@loicngr/kobo 2.1.15 → 2.1.16

package/dist/server/routes/workspaces.js

@@ -105,8 +105,16 @@ app.use('/:id/*', async (c, next) => {
     }
     await next();
 });
-// These handlers own teardown across awaits; purge/delete/restore own their guard in the service.
-for (const route of ['/:id/archive', '/:id/run-setup-script', '/:id/cancel-source-change', '/:id/rollback-file']) {
+// Branch/path mutations must also exclude teardown across awaits.
+// Purge/delete/restore own their guard in the service.
+for (const route of [
+    '/:id/archive',
+    '/:id/run-setup-script',
+    '/:id/cancel-source-change',
+    '/:id/rollback-file',
+    '/:id/rename-branch',
+    '/:id/resync-branch',
+]) {
     app.use(route, async (c, next) => {
         try {
             await withWorkspaceLifecycleGuard(c.req.param('id'), next);
@@ -570,6 +578,7 @@ app.post('/', migrationGuard, creationBodyLimit, async (c) => {
         // the working branch from git itself — the body.workingBranch is ignored.
         let useReusedWorktree = false;
         let reusedDerivedBranch = null;
+        let reusedIdentity = null;
         if (body.worktreePath) {
             currentStep = 'inspect-worktree';
             emitCreateProgress(creationId, currentStep);
@@ -598,6 +607,14 @@ app.post('/', migrationGuard, creationBodyLimit, async (c) => {
                     return c.json({ error: failure, step: 'inspect-worktree' }, 422);
                 }
                 reusedDerivedBranch = branch;
+                const directory = fs.statSync(body.worktreePath);
+                const gitEntry = fs.statSync(path.join(body.worktreePath, '.git'));
+                reusedIdentity = {
+                    device: directory.dev,
+                    inode: directory.ino,
+                    gitDevice: gitEntry.dev,
+                    gitInode: gitEntry.ino,
+                };
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
@@ -781,6 +798,36 @@ app.post('/', migrationGuard, creationBodyLimit, async (c) => {
         const creation = await withGitRepoLock(body.projectPath, async () => {
             let prospectiveWorktreePath;
             if (useReusedWorktree) {
+                // Imports above may yield long enough for a failed PR creation to remove
+                // its checkout. Recheck the exact directory and branch under the same
+                // repository lock as compensation before any record/context files exist.
+                try {
+                    const worktreePath = body.worktreePath;
+                    const directory = fs.statSync(worktreePath);
+                    const gitEntry = fs.statSync(path.join(worktreePath, '.git'));
+                    const commonDir = execFileSync('git', ['-C', worktreePath, 'rev-parse', '--path-format=absolute', '--git-common-dir'], {
+                        encoding: 'utf-8',
+                        timeout: 30_000,
+                    }).trim();
+                    const branch = execFileSync('git', ['-C', worktreePath, 'rev-parse', '--abbrev-ref', 'HEAD'], {
+                        encoding: 'utf-8',
+                        timeout: 30_000,
+                    }).trim();
+                    if (!reusedIdentity ||
+                        !directory.isDirectory() ||
+                        directory.dev !== reusedIdentity.device ||
+                        directory.ino !== reusedIdentity.inode ||
+                        gitEntry.dev !== reusedIdentity.gitDevice ||
+                        gitEntry.ino !== reusedIdentity.gitInode ||
+                        realPathOrResolved(commonDir) !== realPathOrResolved(path.join(body.projectPath, '.git')) ||
+                        branch !== reusedDerivedBranch)
+                        throw new Error('The worktree directory, repository or branch changed during creation; retry from a fresh diagnosis');
+                }
+                catch (err) {
+                    const failure = `Failed to revalidate worktree: ${err instanceof Error ? err.message : String(err)}`;
+                    emitCreateFailed(creationId, 'inspect-worktree', failure);
+                    return c.json({ error: failure, step: 'inspect-worktree' }, 422);
+                }
                 // Another attachment may have completed while this request waited for the lock.
                 const existing = getDb().prepare('SELECT id FROM workspaces WHERE worktree_path = ?').get(body.worktreePath);
                 if (existing) {
@@ -3180,6 +3227,12 @@ app.post('/:id/unarchive', migrationGuard, (c) => {
         return c.json({ error: message }, workspaceErrorStatus(err));
     }
 });
+class WorkspaceBranchConfirmationError extends Error {
+    code = 'branch-confirmation-mismatch';
+    constructor() {
+        super('The workspace branch changed or does not match confirmationBranch. Confirm its current branch before deleting.');
+    }
+}
 // Shared teardown for a single workspace: stops the agent, destroys the
 // terminal, removes the owned worktree, optionally deletes local/remote
 // branches, then deletes the DB row (cascades to tasks/sessions/events).
@@ -3191,6 +3244,8 @@ async function deleteWorkspaceWithSideEffects(workspace, opts) {
         const current = workspaceService.getWorkspace(workspace.id);
         if (!current)
             throw new Error(`Workspace '${workspace.id}' not found`);
+        if (opts.confirmationBranch !== undefined && opts.confirmationBranch !== current.workingBranch)
+            throw new WorkspaceBranchConfirmationError();
         // A bulk deletion may have captured the list before restoration completed.
         if (workspace.archivedAt && !current.archivedAt) {
             throw new Error('Workspace was unarchived while deletion was pending. Retry from its current state.');
@@ -3335,7 +3390,7 @@ app.delete('/:id', migrationGuard, async (c) => {
         return c.json({ ok: true, warnings }, 200);
     }
     catch (err) {
-        if (err instanceof WorkspaceLifecycleBusyError)
+        if (err instanceof WorkspaceLifecycleBusyError || err instanceof WorkspaceBranchConfirmationError)
             return c.json({ code: err.code, error: err.message }, 409);
         const message = err instanceof Error ? err.message : String(err);
         return c.json({ error: message }, workspaceErrorStatus(err));

package/dist/server/services/agent/orchestrator.js

@@ -1947,8 +1947,7 @@ export async function sendMessage(workspaceId, content, expectedSessionId, befor
         throw new Error(`Session '${expectedSessionId}' is not active for workspace '${workspaceId}'`);
     }
     wakeupService.cancel(workspaceId, 'user-message');
-    beforeDispatch?.();
-    await ctrl.sendMessage(content);
+    await ctrl.sendMessage(content, beforeDispatch);
 }
 export async function sendMessageForFallback(workspaceId, content) {
     assertWorkspaceLifecycleAvailable(workspaceId);

package/dist/server/services/agent/session-controller.js

@@ -106,7 +106,7 @@ export class SessionController {
         }
         this._status = 'running';
     }
-    async sendMessage(content) {
+    async sendMessage(content, beforeDispatch) {
         if (!this._startPromise)
             throw new Error('SessionController not started');
         await this._startPromise;
@@ -114,6 +114,9 @@ export class SessionController {
             throw new Error('SessionController is stopping');
         if (!this._engineProcess)
             throw new Error('SessionController not started');
+        // Startup may have yielded while the workspace's delivery mode changed.
+        // Validate immediately before handing the message to the engine.
+        beforeDispatch?.();
         await this._engineProcess.sendMessage(content);
     }
     interrupt() {

package/dist/server/services/pr-checkout-rollback-service.js

@@ -0,0 +1,51 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getDb } from '../db/index.js';
+import { buildNonInteractiveGitEnv } from '../utils/git-ops.js';
+import { withGitRepoLock } from '../utils/git-repo-lock.js';
+/** Undo only our unchanged checkout, never the PR branch or earlier checkout decisions. */
+export async function rollbackCreatedPrCheckout(projectPath, checkout) {
+    const retained = (reason) => ({ removed: false, worktreePath: checkout.worktreePath, reason });
+    if (!checkout.createdWorktree)
+        return retained('The checkout existed before this request');
+    try {
+        return await withGitRepoLock(projectPath, () => {
+            // Workspace adoption uses this same lock. Keep checks and removal synchronous
+            // so another request cannot attach this checkout between the ownership read and removal.
+            const owners = getDb().prepare('SELECT worktree_path FROM workspaces').all();
+            const resolved = fs.realpathSync(checkout.worktreePath);
+            if (owners.some(({ worktree_path }) => {
+                try {
+                    return fs.realpathSync(worktree_path) === resolved;
+                }
+                catch {
+                    return path.resolve(worktree_path) === resolved;
+                }
+            }))
+                return retained('The checkout is attached to a workspace');
+            const stat = fs.lstatSync(checkout.worktreePath);
+            const identity = checkout.createdWorktree;
+            if (!stat.isDirectory() || stat.dev !== identity.device || stat.ino !== identity.inode)
+                return retained('The checkout directory was replaced');
+            const git = (cwd, args) => execFileSync('git', args, {
+                cwd,
+                encoding: 'utf8',
+                timeout: 30_000,
+                maxBuffer: 16 * 1024 * 1024,
+                env: buildNonInteractiveGitEnv(),
+            }).trim();
+            if (git(resolved, ['rev-parse', 'HEAD']) !== identity.head ||
+                git(resolved, ['symbolic-ref', '--short', 'HEAD']) !== checkout.workingBranch)
+                return retained('The checkout branch or HEAD changed');
+            if (git(resolved, ['status', '--porcelain', '--untracked-files=all', '--ignored']))
+                return retained('The checkout contains local or ignored files');
+            // No --force: Git performs its own final dirty/locked-worktree checks.
+            git(projectPath, ['worktree', 'remove', '--', resolved]);
+            return { removed: true, worktreePath: checkout.worktreePath };
+        });
+    }
+    catch (error) {
+        return retained(error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/server/services/pr-checkout-service.js

@@ -227,6 +227,8 @@ export async function applyBranchStrategy(repoPath, branch, strategy) {
     if (strategy === 'keep')
         return { strategy, backupBranch: null };
     if (strategy === 'fast-forward') {
+        // A caller cannot turn fast-forward into a silent reset of local commits.
+        await readGitAsync(repoPath, ['merge-base', '--is-ancestor', branch, remoteRef]);
         await runGitAsync(repoPath, ['branch', '--force', branch, remoteRef]);
         return { strategy, backupBranch: null };
     }
@@ -301,6 +303,9 @@ function resolvePrCheckoutLocked(input, owner) {
         const fresh = await diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths ?? new Map(), input.workspaces ?? []);
         if ((await computeFingerprint(fresh)) !== input.fingerprint)
             throw new StaleDiagnosisError(fresh);
+        if (input.decisions.divergence === 'fast-forward' &&
+            (fresh.branch.state === 'ahead' || fresh.branch.state === 'diverged'))
+            throw new Error('Fast-forward cannot discard local commits. Keep, rebase or explicitly reset the branch.');
         if ((fresh.worktree.state === 'orphan' || fresh.worktree.state === 'attached') &&
             input.decisions.orphanWorktree === 'create-elsewhere') {
             throw new Error('Branch is already checked out. Attach its existing worktree instead.');
@@ -392,7 +397,16 @@ function resolvePrCheckoutLocked(input, owner) {
         //    realignment from step 4 (if any) is NOT undone here — a `reset-hard`
         //    strategy already left its own `kobo-backup/<branch>-<ts>` safety net,
         //    and fast-forward/rebase are non-destructive by construction.
+        let createdWorktree;
         try {
+            if (created) {
+                const stat = fs.lstatSync(worktreePath);
+                createdWorktree = {
+                    device: stat.dev,
+                    inode: stat.ino,
+                    head: await runGitAsync(worktreePath, ['rev-parse', 'HEAD']),
+                };
+            }
             input.afterWorktreeHook?.();
         }
         catch (err) {
@@ -409,7 +423,13 @@ function resolvePrCheckoutLocked(input, owner) {
             }
             throw err;
         }
-        return { worktreePath, workingBranch: input.headBranch, sourceBranch: input.baseBranch, applied };
+        return {
+            worktreePath,
+            workingBranch: input.headBranch,
+            sourceBranch: input.baseBranch,
+            applied,
+            ...(createdWorktree ? { createdWorktree } : {}),
+        };
     });
 }
 /** Realign a branch from inside its own worktree, where ref surgery is refused. */

package/dist/server/services/workspace-creation-mcp-service.js

@@ -0,0 +1,198 @@
+import { checkoutDecisionError, deriveSteps } from '../../shared/pr-checkout-steps.js';
+import { validateWorkspaceCreationArguments } from '../../shared/workspace-creation-tools.js';
+import { CLAUDE_CODE_CAPABILITIES } from './agent/engines/claude-code/capabilities.js';
+import { CODEX_CAPABILITIES } from './agent/engines/codex/capabilities.js';
+import { rollbackCreatedPrCheckout } from './pr-checkout-rollback-service.js';
+export class WorkspaceCreationMcpError extends Error {
+    status;
+    stage;
+    details;
+    constructor(message, status, stage, details = null) {
+        super(message);
+        this.status = status;
+        this.stage = stage;
+        this.details = details;
+        this.name = 'WorkspaceCreationMcpError';
+    }
+}
+async function request(dispatch, path, stage, body, init) {
+    const response = await dispatch(path, init ?? { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body ?? {}) });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok)
+        throw new WorkspaceCreationMcpError(payload?.error ?? `Workspace request failed (${response.status})`, response.status, stage, payload);
+    return payload;
+}
+function prIdentity(raw) {
+    const url = new URL(raw);
+    const pathname = url.pathname.replace(/\/+$/, '');
+    const last = pathname.split('/').at(-1);
+    const number = Number(last);
+    if (!/^[1-9]\d*$/.test(last) || !Number.isSafeInteger(number))
+        throw new WorkspaceCreationMcpError('pr_url must end with a PR/MR number', 400, 'validate');
+    return { number, identity: `${url.origin}${pathname}` };
+}
+function mapInput(input) {
+    const mapping = {
+        name: 'name',
+        project_path: 'projectPath',
+        source_branch: 'sourceBranch',
+        working_branch: 'workingBranch',
+        model: 'model',
+        reasoning_effort: 'reasoningEffort',
+        brainstorm_model: 'brainstormModel',
+        brainstorm_reasoning_effort: 'brainstormReasoningEffort',
+        engine: 'engine',
+        description: 'description',
+        tags: 'tags',
+        tasks: 'tasks',
+        acceptance_criteria: 'acceptanceCriteria',
+        agent_permission_mode: 'agentPermissionMode',
+        auto_loop: 'autoLoop',
+        auto_loop_session_mode: 'autoLoopSessionMode',
+        skip_setup_script: 'skipSetupScript',
+        workflow_policy: 'workflowPolicy',
+        notion_url: 'notionUrl',
+        notion_page_id: 'notionPageId',
+        sentry_url: 'sentryUrl',
+        pr_url: 'prUrl',
+        worktree_path: 'worktreePath',
+        comparison_id: 'comparisonId',
+        creation_id: 'creationId',
+    };
+    const body = {};
+    for (const [key, field] of Object.entries(mapping))
+        if (Object.hasOwn(input, key))
+            body[field] = input[key];
+    if (input.auto_loop_final_review !== undefined) {
+        const config = input.auto_loop_final_review;
+        body.autoLoopFinalReview =
+            config === null
+                ? null
+                : {
+                    engine: config.engine,
+                    model: config.model,
+                    reasoningEffort: config.reasoning_effort,
+                    additionalInstructions: config.additional_instructions ?? '',
+                };
+    }
+    return body;
+}
+/** Reuses the application's route validation, lifecycle guards, Git locks and rollback. */
+export async function executeWorkspaceCreationTool(name, raw, dispatch) {
+    let input;
+    try {
+        input = validateWorkspaceCreationArguments(name, raw);
+    }
+    catch (error) {
+        throw new WorkspaceCreationMcpError(error instanceof Error ? error.message : 'Invalid arguments', 400, 'validate');
+    }
+    const config = input.auto_loop_final_review;
+    if (config) {
+        const capabilities = config.engine === 'codex' ? CODEX_CAPABILITIES : CLAUDE_CODE_CAPABILITIES;
+        if (!capabilities.effortLevels?.some((effort) => effort.id === config.reasoning_effort))
+            throw new WorkspaceCreationMcpError('Unsupported review reasoning effort', 400, 'validate');
+    }
+    const body = mapInput(input);
+    let resolvedCheckout;
+    if (input.pr_url) {
+        const supplied = prIdentity(input.pr_url);
+        const diagnosis = await request(dispatch, '/api/pull-requests/diagnose', 'diagnose', {
+            projectPath: input.project_path,
+            prNumber: supplied.number,
+        });
+        const requiresAction = (reason) => ({
+            created: false,
+            requiresAction: true,
+            ...diagnosis,
+            ...(reason ? { reason } : {}),
+        });
+        if (diagnosis.pr && prIdentity(diagnosis.pr.url).identity !== supplied.identity)
+            throw new WorkspaceCreationMcpError('pr_url does not belong to the selected project', 400, 'diagnose', diagnosis);
+        if (name === 'diagnose_workspace_pr')
+            return diagnosis;
+        if (!diagnosis.pr)
+            return requiresAction('Pull request unavailable');
+        const { report, pr, fingerprint } = diagnosis;
+        const plan = input.pr_checkout;
+        if (plan && plan.fingerprint !== fingerprint)
+            throw new WorkspaceCreationMcpError('The repository changed since the diagnosis was taken', 409, 'diagnose', diagnosis);
+        const decisions = plan?.decisions ?? {};
+        if (report.workspace.state === 'active' && decisions.existingWorkspace === 'open')
+            return { created: false, workspaceId: report.workspace.id, workspace: report.workspace };
+        if (report.workspace.state === 'archived' && decisions.archivedWorkspace === 'unarchive') {
+            const workspace = await request(dispatch, `/api/workspaces/${encodeURIComponent(report.workspace.id)}/unarchive`, 'unarchive');
+            return { created: false, workspaceId: report.workspace.id, workspace };
+        }
+        // A purge or an existing association must never fall through to a second creation.
+        if (report.workspace.state !== 'none')
+            return requiresAction('Use the existing workspace; automatic duplicate creation is not supported');
+        if (decisions.ongoingOperation === 'cancel')
+            return { created: false, cancelled: true, ...diagnosis };
+        const error = checkoutDecisionError(report, decisions);
+        if (error)
+            throw new WorkspaceCreationMcpError(error, 400, 'validate-checkout', diagnosis);
+        const steps = deriveSteps(report);
+        if (steps.some((step) => step.blocking))
+            return requiresAction('Checkout is blocked');
+        if (!plan && (steps.length > 0 || report.worktree.state !== 'none'))
+            return requiresAction();
+        if (plan) {
+            // Every state requiring a choice needs an explicit decision. In particular,
+            // do not inherit the UI's defaults for reset/stash/abort or path selection.
+            const missing = steps.some((step) => (step.id === 'path' && !decisions.pathCollision) ||
+                (step.id === 'worktree' && !decisions.orphanWorktree) ||
+                (step.id === 'operation' && !decisions.ongoingOperation) ||
+                (step.id === 'changes' && !decisions.localChanges) ||
+                (step.id === 'divergence' && !decisions.divergence));
+            if (missing)
+                return requiresAction('Explicit checkout decisions are required');
+        }
+        body.sourceBranch = pr.baseBranch;
+        body.workingBranch = pr.headBranch;
+        body.prUrl = pr.url;
+        body.skipSetupScript = input.skip_setup_script ?? true;
+        if (input.worktree_path) {
+            const diagnosedPath = 'path' in report.worktree ? report.worktree.path : null;
+            if (diagnosedPath !== input.worktree_path)
+                throw new WorkspaceCreationMcpError('worktree_path does not match the diagnosed PR checkout', 400, 'validate-checkout', diagnosis);
+        }
+        const resolved = await request(dispatch, '/api/pull-requests/resolve', 'resolve', {
+            projectPath: input.project_path,
+            prNumber: pr.number,
+            headBranch: pr.headBranch,
+            baseBranch: pr.baseBranch,
+            decisions,
+            fingerprint,
+        });
+        body.worktreePath = resolved.worktreePath;
+        resolvedCheckout = resolved;
+    }
+    try {
+        const attachments = input.attachments;
+        if (attachments?.length) {
+            const form = new FormData();
+            form.append('workspace', JSON.stringify(body));
+            for (const file of attachments)
+                form.append('attachments', new Blob([Buffer.from(file.data_base64, 'base64')], { type: file.mime_type }), file.name);
+            return await request(dispatch, '/api/workspaces', 'create', undefined, { method: 'POST', body: form });
+        }
+        return await request(dispatch, '/api/workspaces', 'create', body);
+    }
+    catch (error) {
+        if (!resolvedCheckout)
+            throw error;
+        if (!(error instanceof WorkspaceCreationMcpError))
+            throw new WorkspaceCreationMcpError(error instanceof Error ? error.message : String(error), 500, 'create', {
+                checkoutRecovery: {
+                    removed: false,
+                    worktreePath: resolvedCheckout.worktreePath,
+                    reason: 'Creation outcome is unknown; inspect the workspace and checkout before retrying',
+                },
+            });
+        const checkoutRecovery = await rollbackCreatedPrCheckout(input.project_path, resolvedCheckout);
+        throw new WorkspaceCreationMcpError(error.message, error.status, error.stage, {
+            ...(error.details && typeof error.details === 'object' ? error.details : {}),
+            checkoutRecovery,
+        });
+    }
+}

package/dist/server/services/workspace-group-message-mcp-service.js

@@ -0,0 +1,58 @@
+import { validateWorkspaceGroupMessageArguments } from '../../shared/workspace-group-message-tools.js';
+import { MAX_GROUP_MESSAGE_RECIPIENTS, matchesGroupMessageFilters } from '../../shared/workspace-group-messages.js';
+import { GroupMessageError, getGroupMessageBatch, startGroupMessageBatch } from './workspace-group-message-service.js';
+import { listWorkspaces } from './workspace-service.js';
+export class WorkspaceGroupMessageMcpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+export function executeWorkspaceGroupMessageTool(name, raw, source) {
+    let input;
+    try {
+        input = validateWorkspaceGroupMessageArguments(name, raw);
+    }
+    catch (error) {
+        throw new WorkspaceGroupMessageMcpError(error instanceof Error ? error.message : 'Invalid arguments', 400);
+    }
+    if (name === 'preview_workspace_group_message') {
+        const filters = {
+            tags: input.tags,
+            statuses: input.statuses,
+            devServerRunning: input.dev_server_running,
+        };
+        const candidates = listWorkspaces()
+            .filter((workspace) => !workspace.archivedAt && !workspace.worktreePurgedAt && matchesGroupMessageFilters(workspace, filters))
+            .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+        const offset = input.offset ?? 0;
+        const limit = input.limit ?? MAX_GROUP_MESSAGE_RECIPIENTS;
+        return {
+            total: candidates.length,
+            offset,
+            limit,
+            recipients: candidates.slice(offset, offset + limit).map((workspace) => ({
+                workspaceId: workspace.id,
+                name: workspace.name,
+                tags: workspace.tags,
+                status: workspace.status,
+                delivery: workspace.autoLoop ? 'next_iteration' : 'immediate',
+            })),
+        };
+    }
+    if (name === 'get_workspace_group_message') {
+        const batch = getGroupMessageBatch(input.request_id);
+        if (!batch)
+            throw new WorkspaceGroupMessageMcpError('Group message request not found', 404);
+        return batch;
+    }
+    try {
+        return startGroupMessageBatch({ requestId: input.request_id, workspaceIds: input.workspace_ids, content: input.content }, source);
+    }
+    catch (error) {
+        if (error instanceof GroupMessageError)
+            throw new WorkspaceGroupMessageMcpError(error.message, error.status);
+        throw error;
+    }
+}