@antonbabenko/deliberation-mcp 3.6.1 → 3.7.0

package/dist/index.js

@@ -241,7 +241,10 @@ var require_provider = __commonJS({
     var STRIP_TRAIL = /[*_`~\s]+$/;
     var HEADING_RE = /^#{1,6}\s/;
     function normVerdict(tok) {
-      return tok.replace(/\s+/g, "_").toUpperCase();
+      return (
+        /** @type {any} */
+        tok.replace(/\s+/g, "_").toUpperCase()
+      );
     }
     function parseReview(text) {
       const raw = safeString(text);
@@ -259,36 +262,24 @@ var require_provider = __commonJS({
     function resolveVerdict(lines) {
       for (const ln of lines) {
         const m = ln.match(SENTINEL_RE);
-        if (m) return (
-          /** @type {any} */
-          normVerdict(m[1])
-        );
+        if (m) return normVerdict(m[1]);
       }
       for (const ln of lines) {
         const m = ln.match(VERDICT_RE);
-        if (m) return (
-          /** @type {any} */
-          normVerdict(m[1])
-        );
+        if (m) return normVerdict(m[1]);
       }
       for (let i = 0; i < lines.length; i++) {
         if (!VERDICT_WORD_RE.test(lines[i].trim())) continue;
         for (let j = i + 1; j < lines.length && j <= i + 3; j++) {
           const t = lines[j].replace(MD_EMPHASIS, "").trim();
           if (!t) continue;
-          if (TOKEN_LINE_RE.test(t)) return (
-            /** @type {any} */
-            normVerdict(t)
-          );
+          if (TOKEN_LINE_RE.test(t)) return normVerdict(t);
           break;
         }
       }
-      for (const ln of lines) {
-        const t = ln.replace(MD_EMPHASIS, "").trim();
-        if (TOKEN_LINE_RE.test(t)) return (
-          /** @type {any} */
-          normVerdict(t)
-        );
+      const nonEmpty = lines.map((l) => l.replace(MD_EMPHASIS, "").trim()).filter((t) => t !== "");
+      for (const t of [nonEmpty[0], nonEmpty[nonEmpty.length - 1]]) {
+        if (t && TOKEN_LINE_RE.test(t)) return normVerdict(t);
       }
       return null;
     }
@@ -345,6 +336,7 @@ var require_consensus_loop = __commonJS({
     "use strict";
     var MAX_ROUNDS_DEFAULT = 5;
     var VERDICTS = Object.freeze(["APPROVE", "REQUEST_CHANGES", "REJECT"]);
+    var REVIEW_FORMAT_INSTRUCTION = "End with a line by itself in exactly this form (no markdown, token on the SAME line): VERDICT: APPROVE   (or VERDICT: REQUEST_CHANGES, or VERDICT: REJECT). Then list any critical issues, one per line as: - [category] description   where category is one of security, correctness, scope, ambiguity, performance, ops.";
     function assertStatus(state, expected, op) {
       if (state.status !== expected) {
         throw new Error(`${op}: expected status '${expected}', got '${state.status}'`);
@@ -387,12 +379,12 @@ ${state.currentPlan}`
       const peerPrompt = [
         body,
         "Review the plan for correctness, security, scope, ambiguity, performance, and ops gaps.",
-        "End with a line by itself in exactly this form (no markdown, token on the SAME line): VERDICT: APPROVE   (or VERDICT: REQUEST_CHANGES, or VERDICT: REJECT). Then list any critical issues, one per line as: - [category] description   where category is one of security, correctness, scope, ambiguity, performance, ops."
+        REVIEW_FORMAT_INSTRUCTION
       ].join("\n\n");
       const blindPrompt = [
         body,
         "Give your own independent verdict BEFORE seeing peer opinions.",
-        "End with a line by itself in exactly this form (no markdown, token on the SAME line): VERDICT: APPROVE   (or VERDICT: REQUEST_CHANGES, or VERDICT: REJECT). Then list any critical issues, one per line as: - [category] description   where category is one of security, correctness, scope, ambiguity, performance, ops."
+        REVIEW_FORMAT_INSTRUCTION
       ].join("\n\n");
       return { peerPrompt, blindPrompt };
     }
@@ -1118,7 +1110,7 @@ var require_sessions = __commonJS({
     var DEFAULT_MAX_AGE_DAYS = 30;
     function scrubSecrets(text) {
       if (typeof text !== "string" || text.length === 0) return text;
-      return text.replace(/\bsk-or-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bxai-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]").replace(/\bAIza[0-9A-Za-z_-]{35,}/g, "[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Bearer [REDACTED]");
+      return text.replace(/\bsk-or-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bxai-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]").replace(/\bAIza[0-9A-Za-z_-]{35,}/g, "[REDACTED]").replace(/\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:)[^\s@/]{6,}@/gi, "$1[REDACTED]@").replace(/\bToken\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Token [REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Bearer [REDACTED]");
     }
     function capText(text) {
       if (typeof text !== "string") return text;
@@ -1699,24 +1691,27 @@ var require_antigravity = __commonJS({
       );
       if (!bridge) throw new Error("makeAntigravityProvider requires opts.bridge (core is transport-agnostic; inject the gemini bridge)");
       const model = opts.model || process.env.GEMINI_DEFAULT_MODEL || "auto-gemini-3";
+      const allowImplement = opts.allowImplement === true;
       return {
         name: "gemini",
-        capabilities: { canImplement: true, fileUpload: false, multiTurn: true, walksFilesystem: true },
+        // canImplement reflects the construction lock so discovery (panel) is honest about THIS process.
+        capabilities: { canImplement: allowImplement, fileUpload: false, multiTurn: true, walksFilesystem: true },
         async health() {
           return typeof bridge.runGemini === "function" ? { ok: true } : { ok: false, reason: "agy bridge unavailable" };
         },
         async ask(req) {
           const started = Date.now();
+          const implement = allowImplement && req.mode === "implement";
           const includeDirs = (req.files || []).filter((f) => f.dir).map((f) => f.dir);
           const args = bridge.buildAgyArgs({
             prompt: req.prompt,
             model,
-            sandbox: "read-only",
+            sandbox: implement ? "workspace-write" : "read-only",
             developerInstructions: req.developerInstructions,
             includeDirs
           });
           try {
-            const out = await bridge.runGemini(args, req.cwd, req.timeoutMs, void 0, { readOnly: true, includeDirs });
+            const out = await bridge.runGemini(args, req.cwd, req.timeoutMs, void 0, { readOnly: !implement, includeDirs });
             return { provider: "gemini", model, text: out.response || "", threadId: out.threadId, isError: false, ms: Date.now() - started, reasoningEffort: null, ...out.workspaceMutated ? { workspaceMutated: true } : {} };
           } catch (e) {
             const err = (
@@ -1751,12 +1746,13 @@ var require_codex = __commonJS({
       if (s.includes("rate")) return { errorKind: "rate-limit", retryable: true };
       return { errorKind: "unknown", retryable: false };
     }
-    function codexExecArgs() {
-      return ["exec", "--sandbox", "read-only", "--skip-git-repo-check"];
+    function codexExecArgs(mode) {
+      const sandbox = mode === "implement" ? "workspace-write" : "read-only";
+      return ["exec", "--sandbox", sandbox, "--skip-git-repo-check"];
     }
-    function defaultRun({ prompt, cwd, timeoutMs }) {
+    function defaultRun({ prompt, cwd, timeoutMs, mode }) {
       return new Promise((resolve) => {
-        const child = spawn("codex", codexExecArgs(), { cwd: cwd || process.cwd() });
+        const child = spawn("codex", codexExecArgs(mode), { cwd: cwd || process.cwd() });
         let stdout = "", stderr = "", settled = false;
         const timer = timeoutMs ? setTimeout(() => child.kill("SIGKILL"), timeoutMs) : null;
         if (timer) timer.unref();
@@ -1780,21 +1776,24 @@ var require_codex = __commonJS({
     function makeCodexProvider(opts = {}) {
       const run = opts.run || defaultRun;
       const model = opts.model || "default";
+      const allowImplement = opts.allowImplement === true;
       return {
         name: "codex",
-        capabilities: { canImplement: true, fileUpload: false, multiTurn: false, walksFilesystem: true },
-        // Option A: no threadId continuity
+        // canImplement reflects the construction lock so discovery (panel) is honest about THIS
+        // process. Option A: no threadId continuity (multiTurn:false).
+        capabilities: { canImplement: allowImplement, fileUpload: false, multiTurn: false, walksFilesystem: true },
         async health() {
           return { ok: true };
         },
         async ask(req) {
           const started = Date.now();
+          const mode = allowImplement && req.mode === "implement" ? "implement" : "advisory";
           const full = req.developerInstructions ? `${req.developerInstructions}
 
 ---
 
 ${req.prompt}` : req.prompt;
-          const { code, stdout, stderr } = await run({ prompt: full, cwd: req.cwd, timeoutMs: req.timeoutMs });
+          const { code, stdout, stderr } = await run({ prompt: full, cwd: req.cwd, timeoutMs: req.timeoutMs, mode });
           if (code === 0) {
             return { provider: "codex", model, text: stdout.trim(), isError: false, ms: Date.now() - started, reasoningEffort: null };
           }
@@ -2202,6 +2201,7 @@ var require_gemini = __commonJS({
     var DEFAULT_RECOVERY_GRACE_MS = 12e4;
     var MAX_MS = 6e5;
     var VALID_SANDBOX_VALUES = /* @__PURE__ */ new Set(["read-only", "workspace-write"]);
+    var THREAD_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,127}$/;
     function goDuration(ms) {
       return Math.ceil(ms / 1e3) + "s";
     }
@@ -2224,11 +2224,15 @@ ${prompt}`;
       args.push("-p", prompt);
       return args;
     }
-    var ADVISORY_ENV_SCRUB = ["GITHUB_TOKEN", "GH_TOKEN", "GIT_ASKPASS", "SSH_AUTH_SOCK"];
+    var ADVISORY_ENV_SCRUB = ["GIT_ASKPASS", "SSH_AUTH_SOCK"];
+    var CREDENTIAL_NAME_RE = /(?:^|_)(?:KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS)$|API_KEY|ACCESS_KEY|SESSION_TOKEN|PRIVATE_KEY/i;
     function advisoryEnv(env) {
       const out = { ...env };
       delete out.DELIBERATION_DISABLE_OS_SANDBOX;
       for (const k of ADVISORY_ENV_SCRUB) delete out[k];
+      for (const k of Object.keys(out)) {
+        if (CREDENTIAL_NAME_RE.test(k)) delete out[k];
+      }
       return out;
     }
     function seatbeltLiteral(p) {
@@ -2349,7 +2353,8 @@ ${prompt}`;
           real = fs.realpathSync(resolved);
         } catch (_) {
         }
-        return map[real] ?? map[resolved] ?? map[cwd] ?? null;
+        const candidate = map[real] ?? map[resolved] ?? map[cwd] ?? null;
+        return typeof candidate === "string" && THREAD_ID_RE.test(candidate) ? candidate : null;
       } catch (_) {
         return null;
       }
@@ -2391,7 +2396,10 @@ ${prompt}`;
           process.stderr.write("[deliberation] agy read-only run wrapped in sandbox-exec (workspace writes denied)\n");
         }
         const agyProcess = spawn(spawnPlan.cmd, spawnPlan.argv, {
-          env: readOnly ? advisoryEnv(process.env) : process.env,
+          // Scrub credentials in BOTH read-only and workspace-write runs. A write run
+          // legitimately mutates the worktree but still has no need for the operator's
+          // API keys / GIT_ASKPASS / SSH_AUTH_SOCK - the human commits and pushes, not agy.
+          env: advisoryEnv(process.env),
           shell: false,
           cwd: effCwd,
           // agy -p (print mode) waits for stdin EOF before returning; if the stdin
@@ -2674,8 +2682,8 @@ ${prompt}`;
               return;
             }
             const threadId2 = args.threadId.trim();
-            if (threadId2 === "" || threadId2 === "latest" || threadId2 === "unknown") {
-              if (shouldRespond) sendError(id, -32602, "Invalid params: 'threadId' must be an explicit conversation id, not '" + threadId2 + "'");
+            if (!THREAD_ID_RE.test(threadId2) || threadId2 === "latest" || threadId2 === "unknown") {
+              if (shouldRespond) sendError(id, -32602, "Invalid params: 'threadId' must be an explicit conversation id (alphanumeric/underscore start, then [A-Za-z0-9_-], 1..128 chars)");
               return;
             }
             if (!isNonEmptyString(args.prompt)) {
@@ -2772,6 +2780,7 @@ ${prompt}`;
       module2.exports.READ_ONLY_GUARD = READ_ONLY_GUARD;
       module2.exports.applyReadOnlyGuard = applyReadOnlyGuard;
       module2.exports.advisoryEnv = advisoryEnv;
+      module2.exports.THREAD_ID_RE = THREAD_ID_RE;
       module2.exports.buildSeatbeltProfile = buildSeatbeltProfile;
       module2.exports.buildSpawnCommand = buildSpawnCommand;
       module2.exports.diffGitState = diffGitState;
@@ -2806,7 +2815,7 @@ var require_lock = __commonJS({
         try {
           fs.mkdirSync(lockDir);
           const markerPath = path.join(lockDir, markerName);
-          fs.writeFileSync(markerPath, JSON.stringify({ pid: process.pid, token, t: Date.now() }));
+          fs.writeFileSync(markerPath, JSON.stringify({ pid: process.pid, token, t: Date.now() }), { mode: 384 });
           return { lockDir, markerPath, token };
         } catch (e) {
           if (e.code !== "EEXIST") throw e;
@@ -2900,7 +2909,7 @@ var require_cache = __commonJS({
     function writeCache(file, data) {
       mkdirSync(path.dirname(file), { recursive: true });
       const tmp = `${file}.tmp.${process.pid}.${Date.now()}`;
-      writeFileSync(tmp, JSON.stringify(data));
+      writeFileSync(tmp, JSON.stringify(data), { mode: 384 });
       renameSync(tmp, file);
     }
     var _inflight = /* @__PURE__ */ new Map();
@@ -3038,6 +3047,12 @@ var require_glob = __commonJS({
         for (const c of res) if (c.re.test(rel)) return true;
         return false;
       }
+      function pushFile(rel, abs, size) {
+        files.push({ rel, abs, size });
+        totalBytes += size;
+        if (files.length > maxFiles) throw new Error(`directory expansion exceeded maxFiles=${maxFiles}. Narrow include or raise the limit.`);
+        if (totalBytes > maxBytes) throw new Error(`directory expansion exceeded maxBytes=${maxBytes} bytes. Narrow include or raise the limit.`);
+      }
       function descend(absDir, relDir) {
         let entries;
         try {
@@ -3069,8 +3084,7 @@ var require_glob = __commonJS({
             if (!st.isFile()) continue;
             if (matches(excludeRes, relPosix)) continue;
             if (!matches(includeRes, relPosix)) continue;
-            files.push({ rel: relPosix, abs: realTarget, size: st.size });
-            totalBytes += st.size;
+            pushFile(relPosix, realTarget, st.size);
           } else if (ent.isDirectory()) {
             if (matches(excludeRes, relPosix) || matches(excludeRes, relPosix + "/**")) continue;
             descend(absChild, relPosix);
@@ -3083,18 +3097,11 @@ var require_glob = __commonJS({
             } catch (_) {
               continue;
             }
-            files.push({ rel: relPosix, abs: absChild, size: st.size });
-            totalBytes += st.size;
+            pushFile(relPosix, absChild, st.size);
           }
         }
       }
       descend(rootAbs, "");
-      if (files.length > maxFiles) {
-        throw new Error(`directory expansion selected ${files.length} files; exceeds maxFiles=${maxFiles}. Narrow include or raise the limit.`);
-      }
-      if (totalBytes > maxBytes) {
-        throw new Error(`directory expansion selected ${totalBytes} bytes; exceeds maxBytes=${maxBytes}. Narrow include or raise the limit.`);
-      }
       files.sort((a, b) => a.rel.localeCompare(b.rel, "en"));
       return { files, totalBytes };
     }
@@ -3409,7 +3416,8 @@ ${ref.inline_text}` });
           res = await f(`${base}/files`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${apiKey}` },
-            body: form
+            body: form,
+            redirect: "error"
           });
         } catch (err) {
           const e = new Error(`File upload network error: ${err && err.message || err}`);
@@ -3599,7 +3607,8 @@ ${ref.inline_text}` });
             "Authorization": `Bearer ${apiKey}`
           },
           body: JSON.stringify(payload),
-          signal: controller.signal
+          signal: controller.signal,
+          redirect: "error"
         });
       } catch (err) {
         const name = err && err.name;
@@ -4326,7 +4335,7 @@ var require_openrouter = __commonJS({
       const timer = setTimeout(() => controller.abort(), t);
       let res;
       try {
-        res = await f(url, { method: "POST", headers, body: JSON.stringify(payload), signal: controller.signal });
+        res = await f(url, { method: "POST", headers, body: JSON.stringify(payload), signal: controller.signal, redirect: "error" });
       } catch (err) {
         const msg = String(err && err.message || err);
         if (err && err.name === "AbortError" || /abort/i.test(msg)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antonbabenko/deliberation-mcp",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "description": "Deliberation for Claude Code and any MCP host - GPT, Gemini, Grok, and OpenRouter expert subagents.",
   "mcpName": "io.github.antonbabenko/deliberation",
   "repository": { "type": "git", "url": "git+https://github.com/antonbabenko/deliberation.git", "directory": "server/mcp" },