@dypai-ai/mcp 1.7.2 → 1.7.4

package/src/tools/sync/planner.js

@@ -16,6 +16,7 @@ import { deserializeEndpoint, serializeEndpoint } from "./codec.js"
 import {
   runEffectiveWorkflows,
 } from "../../lib/effective-workflows-runner.js"
+import { findEndpointNameCollisions } from "./endpoint-names.js"
 
 const ENDPOINT_NAME_RE = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/
 
@@ -71,27 +72,51 @@ export async function readLocalStateSnapshot(rootDir) {
   }
 }
 
+export function mergeLocalStateSnapshot({ currentState, rows, endpointResults, projectId, now = new Date() }) {
+  const compatibleState = currentState?.project_id === projectId ? currentState : null
+  const endpoints = { ...(compatibleState?.endpoints || {}) }
+  const unresolvedEndpoints = { ...(compatibleState?.unresolved_endpoints || {}) }
+  const rowsByName = Object.fromEntries((rows || []).map((row) => [row.name, row]))
+
+  for (const result of endpointResults || []) {
+    if (result?.resource_type && result.resource_type !== "endpoint") continue
+    const name = result?.name
+    if (!name) continue
+    if (result.action === "delete") {
+      delete endpoints[name]
+      delete unresolvedEndpoints[name]
+      continue
+    }
+    const row = rowsByName[name]
+    if (!row) continue
+    endpoints[name] = { id: row.id, updated_at: row.updated_at, revision: row.revision }
+    delete unresolvedEndpoints[name]
+  }
+
+  return {
+    pulled_at: compatibleState?.pulled_at || null,
+    refreshed_at: now.toISOString(),
+    project_id: projectId,
+    endpoints,
+    unresolved_endpoints: unresolvedEndpoints,
+  }
+}
+
 /**
- * Refresh .dypai/state.json from live remote endpoint timestamps.
- * Call after publish/deploy so the next push does not see phantom conflicts.
+ * Merge only the endpoints that a publish response proves were promoted.
+ * A project-wide timestamp refresh is unsafe after a scoped push: unrelated
+ * local files may still be stale and must keep their previous/unresolved
+ * baseline so the next push can block correctly.
  */
-export async function refreshLocalStateSnapshot({ projectId, rootDir }) {
-  if (!projectId || !rootDir) return null
+export async function refreshLocalStateSnapshot({ projectId, rootDir, endpointResults = [] }) {
+  if (!projectId || !rootDir || !endpointResults.length) return null
   const rows = await execSql(projectId, `
-      SELECT id, name, updated_at
+      SELECT id, name, updated_at, revision
       FROM system.endpoints
       ORDER BY name
     `)
-  const successfullyPulledIds = new Set(rows.map((row) => row.id))
-  const state = {
-    pulled_at: new Date().toISOString(),
-    project_id: projectId,
-    endpoints: Object.fromEntries(
-      rows
-        .filter((row) => successfullyPulledIds.has(row.id))
-        .map((row) => [row.name, { id: row.id, updated_at: row.updated_at }]),
-    ),
-  }
+  const currentState = await readLocalStateSnapshot(rootDir)
+  const state = mergeLocalStateSnapshot({ currentState, rows, endpointResults, projectId })
   const statePath = join(rootDir, ".dypai", "state.json")
   await mkdir(join(rootDir, ".dypai"), { recursive: true })
   await writeFile(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8")
@@ -166,7 +191,7 @@ export async function fetchRemoteState(projectId) {
   const endpoints = await execSql(projectId, `
       SELECT id, name, method, description, workflow_code, input, output,
              allowed_roles, is_tool, tool_description, group_id, is_active,
-             response_cardinality, updated_at
+             response_cardinality, updated_at, revision
       FROM system.endpoints
       ORDER BY name
     `)
@@ -507,21 +532,13 @@ export async function readLocalEffectiveState(rootDir, projectId = null, deps =
     byName[payload.name] = {
       source: "flow",
       file,
+      group: payload.group_name || null,
       pushPayload: payload,
       ...(shadowedMeta ? { shadowed: shadowedMeta } : {}),
     }
     if (shadowedMeta) shadowed.push({ name: payload.name, shadowed: shadowedMeta })
   }
 
-  for (const diagnostic of diagnostics) {
-    if (diagnostic?.severity !== "error") continue
-    yamlState.errors.push({
-      file: diagnostic.file || diagnostic.endpoint,
-      error: diagnostic.message || "Failed to build flow push payload",
-      rule: diagnostic.rule || "flow_push_payload_failed",
-    })
-  }
-
   for (const item of rejected) {
     if (!isBackendSourcePath(item?.path)) continue
     yamlState.errors.push({
@@ -536,7 +553,14 @@ export async function readLocalEffectiveState(rootDir, projectId = null, deps =
     byName[name] = { ...entry, source: "legacy-yaml" }
   }
 
-  return { byName, errors: yamlState.errors, shadowed, runnerWarning: null, automations: bulkResult.data?.automations ?? null }
+  return {
+    byName,
+    errors: yamlState.errors,
+    shadowed,
+    runnerWarning: null,
+    compilerDiagnostics: diagnostics,
+    automations: bulkResult.data?.automations ?? null,
+  }
 }
 
 // ─── Normalization + diff ──────────────────────────────────────────────────
@@ -703,19 +727,36 @@ function findMissingCredentials(doc, credNameToId) {
  * was pulled at time T and its remote updated_at is now > T, someone modified
  * it out-of-band since the pull. Report these so the user can pull first.
  */
-function detectConflicts(stateSnapshot, remoteByName) {
+export function detectConflicts(stateSnapshot, remoteByName) {
   if (!stateSnapshot?.endpoints) return []
   const conflicts = []
+  for (const [name, unresolved] of Object.entries(stateSnapshot.unresolved_endpoints || {})) {
+    if (!remoteByName[name]) continue
+    conflicts.push({
+      endpoint: name,
+      snapshot_at: null,
+      remote_updated_at: remoteByName[name]?.updated_at || unresolved.remote_updated_at,
+      remote_revision: remoteByName[name]?.revision || unresolved.remote_revision,
+      reason: unresolved.reason || "local_source_not_reconciled",
+      local_file: unresolved.file,
+    })
+  }
   for (const [name, snap] of Object.entries(stateSnapshot.endpoints)) {
+    if (stateSnapshot.unresolved_endpoints?.[name]) continue
     const remote = remoteByName[name]
     if (!remote) continue
     const snapT = snap.updated_at ? new Date(snap.updated_at).getTime() : 0
     const remoteT = remote.updated_at ? new Date(remote.updated_at).getTime() : 0
-    if (remoteT > snapT + 1000) { // 1s tolerance for clock skew
+    const snapRevision = Number(snap.revision || 0)
+    const remoteRevision = Number(remote.revision || 0)
+    const revisionChanged = snapRevision > 0 && remoteRevision > 0 && remoteRevision !== snapRevision
+    if (revisionChanged || remoteT > snapT + 1000) { // timestamp fallback for old snapshots
       conflicts.push({
         endpoint: name,
         snapshot_at: snap.updated_at,
         remote_updated_at: remote.updated_at,
+        snapshot_revision: snapRevision || undefined,
+        remote_revision: remoteRevision || undefined,
       })
     }
   }
@@ -729,6 +770,17 @@ export function computePlan(local, remote, mapsCtx, { deleteOrphans = false, sta
   const plan = { create: [], update: [], delete: [], unchanged: [] }
   const warnings = []
 
+  const endpointNameCollisions = findEndpointNameCollisions(Object.keys(remote?.byName || {}))
+  if (endpointNameCollisions.length) {
+    warnings.push({
+      type: "canonical_endpoint_name_collisions",
+      count: endpointNameCollisions.length,
+      examples: endpointNameCollisions.slice(0, 25),
+      truncated: endpointNameCollisions.length > 25,
+      hint: "Legacy underscore and canonical hyphen slugs coexist remotely. They are separate APIs; audit callers before deleting either form.",
+    })
+  }
+
   // ── Groups plan ──────────────────────────────────────────────────────
   // Groups are 100% folder-driven: each first-level subfolder in endpoints/
   // IS a group. The remote is made to match the local folder structure
@@ -737,7 +789,7 @@ export function computePlan(local, remote, mapsCtx, { deleteOrphans = false, sta
   // group is re-created automatically. Zero friction.
   const localGroups = new Set()
   for (const entry of Object.values(local.byName)) {
-    const g = entry?.doc?.group
+    const g = entry?.group || entry?.doc?.group || entry?.pushPayload?.group_name
     if (g) localGroups.add(g)
   }
   const remoteGroupNames = new Set(Object.keys(mapsCtx.groupNameToId || {}))

package/src/tools/sync/pull.js

@@ -21,6 +21,7 @@ import { proxyToolCall } from "../proxy.js"
 import { api } from "../../api.js"
 import { serializeEndpoint } from "./codec.js"
 import { dumpPublicSchema } from "./schema-dump.js"
+import { findEndpointNameCollisions } from "./endpoint-names.js"
 // Codegen was removed from v1 — the agent reads dypai/schema.sql + endpoint YAMLs
 // directly instead of relying on auto-generated TS types. The codegen.js file
 // still lives on disk in case we resurface it later with a leaner design.
@@ -660,6 +661,10 @@ export function classifyFlowSourceWrite({ existingContent, remoteContent, clean
   return { action: "write" }
 }
 
+export function shouldSnapshotFlowSourceWrite(writeDecision) {
+  return writeDecision?.action === "write"
+}
+
 function parseMaybeJson(v) {
   if (v == null || typeof v !== "string") return v
   try { return JSON.parse(v) } catch { return v }
@@ -698,14 +703,23 @@ function renderYaml(doc) {
  *
  * Exported for unit testing.
  */
-export function buildStateSnapshot({ endpoints, successfullyPulledIds, projectId, now = new Date() }) {
+export function buildStateSnapshot({ endpoints, successfullyPulledIds, unresolvedEndpoints = [], projectId, now = new Date() }) {
   return {
     pulled_at: now.toISOString(),
     project_id: projectId,
     endpoints: Object.fromEntries(
       endpoints
         .filter(e => successfullyPulledIds.has(e.id))
-        .map(e => [e.name, { id: e.id, updated_at: e.updated_at }])
+        .map(e => [e.name, { id: e.id, updated_at: e.updated_at, revision: e.revision }])
+    ),
+    unresolved_endpoints: Object.fromEntries(
+      unresolvedEndpoints.map((item) => [item.endpoint, {
+        id: item.id,
+        remote_updated_at: item.remote_updated_at,
+        remote_revision: item.remote_revision,
+        file: item.file,
+        reason: item.reason || "local_source_differs",
+      }]),
     ),
   }
 }
@@ -787,7 +801,7 @@ export const dypaiPullTool = {
       execSql(project_id, `
         SELECT id, name, method, description, workflow_code, workflow, workflow_source,
                input, output, response_cardinality, allowed_roles, is_tool, tool_description,
-               group_id, is_active, updated_at
+               group_id, is_active, updated_at, revision
         FROM system.endpoints
         ORDER BY name
       `),
@@ -917,6 +931,7 @@ export const dypaiPullTool = {
     // conflict). Tracked by row id so endpoint renames at the same name
     // can't accidentally inherit a stale snapshot.
     const successfullyPulled = new Set()
+    const keptLocalEndpoints = []
 
     for (const rawRow of endpoints) {
       const row = hydrateRow(rawRow)
@@ -944,19 +959,29 @@ export const dypaiPullTool = {
             })
             if (writeDecision.action === "keep-local") {
               filesWritten.push(`(kept local ${relFlowPath})`)
+              keptLocalEndpoints.push({
+                endpoint: row.name,
+                id: row.id,
+                remote_updated_at: row.updated_at,
+                remote_revision: row.revision,
+                file: relFlowPath,
+                reason: "local_source_differs",
+              })
               errors.push({
                 endpoint: row.name,
                 error:
                   `Local ${relFlowPath} differs from persisted DYPAI source and was NOT overwritten. ` +
                   `Review/commit/stash local changes, or rerun dypai_pull with clean:true if you intentionally want the remote source.`,
               })
-              successfullyPulled.add(row.id)
+              // state.json is a baseline of bytes actually pulled from remote.
+              // Recording the remote timestamp while retaining stale local
+              // bytes would silence the next push conflict.
               continue
             }
 
             await writeFileEnsured(flowPath, flowContent)
             filesWritten.push(relFlowPath)
-            successfullyPulled.add(row.id)
+            if (shouldSnapshotFlowSourceWrite(writeDecision)) successfullyPulled.add(row.id)
             continue
           }
 
@@ -1063,6 +1088,7 @@ export const dypaiPullTool = {
     const state = buildStateSnapshot({
       endpoints,
       successfullyPulledIds: successfullyPulled,
+      unresolvedEndpoints: keptLocalEndpoints,
       projectId: resolvedProjectId,
     })
     await writeFileEnsured(join(outDir, ".dypai", "state.json"), JSON.stringify(state, null, 2) + "\n")
@@ -1085,6 +1111,7 @@ export const dypaiPullTool = {
     const inactiveEndpoints = (endpoints || [])
       .filter(e => e.is_active === false)
       .map(e => e.name)
+    const endpointNameCollisions = findEndpointNameCollisions(endpoints)
 
     // `environment` is an internal flag we still surface in `overview.project`
     // for diagnostics / dashboard parity, but the agent-facing copy uses the
@@ -1142,6 +1169,11 @@ export const dypaiPullTool = {
         by_group: byGroup,
         tool_endpoints: toolEndpoints,
         inactive_endpoints: inactiveEndpoints.length > 0 ? inactiveEndpoints : undefined,
+        canonical_name_collisions: endpointNameCollisions.length > 0 ? {
+          count: endpointNameCollisions.length,
+          items: endpointNameCollisions.slice(0, 50),
+          truncated: endpointNameCollisions.length > 50,
+        } : undefined,
       },
       credentials: (credentials || []).map(c => ({ name: c.name, type: c.type })),
       realtime_policies: (realtimePolicies || []).length,
@@ -1163,6 +1195,9 @@ export const dypaiPullTool = {
       success: errors.length === 0,
       endpoints: endpoints.length,
       files_written: filesWritten.length,
+      files_kept_local: keptLocalEndpoints.length,
+      kept_local_endpoints: keptLocalEndpoints.length ? keptLocalEndpoints : undefined,
+      name_collisions: endpointNameCollisions.length,
       output_dir: outDir,
       out_dir_resolved_via: outDirSource,
       // Surface count at top level too — agents that ignore `overview` (e.g.
@@ -1171,8 +1206,16 @@ export const dypaiPullTool = {
       overview,
       errors: errors.length ? errors : undefined,
       warning: suspiciousWarning || undefined,
+      safety_warnings: endpointNameCollisions.length ? [{
+        type: "canonical_endpoint_name_collisions",
+        count: endpointNameCollisions.length,
+        examples: endpointNameCollisions.slice(0, 10),
+        hint: "Legacy underscore and canonical hyphen slugs coexist. Treat them as separate live APIs; audit traffic and migrate/delete deliberately.",
+      }] : undefined,
       hint: errors.length
-        ? "Some endpoints failed to serialize. Check errors[] — usually malformed workflow_code."
+        ? keptLocalEndpoints.length
+          ? `${keptLocalEndpoints.length} local Flow file(s) differed and were kept. They were excluded from .dypai/state.json, so a later push will continue to block on remote drift. Review the files or rerun with clean:true only when remote is intentionally authoritative.`
+          : "Some endpoints failed to serialize. Check errors[] — usually malformed workflow_code."
         : suspiciousWarning
           ? "Files were written but the path looks wrong. See `warning` above and re-run with an absolute out_dir."
         : draftsTotal > 0