@edgehero/pi-dispatch-receiver 4.1.0 → 4.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-receiver",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "type": "module",
   "description": "The pi-dispatch trigger edge: verifies GitHub, GitLab, Forgejo and Azure DevOps webhooks, or polls GitHub with no public URL, and queues one pi coding agent job per event (per replica, if set) for the worker.",
   "keywords": [
@@ -48,7 +48,7 @@
   },
   "dependencies": {
     "@octokit/webhooks": "14.2.0",
-    "@edgehero/pi-dispatch": "^4.1.0",
+    "@edgehero/pi-dispatch": "^4.3.0",
     "bullmq": "5.80.4",
     "ioredis": "5.11.1"
   }

package/src/config.mjs

@@ -318,9 +318,9 @@ function loadTriggers(env, readFile, fileExists) {
 		}
 		const group = groups[run.kind];
 		if (on.type === "label") {
-			group.label.push({ index, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas, repository: run.repository });
+			group.label.push({ index, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, mcp: run.mcp, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, awaitInput: run.awaitInput, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas, repository: run.repository });
 		} else if (on.type === "comment") {
-			group.comment = { index, phrase: on.phrase, defaultFlow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas, repository: run.repository }; // parseTriggers guarantees at most one per forge
+			group.comment = { index, phrase: on.phrase, defaultFlow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, mcp: run.mcp, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, awaitInput: run.awaitInput, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas, repository: run.repository }; // parseTriggers guarantees at most one per forge
 		} else if (on.type === "pull_request") {
 			// The close-only split (issue #231): a close rule routes through the close gate (the CLOSER's
 			// resolved authority) and every other PR rule through the author gate, so they live in separate
@@ -329,17 +329,17 @@ function loadTriggers(env, readFile, fileExists) {
 			// split reads the SHARED close-word table, never a re-typed word.
 			const closeWord = PR_CLOSE_ACTIONS[run.kind];
 			if (closeWord !== undefined && on.action.includes(closeWord)) {
-				group.prClose.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas });
+				group.prClose.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, mcp: run.mcp, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, awaitInput: run.awaitInput, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas });
 			} else {
 				// `reviewStates` is null rather than an empty Set when unnarrowed: the filter tests it for
 				// presence, and an empty Set would read as "no verdict matches" and silently refuse everything.
-				group.pullRequest.push({ index, actions: new Set(on.action), reviewStates: on.reviewState ? new Set(on.reviewState) : null, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas });
+				group.pullRequest.push({ index, actions: new Set(on.action), reviewStates: on.reviewState ? new Set(on.reviewState) : null, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, mcp: run.mcp, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, awaitInput: run.awaitInput, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas });
 			}
 		} else if (on.type === "issue") {
 			// The close-trigger kind (issue #231). No predicate and no reviewStates by construction (the
 			// loader refused both), and `number`/`once` ride conditionally-present exactly as the loader
 			// normalized them -- the filter's close route reads them, nothing else does.
-			group.issue.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas });
+			group.issue.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, backend: run.backend, excludeTools: run.excludeTools, mcp: run.mcp, provider: run.provider, model: run.model, maxTurns: run.maxTurns, models: run.models, maxCostUsd: run.maxCostUsd, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, awaitInput: run.awaitInput, secrets: run.secrets, secretsProfile: run.secretsProfile, waitFor: run.waitFor, replicas: run.replicas });
 		}
 	}
 

package/src/filter-azure.mjs

@@ -27,6 +27,7 @@
 import { createHash } from "node:crypto";
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
 import { PR_COMMENT_EVENT, PR_EVENTS, WORK_ITEM_EVENTS } from "./azure-subset.mjs";
+import { hasParkedLabel } from "@edgehero/pi-dispatch/parked";
 
 /** The `pull_request` actions a trigger may name, mirrored from the loader's azure vocabulary. */
 export const PR_ACTION_FOR = {
@@ -117,6 +118,9 @@ export function filterAzure(subset, triggers, knownFlows, selfId, authorized, de
 		...(resolved.backend !== undefined ? { backend: resolved.backend } : {}),
 		// #291. A separate spread, filter.mjs's backend rule: a dropped exclusion runs the job WITH the tool.
 		...(resolved.excludeTools !== undefined ? { excludeTools: resolved.excludeTools } : {}),
+		// REQ-MCP-OPERATOR-SERVERS. Its own spread, the excludeTools rule above: a dropped list runs
+		// the job without its servers.
+		...(resolved.mcp !== undefined ? { mcp: resolved.mcp } : {}),
 		// #502. One spread PER FIELD, the excludeTools rule above: folded into one conditional, a trigger
 		// that named only a model would have its provider's absence decide whether the model survives,
 		// and a dropped model runs the job on the deployment default while the file reads as chosen.
@@ -140,6 +144,11 @@ export function filterAzure(subset, triggers, knownFlows, selfId, authorized, de
 		...(resolved.waitFor !== undefined ? { waitFor: resolved.waitFor } : {}),
 		...(resolved.instructions !== undefined ? { instructions: resolved.instructions } : {}),
 		...(resolved.resume !== undefined ? { resume: resolved.resume } : {}),
+		// REQ-AWAIT-INPUT (issue #625): whether the job may end awaiting a person's answer. Present only when armed,
+		// resume's rule, so an unflagged job's data stays byte-identical.
+		...(resolved.awaitInput === true ? { awaitInput: true } : {}),
+		// A phrase-free reply to a parked issue (issue #625): the worker gates it on the `parked` sidecar before any spend.
+		...(resolved.parkedReply === true ? { parkedReply: true } : {}),
 		// How many independent sandboxes race this flow (REQ-REPLICA-RUNS). At JOB level and conditional for the
 		// reasons filter.mjs states in full: receiver.mjs reads this to decide how many times to enqueue, and an
 		// unflagged job's data must stay byte-identical to today's.
@@ -203,7 +212,7 @@ function matchLabelRules(subset, triggers, labels, action) {
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		repository: rule.repository,
 		packages: rule.packages,
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -211,6 +220,7 @@ function matchLabelRules(subset, triggers, labels, action) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		matched: { index: rule.index, type: "label", label: matchedLabel(L, rule.predicate) },
 		target: { type: "issue", number: subset.target?.number, title: subset.target?.title, body: subset.target?.body },
@@ -221,7 +231,14 @@ function matchLabelRules(subset, triggers, labels, action) {
 function routeComment(subset, triggers, knownFlows, targetType) {
 	const phrase = triggers.comment?.phrase;
 	const body = subset.comment;
-	if (typeof phrase !== "string" || typeof body !== "string" || !body.includes(phrase)) {
+	const phraseHit = typeof phrase === "string" && typeof body === "string" && body.includes(phrase);
+	// A reply WITHOUT the phrase resumes a parked issue (issue #625, parked.mjs): only on an issue (a pull request's key
+	// needs its head branch, which costs a token to read, so its reply keeps the phrase), only when the comment
+	// trigger arms run.resume and is not a command, and only when the forge says the issue carries the marker. The
+	// author gate above already ran: this widens WHICH comments start a job, never WHO may. The marker is a hint; the
+	// worker refuses the job before any spend unless the key's `parked` sidecar exists.
+	const parkedReply = !phraseHit && typeof phrase === "string" && typeof body === "string" && triggers.comment?.resume === true && triggers.comment?.command === undefined && targetType === "issue" && hasParkedLabel(subset.tags);
+	if (!phraseHit && !parkedReply) {
 		return { enqueue: false, reason: "no-trigger-phrase" };
 	}
 	// On a COMMAND rule (issue #189) the flow-resolution block below -- default flow, the `<phrase> <flow>`
@@ -248,7 +265,7 @@ function routeComment(subset, triggers, knownFlows, targetType) {
 		...(command !== undefined ? { command } : { flow }),
 		repository: triggers.comment.repository,
 		packages: triggers.comment.packages,
-		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools,
+		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools, mcp: triggers.comment.mcp,
 		provider: triggers.comment.provider, model: triggers.comment.model, maxTurns: triggers.comment.maxTurns, models: triggers.comment.models, maxCostUsd: triggers.comment.maxCostUsd,
 		skillsDir: triggers.comment.skillsDir,
 		secrets: triggers.comment.secrets,
@@ -256,8 +273,10 @@ function routeComment(subset, triggers, knownFlows, targetType) {
 		waitFor: triggers.comment.waitFor,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
+		awaitInput: triggers.comment.awaitInput,
 		replicas: triggers.comment.replicas,
 		matched: { index: triggers.comment.index, type: "comment", phrase },
+		...(parkedReply && { parkedReply: true }),
 		// No author_association: Azure has none, and the authority that admitted this comment was resolved
 		// from the graph, not read off the body.
 		comment: { body },
@@ -282,7 +301,7 @@ function routePullRequest(subset, triggers, action) {
 			...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 			repository: rule.repository,
 			packages: rule.packages,
-			image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+			image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 			provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 			skillsDir: rule.skillsDir,
 			secrets: rule.secrets,
@@ -290,6 +309,7 @@ function routePullRequest(subset, triggers, action) {
 			waitFor: rule.waitFor,
 			instructions: rule.instructions,
 			resume: rule.resume,
+			awaitInput: rule.awaitInput,
 			replicas: rule.replicas,
 			matched: { index: rule.index, type: "pull_request", action },
 			target: {

package/src/filter-forgejo.mjs

@@ -36,6 +36,7 @@
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
 import { findCloseRule } from "./close.mjs";
 import { isRecognizedAction, mapAction } from "./forgejo-subset.mjs";
+import { hasParkedLabel } from "@edgehero/pi-dispatch/parked";
 
 const LABEL_ACTIONS = new Set(["opened", "labeled", "reopened"]);
 export const PR_ACTIONS = new Set(["labeled", "opened", "synchronize", "reopened"]);
@@ -131,6 +132,9 @@ export function filterForgejo(eventName, subset, triggers, knownFlows, selfId, a
 		...(resolved.backend !== undefined ? { backend: resolved.backend } : {}),
 		// #291. A separate spread, filter.mjs's backend rule: a dropped exclusion runs the job WITH the tool.
 		...(resolved.excludeTools !== undefined ? { excludeTools: resolved.excludeTools } : {}),
+		// REQ-MCP-OPERATOR-SERVERS. Its own spread, the excludeTools rule above: a dropped list runs
+		// the job without its servers.
+		...(resolved.mcp !== undefined ? { mcp: resolved.mcp } : {}),
 		// #502. One spread PER FIELD, the excludeTools rule above: folded into one conditional, a trigger
 		// that named only a model would have its provider's absence decide whether the model survives,
 		// and a dropped model runs the job on the deployment default while the file reads as chosen.
@@ -154,6 +158,11 @@ export function filterForgejo(eventName, subset, triggers, knownFlows, selfId, a
 		...(resolved.waitFor !== undefined ? { waitFor: resolved.waitFor } : {}),
 		...(resolved.instructions !== undefined ? { instructions: resolved.instructions } : {}),
 		...(resolved.resume !== undefined ? { resume: resolved.resume } : {}),
+		// REQ-AWAIT-INPUT (issue #625): whether the job may end awaiting a person's answer. Present only when armed,
+		// resume's rule, so an unflagged job's data stays byte-identical.
+		...(resolved.awaitInput === true ? { awaitInput: true } : {}),
+		// A phrase-free reply to a parked issue (issue #625): the worker gates it on the `parked` sidecar before any spend.
+		...(resolved.parkedReply === true ? { parkedReply: true } : {}),
 		// How many independent sandboxes race this flow (REQ-REPLICA-RUNS). At JOB level and conditional for the
 		// reasons filter.mjs states in full: receiver.mjs reads this to decide how many times to enqueue, and an
 		// unflagged job's data must stay byte-identical to today's.
@@ -183,7 +192,7 @@ function routeIssueLabel(subset, triggers) {
 		// A command rule (issue #189) skips flow resolution entirely: the label match IS the dispatch.
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -191,6 +200,7 @@ function routeIssueLabel(subset, triggers) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		matched: { index: rule.index, type: "label", label: matchedLabel(L, rule.predicate) },
 		target: { type: "issue", number: subset.issue?.number, title: subset.issue?.title, body: subset.issue?.body },
@@ -201,7 +211,14 @@ function routeIssueLabel(subset, triggers) {
 function routeComment(subset, triggers, knownFlows) {
 	const phrase = triggers.comment?.phrase;
 	const body = subset.comment?.body;
-	if (typeof phrase !== "string" || typeof body !== "string" || !body.includes(phrase)) {
+	const phraseHit = typeof phrase === "string" && typeof body === "string" && body.includes(phrase);
+	// A reply WITHOUT the phrase resumes a parked issue (issue #625, parked.mjs): only on an issue (a pull request's key
+	// needs its head branch, which costs a token to read, so its reply keeps the phrase), only when the comment
+	// trigger arms run.resume and is not a command, and only when the forge says the issue carries the marker. The
+	// author gate above already ran: this widens WHICH comments start a job, never WHO may. The marker is a hint; the
+	// worker refuses the job before any spend unless the key's `parked` sidecar exists.
+	const parkedReply = !phraseHit && typeof phrase === "string" && typeof body === "string" && triggers.comment?.resume === true && triggers.comment?.command === undefined && subset.isPull !== true && hasParkedLabel(subset.issue?.labels);
+	if (!phraseHit && !parkedReply) {
 		return { enqueue: false, reason: "no-trigger-phrase" };
 	}
 	// On a COMMAND rule (issue #189) the flow-resolution block below -- default flow, the `<phrase> <flow>`
@@ -233,7 +250,7 @@ function routeComment(subset, triggers, knownFlows) {
 		enqueue: true,
 		...(command !== undefined ? { command } : { flow }),
 		packages: triggers.comment.packages,
-		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools,
+		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools, mcp: triggers.comment.mcp,
 		provider: triggers.comment.provider, model: triggers.comment.model, maxTurns: triggers.comment.maxTurns, models: triggers.comment.models, maxCostUsd: triggers.comment.maxCostUsd,
 		skillsDir: triggers.comment.skillsDir,
 		secrets: triggers.comment.secrets,
@@ -241,8 +258,10 @@ function routeComment(subset, triggers, knownFlows) {
 		waitFor: triggers.comment.waitFor,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
+		awaitInput: triggers.comment.awaitInput,
 		replicas: triggers.comment.replicas,
 		matched: { index: triggers.comment.index, type: "comment", phrase },
+		...(parkedReply && { parkedReply: true }),
 		// The invoking comment rides on the trigger. No author_association: Forgejo has none, and the
 		// authority that admitted this comment was resolved from the API, not read off the body.
 		comment: { body: subset.comment.body },
@@ -265,7 +284,7 @@ function routePullRequest(subset, triggers, action) {
 			// A command rule (issue #189) skips flow resolution entirely: the rule match IS the dispatch.
 			...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 			packages: rule.packages,
-			image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+			image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 			provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 			skillsDir: rule.skillsDir,
 			secrets: rule.secrets,
@@ -273,6 +292,7 @@ function routePullRequest(subset, triggers, action) {
 			waitFor: rule.waitFor,
 			instructions: rule.instructions,
 			resume: rule.resume,
+			awaitInput: rule.awaitInput,
 			replicas: rule.replicas,
 			matched: { index: rule.index, type: "pull_request", action },
 			target: {
@@ -321,7 +341,7 @@ function routeIssueClose(subset, triggers, authorized) {
 		enqueue: true,
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -329,6 +349,7 @@ function routeIssueClose(subset, triggers, authorized) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		// `once: true` rides `matched` ONLY when armed (spreading false is a no-op), so the enqueue path
 		// can see a disarm is owed without re-reading the rule table -- and a plain close rule's matched
@@ -358,7 +379,7 @@ function routePullRequestClose(subset, triggers, authorized) {
 		enqueue: true,
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages,
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -366,6 +387,7 @@ function routePullRequestClose(subset, triggers, authorized) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		// No `number` on a PR close's matched record -- parallel to routePullRequest's, where the item
 		// number is the target's business; the issue route carries it because the github design does.

package/src/filter-gitlab.mjs

@@ -42,6 +42,7 @@
 
 import { firstMatchingRule, labelSet, matchedLabel } from "./predicate.mjs";
 import { findCloseRule } from "./close.mjs";
+import { hasParkedLabel } from "@edgehero/pi-dispatch/parked";
 
 /**
 /** The merge-request actions a trigger may name, mirrored from the loader's gitlab vocabulary. */
@@ -134,6 +135,9 @@ export function filterGitLab(subset, triggers, knownFlows, selfId, authorized, d
 		...(resolved.backend !== undefined ? { backend: resolved.backend } : {}),
 		// #291. A separate spread, filter.mjs's backend rule: a dropped exclusion runs the job WITH the tool.
 		...(resolved.excludeTools !== undefined ? { excludeTools: resolved.excludeTools } : {}),
+		// REQ-MCP-OPERATOR-SERVERS. Its own spread, the excludeTools rule above: a dropped list runs
+		// the job without its servers.
+		...(resolved.mcp !== undefined ? { mcp: resolved.mcp } : {}),
 		// #502. One spread PER FIELD, the excludeTools rule above: folded into one conditional, a trigger
 		// that named only a model would have its provider's absence decide whether the model survives,
 		// and a dropped model runs the job on the deployment default while the file reads as chosen.
@@ -159,6 +163,11 @@ export function filterGitLab(subset, triggers, knownFlows, selfId, authorized, d
 		// Conditional like packages/image, and for the same reason: an unflagged job's data must stay
 		// byte-identical to today's, so the key is absent rather than present-and-undefined.
 		...(resolved.resume !== undefined ? { resume: resolved.resume } : {}),
+		// REQ-AWAIT-INPUT (issue #625): whether the job may end awaiting a person's answer. Present only when armed,
+		// resume's rule, so an unflagged job's data stays byte-identical.
+		...(resolved.awaitInput === true ? { awaitInput: true } : {}),
+		// A phrase-free reply to a parked issue (issue #625): the worker gates it on the `parked` sidecar before any spend.
+		...(resolved.parkedReply === true ? { parkedReply: true } : {}),
 		// How many independent sandboxes race this flow (REQ-REPLICA-RUNS). At JOB level and conditional for the
 		// reasons filter.mjs states in full: receiver.mjs reads this to decide how many times to enqueue, and an
 		// unflagged job's data must stay byte-identical to today's.
@@ -193,7 +202,7 @@ function routeLabel(subset, triggers, targetType) {
 		// A command rule (issue #189) skips flow resolution entirely: the label match IS the dispatch.
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages,
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -201,6 +210,7 @@ function routeLabel(subset, triggers, targetType) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		matched: { index: rule.index, type: "label", label: matchedLabel(added, rule.predicate) },
 		target: buildTarget(subset, targetType),
@@ -258,7 +268,7 @@ function mrResult(subset, rule, matched) {
 		// A command rule (issue #189) skips flow resolution entirely: the rule match IS the dispatch.
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages,
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -266,6 +276,7 @@ function mrResult(subset, rule, matched) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		matched,
 		target: buildTarget(subset, "pull_request"),
@@ -305,7 +316,7 @@ function routeIssueClose(subset, triggers, authorized) {
 		enqueue: true,
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -313,6 +324,7 @@ function routeIssueClose(subset, triggers, authorized) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		// `once: true` rides `matched` ONLY when armed (spreading false is a no-op), so the enqueue path
 		// can see a disarm is owed without re-reading the rule table -- and a plain close rule's matched
@@ -340,7 +352,7 @@ function routeMergeRequestClose(subset, triggers, authorized) {
 		enqueue: true,
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages,
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -348,6 +360,7 @@ function routeMergeRequestClose(subset, triggers, authorized) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		// No `number` on an MR close's matched record -- parallel to routeMergeRequest's, where the item
 		// number is the target's business; the issue route carries it because the github design does.
@@ -367,7 +380,14 @@ function routeNote(subset, triggers, knownFlows) {
 
 	const phrase = triggers?.comment?.phrase;
 	const body = subset.note;
-	if (typeof phrase !== "string" || typeof body !== "string" || !body.includes(phrase)) {
+	const phraseHit = typeof phrase === "string" && typeof body === "string" && body.includes(phrase);
+	// A reply WITHOUT the phrase resumes a parked issue (issue #625, parked.mjs): only on an issue (a pull request's key
+	// needs its head branch, which costs a token to read, so its reply keeps the phrase), only when the comment
+	// trigger arms run.resume and is not a command, and only when the forge says the issue carries the marker. The
+	// author gate above already ran: this widens WHICH comments start a job, never WHO may. The marker is a hint; the
+	// worker refuses the job before any spend unless the key's `parked` sidecar exists.
+	const parkedReply = !phraseHit && typeof phrase === "string" && typeof body === "string" && triggers?.comment?.resume === true && triggers?.comment?.command === undefined && subset.noteableType !== "MergeRequest" && hasParkedLabel(subset.target?.labels);
+	if (!phraseHit && !parkedReply) {
 		return { enqueue: false, reason: "no-trigger-phrase" };
 	}
 	// On a COMMAND rule (issue #189) the flow-resolution block below -- default flow, the `<phrase> <flow>`
@@ -393,7 +413,7 @@ function routeNote(subset, triggers, knownFlows) {
 		enqueue: true,
 		...(command !== undefined ? { command } : { flow }),
 		packages: triggers.comment.packages,
-		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools,
+		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools, mcp: triggers.comment.mcp,
 		provider: triggers.comment.provider, model: triggers.comment.model, maxTurns: triggers.comment.maxTurns, models: triggers.comment.models, maxCostUsd: triggers.comment.maxCostUsd,
 		skillsDir: triggers.comment.skillsDir,
 		secrets: triggers.comment.secrets,
@@ -401,8 +421,10 @@ function routeNote(subset, triggers, knownFlows) {
 		waitFor: triggers.comment.waitFor,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
+		awaitInput: triggers.comment.awaitInput,
 		replicas: triggers.comment.replicas,
 		matched: { index: triggers.comment.index, type: "comment", phrase },
+		...(parkedReply && { parkedReply: true }),
 		target: buildTarget(subset, targetType),
 		// The invoking comment rides the job as DATA (CONST-ISSUE-TEXT-IS-DATA). No author_association
 		// counterpart exists on GitLab: the approval is the resolved access level, which is a harness

package/src/filter.mjs

@@ -47,6 +47,7 @@
  */
 import { findCloseRule } from "./close.mjs";
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
+import { hasParkedLabel } from "@edgehero/pi-dispatch/parked";
 
 const AUTHOR_ALLOWLIST = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 const LABEL_ACTIONS = new Set(["opened", "labeled", "reopened"]);
@@ -157,6 +158,9 @@ export function filter(eventName, subset, cfg, selfId, deliveryId, closerAuthori
 		// dropped exclusion runs the job WITH the tool, the destructive absence the loader's own sweep
 		// refuses a misspelling for, arriving through the plumbing instead of the spelling.
 		...(resolved.excludeTools !== undefined ? { excludeTools: resolved.excludeTools } : {}),
+		// REQ-MCP-OPERATOR-SERVERS. Its own spread, the excludeTools rule above: a dropped list runs
+		// the job without its servers.
+		...(resolved.mcp !== undefined ? { mcp: resolved.mcp } : {}),
 		// #502. One spread PER FIELD, the excludeTools rule above: folded into one conditional, a trigger
 		// that named only a model would have its provider's absence decide whether the model survives,
 		// and a dropped model runs the job on the deployment default while the file reads as chosen.
@@ -182,6 +186,11 @@ export function filter(eventName, subset, cfg, selfId, deliveryId, closerAuthori
 		// Conditional like packages/image, and for the same reason: an unflagged job's data must stay
 		// byte-identical to today's, so the key is absent rather than present-and-undefined.
 		...(resolved.resume !== undefined ? { resume: resolved.resume } : {}),
+		// REQ-AWAIT-INPUT (issue #625): whether the job may end awaiting a person's answer. Present only when armed,
+		// resume's rule, so an unflagged job's data stays byte-identical.
+		...(resolved.awaitInput === true ? { awaitInput: true } : {}),
+		// A phrase-free reply to a parked issue (issue #625): the worker gates it on the `parked` sidecar before any spend.
+		...(resolved.parkedReply === true ? { parkedReply: true } : {}),
 		// How many independent sandboxes race this flow (REQ-REPLICA-RUNS). At JOB level like the rest, never
 		// inside `trigger`, and for the sharpest version of that reason: this is the caller's fanout count --
 		// receiver.mjs reads it to decide how many times to enqueue -- and a descriptive context object copied
@@ -221,7 +230,7 @@ function routeIssueLabel(subset, triggers) {
 		// A command rule (issue #189) skips flow resolution entirely: the label match IS the dispatch.
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -229,6 +238,7 @@ function routeIssueLabel(subset, triggers) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		matched: { index: rule.index, type: "label", label: matchedLabel(L, rule.predicate) },
 		target: { type: "issue", number: subset.issue?.number, title: subset.issue?.title, body: subset.issue?.body },
@@ -247,7 +257,14 @@ function routeComment(subset, triggers, knownFlows) {
 	}
 	const phrase = triggers.comment?.phrase;
 	const body = subset.comment?.body;
-	if (typeof phrase !== "string" || typeof body !== "string" || !body.includes(phrase)) {
+	const phraseHit = typeof phrase === "string" && typeof body === "string" && body.includes(phrase);
+	// A reply WITHOUT the phrase resumes a parked issue (issue #625, parked.mjs): only on an issue (a pull request's key
+	// needs its head branch, which costs a token to read, so its reply keeps the phrase), only when the comment
+	// trigger arms run.resume and is not a command, and only when the forge says the issue carries the marker. The
+	// author gate above already ran: this widens WHICH comments start a job, never WHO may. The marker is a hint; the
+	// worker refuses the job before any spend unless the key's `parked` sidecar exists.
+	const parkedReply = !phraseHit && typeof phrase === "string" && typeof body === "string" && triggers.comment?.resume === true && triggers.comment?.command === undefined && subset.issue?.pull_request !== true && hasParkedLabel(subset.issue?.labels);
+	if (!phraseHit && !parkedReply) {
 		return { enqueue: false, reason: "no-trigger-phrase" };
 	}
 	// On a COMMAND rule (issue #189) the whole flow-resolution block below -- default flow, the `<phrase>
@@ -282,7 +299,7 @@ function routeComment(subset, triggers, knownFlows) {
 		// The single comment trigger IS the matched rule here, so its opt-in is the job's. A `<phrase>
 		// <flow>` override changes WHICH flow runs, never which triggers.json entry authorized it.
 		packages: triggers.comment.packages,
-		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools,
+		image: triggers.comment.image, backend: triggers.comment.backend, excludeTools: triggers.comment.excludeTools, mcp: triggers.comment.mcp,
 		provider: triggers.comment.provider, model: triggers.comment.model, maxTurns: triggers.comment.maxTurns, models: triggers.comment.models, maxCostUsd: triggers.comment.maxCostUsd,
 		skillsDir: triggers.comment.skillsDir,
 		secrets: triggers.comment.secrets,
@@ -290,8 +307,10 @@ function routeComment(subset, triggers, knownFlows) {
 		waitFor: triggers.comment.waitFor,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
+		awaitInput: triggers.comment.awaitInput,
 		replicas: triggers.comment.replicas,
 		matched: { index: triggers.comment.index, type: "comment", phrase },
+		...(parkedReply && { parkedReply: true }),
 		// The invoking comment rides on the trigger: body and author_association are both named by
 		// INT-WEBHOOK-PAYLOAD-SUBSET, and the body stays DATA all the way down (CONST-ISSUE-TEXT-IS-DATA).
 		comment: { body: subset.comment.body, author_association: subset.comment.author_association },
@@ -381,7 +400,7 @@ function routePullRequest(subset, triggers, action) {
 			// A command rule (issue #189) skips flow resolution entirely: the rule match IS the dispatch.
 			...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 			packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
-			image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+			image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 			provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 			skillsDir: rule.skillsDir,
 			secrets: rule.secrets,
@@ -389,6 +408,7 @@ function routePullRequest(subset, triggers, action) {
 			waitFor: rule.waitFor,
 			instructions: rule.instructions,
 			resume: rule.resume,
+			awaitInput: rule.awaitInput,
 			replicas: rule.replicas,
 			matched: { index: rule.index, type: "pull_request", action },
 			...(isReview ? { review: { id: review.id, body: review.body, state: review.state, author_association: review.author_association } } : {}),
@@ -498,7 +518,7 @@ function routeClose(rules, number, closerAuthorized, matchedFor, targetFor) {
 		// A command rule (issue #189) skips flow resolution entirely: the rule match IS the dispatch.
 		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
 		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
-		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools,
+		image: rule.image, backend: rule.backend, excludeTools: rule.excludeTools, mcp: rule.mcp,
 		provider: rule.provider, model: rule.model, maxTurns: rule.maxTurns, models: rule.models, maxCostUsd: rule.maxCostUsd,
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
@@ -506,6 +526,7 @@ function routeClose(rules, number, closerAuthorized, matchedFor, targetFor) {
 		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
+		awaitInput: rule.awaitInput,
 		replicas: rule.replicas,
 		matched: matchedFor(rule),
 		target: targetFor(),