
+    var CREDENTIAL_NAME_RE = /(?:^|_)(?:KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS)$|API_KEY|ACCESS_KEY|SESSION_TOKEN|PRIVATE_KEY/i;
     function advisoryEnv(env) {
       const out = { ...env };
       delete out.DELIBERATION_DISABLE_OS_SANDBOX;
       for (const k of ADVISORY_ENV_SCRUB) delete out[k];
+      for (const k of Object.keys(out)) {
+        if (CREDENTIAL_NAME_RE.test(k)) delete out[k];
+      }
       return out;
     }
     function seatbeltLiteral(p) {
@@ -2286,7 +2354,8 @@ ${prompt}`;
           real = fs.realpathSync(resolved);
         } catch (_) {
         }
-        return map[real] ?? map[resolved] ?? map[cwd] ?? null;
+        const candidate = map[real] ?? map[resolved] ?? map[cwd] ?? null;
+        return typeof candidate === "string" && THREAD_ID_RE.test(candidate) ? candidate : null;
       } catch (_) {
         return null;
       }
@@ -2611,8 +2680,8 @@ ${prompt}`;
               return;
             }
             const threadId2 = args.threadId.trim();
-            if (threadId2 === "" || threadId2 === "latest" || threadId2 === "unknown") {
-              if (shouldRespond) sendError(id, -32602, "Invalid params: 'threadId' must be an explicit conversation id, not '" + threadId2 + "'");
+            if (!THREAD_ID_RE.test(threadId2) || threadId2 === "latest" || threadId2 === "unknown") {
+              if (shouldRespond) sendError(id, -32602, "Invalid params: 'threadId' must be an explicit conversation id (alphanumeric/underscore start, then [A-Za-z0-9_-], 1..128 chars)");
               return;
             }
             if (!isNonEmptyString(args.prompt)) {
@@ -2709,6 +2778,7 @@ ${prompt}`;
       module2.exports.READ_ONLY_GUARD = READ_ONLY_GUARD;
       module2.exports.applyReadOnlyGuard = applyReadOnlyGuard;
       module2.exports.advisoryEnv = advisoryEnv;
+      module2.exports.THREAD_ID_RE = THREAD_ID_RE;
       module2.exports.buildSeatbeltProfile = buildSeatbeltProfile;
       module2.exports.buildSpawnCommand = buildSpawnCommand;
       module2.exports.diffGitState = diffGitState;
@@ -2743,7 +2813,7 @@ var require_lock = __commonJS({
         try {
           fs.mkdirSync(lockDir);
           const markerPath = path.join(lockDir, markerName);
-          fs.writeFileSync(markerPath, JSON.stringify({ pid: process.pid, token, t: Date.now() }));
+          fs.writeFileSync(markerPath, JSON.stringify({ pid: process.pid, token, t: Date.now() }), { mode: 384 });
           return { lockDir, markerPath, token };
         } catch (e) {
           if (e.code !== "EEXIST") throw e;
@@ -2837,7 +2907,7 @@ var require_cache = __commonJS({
     function writeCache(file, data) {
       mkdirSync(path.dirname(file), { recursive: true });
       const tmp = `${file}.tmp.${process.pid}.${Date.now()}`;
-      writeFileSync(tmp, JSON.stringify(data));
+      writeFileSync(tmp, JSON.stringify(data), { mode: 384 });
       renameSync(tmp, file);
     }
     var _inflight = /* @__PURE__ */ new Map();
@@ -3008,6 +3078,8 @@ var require_glob = __commonJS({
             if (!matches(includeRes, relPosix)) continue;
             files.push({ rel: relPosix, abs: realTarget, size: st.size });
             totalBytes += st.size;
+            if (files.length > maxFiles) throw new Error(`directory expansion exceeded maxFiles=${maxFiles}. Narrow include or raise the limit.`);
+            if (totalBytes > maxBytes) throw new Error(`directory expansion exceeded maxBytes=${maxBytes} bytes. Narrow include or raise the limit.`);
           } else if (ent.isDirectory()) {
             if (matches(excludeRes, relPosix) || matches(excludeRes, relPosix + "/**")) continue;
             descend(absChild, relPosix);
@@ -3022,6 +3094,8 @@ var require_glob = __commonJS({
             }
             files.push({ rel: relPosix, abs: absChild, size: st.size });
             totalBytes += st.size;
+            if (files.length > maxFiles) throw new Error(`directory expansion exceeded maxFiles=${maxFiles}. Narrow include or raise the limit.`);
+            if (totalBytes > maxBytes) throw new Error(`directory expansion exceeded maxBytes=${maxBytes} bytes. Narrow include or raise the limit.`);
           }
         }
       }
@@ -3346,7 +3420,8 @@ ${ref.inline_text}` });
           res = await f(`${base}/files`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${apiKey}` },
-            body: form
+            body: form,
+            redirect: "error"
           });
         } catch (err) {
           const e = new Error(`File upload network error: ${err && err.message || err}`);
@@ -3536,7 +3611,8 @@ ${ref.inline_text}` });
             "Authorization": `Bearer ${apiKey}`
           },
           body: JSON.stringify(payload),
-          signal: controller.signal
+          signal: controller.signal,
+          redirect: "error"
         });
       } catch (err) {
         const name = err && err.name;
@@ -4263,7 +4339,7 @@ var require_openrouter = __commonJS({
       const timer = setTimeout(() => controller.abort(), t);
       let res;
       try {
-        res = await f(url, { method: "POST", headers, body: JSON.stringify(payload), signal: controller.signal });
+        res = await f(url, { method: "POST", headers, body: JSON.stringify(payload), signal: controller.signal, redirect: "error" });
       } catch (err) {
         const msg = String(err && err.message || err);
         if (err && err.name === "AbortError" || /abort/i.test(msg)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antonbabenko/deliberation-mcp",
-  "version": "3.6.0",
+  "version": "3.6.2",
   "description": "Deliberation for Claude Code and any MCP host - GPT, Gemini, Grok, and OpenRouter expert subagents.",
   "mcpName": "io.github.antonbabenko/deliberation",
   "repository": { "type": "git", "url": "git+https://github.com/antonbabenko/deliberation.git", "directory": "server/mcp" },