@moretea-labs/forge 1.8.0 → 1.8.2

package/adapters/mcp/server.ts

@@ -16,9 +16,10 @@ import { callAccessTool } from './tool-mapping/access-tools';
 import { callRepositoryToolWithPostFinalizeAttribution } from './tool-mapping/post-finalize-work-attribution';
 import { callRuntimeTool } from './runtime-gateway/runtime-tools';
 import { callExecutionTool } from './runtime-gateway/execution-tools';
-import { callProcessTool } from './runtime-gateway/process-tools';
+import { callProcessTool, executeAuthorizedHostCommand } from './runtime-gateway/process-tools';
 import { injectDurableCommandFields, isGatewayIsolatedTool, routeDurableMcpCall } from './runtime-gateway/router';
 import { controllerExposureSnapshot, isControllerToolExposed } from './toolset';
+import { settleCognitionAfterTool } from './runtime-gateway/cognition-settlement';
 import { randomUUID } from 'crypto';
 import { readFileSync } from 'fs';
 import { join } from 'path';
@@ -28,6 +29,7 @@ import { getRuntimeWriteClaim } from '../../src/runtime/root/write-fence';
 import { recordMcpIncident, recordMcpTiming, type McpTimingTrace } from '../../src/runtime/diagnostics/mcp-timing';
 import { maybeRegisterMcpIncidentRepair } from '../../src/runtime/diagnostics/incident-repair';
 import { FORGE_VERSION, forgeToolSurfaceFingerprint } from '../../src/cli/controller/runtime-config';
+import { RUNTIME_MCP_CUTOVER_OUTCOME_UNKNOWN } from '../../src/runtime/root/mcp-transport';
 
 export type { McpServerOptions } from './multi-repository';
 export { buildMultiRepositoryToolDefinitions, callMultiRepositoryTool } from './multi-repository';
@@ -45,9 +47,11 @@ function isMultiRepositoryContext(ctx: ServerToolContext): ctx is MultiRepositor
   return 'controllerHome' in ctx;
 }
 
-function recordRequestId(args: Record<string, unknown>, rpcId: string | number | undefined): string {
+function recordRequestId(args: Record<string, unknown>, _rpcId: string | number | undefined): string {
   const explicit = typeof args.request_id === 'string' ? args.request_id.trim() : '';
-  return explicit || `mcp-rpc:${rpcId === undefined ? randomUUID() : String(rpcId)}`;
+  // Transport RPC ids are connection-local correlation only. They are not a
+  // semantic idempotency authority and may be recycled across unrelated calls.
+  return explicit || `mcp-call:${randomUUID()}`;
 }
 
 function firstTimingString(...values: unknown[]): string | undefined {
@@ -208,6 +212,7 @@ async function traceControllerMcpRequest(
       ...(rpcId === undefined ? {} : { rpcId }),
       layer: ctx.runtimeSourceRoot ? 'canonical_runtime' : 'public_gateway',
       startedAt: startedAtWall,
+      ...(ctx.hostConversationSessionId?.trim() ? { hostConversationSessionId: ctx.hostConversationSessionId.trim() } : {}),
       outcome,
       ...(errorCode ? { errorCode } : {}),
       ...executionIdentity,
@@ -414,6 +419,7 @@ interface CanonicalRuntimeForwardingIdentity {
   principalId?: string;
   sessionId?: string;
   controllerType?: ForwardedControllerType;
+  hostConversationSessionId?: string;
 }
 
 function boundedForwardedIdentity(value: unknown): string | undefined {
@@ -422,18 +428,26 @@ function boundedForwardedIdentity(value: unknown): string | undefined {
   return normalized ? normalized.slice(0, 512) : undefined;
 }
 
+/** ChatGPT supplies this as an anonymized same-conversation correlation fact. It is not an auth token or URL. */
+export function chatgptHostSessionIdFromMcpMeta(meta: unknown): string | undefined {
+  if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return undefined;
+  return boundedForwardedIdentity((meta as Record<string, unknown>)['openai/session']);
+}
+
 export function canonicalRuntimeForwardingIdentity(meta: unknown): CanonicalRuntimeForwardingIdentity {
   if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return {};
   const envelope = (meta as Record<string, unknown>)[CANONICAL_RUNTIME_FORWARD_META_KEY];
   if (!envelope || typeof envelope !== 'object' || Array.isArray(envelope)) return {};
   const record = envelope as Record<string, unknown>;
   const controllerType = boundedForwardedIdentity(record.controllerType);
+  const hostConversationSessionId = boundedForwardedIdentity(record.hostConversationSessionId);
   return {
     principalId: boundedForwardedIdentity(record.principalId),
     sessionId: boundedForwardedIdentity(record.sessionId),
     ...(controllerType && ['chatgpt', 'codex', 'claude', 'grok', 'human'].includes(controllerType)
       ? { controllerType: controllerType as ForwardedControllerType }
       : {}),
+    ...(hostConversationSessionId ? { hostConversationSessionId } : {}),
   };
 }
 
@@ -443,18 +457,27 @@ function canonicalRuntimeForwardingMeta(ctx: MultiRepositoryMcpToolContext): Rec
       ...(ctx.principalId?.trim() ? { principalId: ctx.principalId.trim() } : {}),
       ...(ctx.sessionId?.trim() ? { sessionId: ctx.sessionId.trim() } : {}),
       ...(ctx.controllerType ? { controllerType: ctx.controllerType } : {}),
+      ...(ctx.hostConversationSessionId?.trim() ? { hostConversationSessionId: ctx.hostConversationSessionId.trim() } : {}),
     },
   };
 }
 
 function canonicalRuntimeRequestContext(baseContext: ServerToolContext, meta: unknown): ServerToolContext {
-  if (!isMultiRepositoryContext(baseContext) || !baseContext.runtimeSourceRoot) return baseContext;
+  if (!isMultiRepositoryContext(baseContext)) return baseContext;
+  // Host metadata is request-scoped correlation only. The public Gateway carries
+  // it through its private forwarding envelope so Canonical Runtime does not lose
+  // the ChatGPT conversation scope during the proxy hop.
+  const hostConversationSessionId = chatgptHostSessionIdFromMcpMeta(meta);
+  if (!baseContext.runtimeSourceRoot) {
+    return hostConversationSessionId ? { ...baseContext, hostConversationSessionId } : baseContext;
+  }
   const forwarded = canonicalRuntimeForwardingIdentity(meta);
   return {
     ...baseContext,
     ...(forwarded.principalId ? { principalId: forwarded.principalId } : {}),
     ...(forwarded.sessionId ? { sessionId: forwarded.sessionId } : {}),
     ...(forwarded.controllerType ? { controllerType: forwarded.controllerType } : {}),
+    ...(forwarded.hostConversationSessionId ? { hostConversationSessionId: forwarded.hostConversationSessionId } : {}),
   };
 }
 
@@ -484,12 +507,26 @@ export function sameCanonicalRuntimeProxyIdentity(
 }
 
 export function canonicalRuntimeToolCallIsReplaySafe(name: string, args: Record<string, unknown>): boolean {
-  if (name !== 'repository_command_execute') return false;
+  if (name !== 'execute_command') return false;
   const workId = typeof args.work_id === 'string' ? args.work_id.trim() : '';
   const requestId = typeof args.request_id === 'string' ? args.request_id.trim() : '';
   return Boolean(workId && requestId);
 }
 
+export function canonicalRuntimeToolCallFailureIsCutoverOutcomeUnknown(error: unknown): boolean {
+  if (!error || typeof error !== 'object') return false;
+  const record = error as { code?: unknown; message?: unknown; data?: unknown };
+  const message = typeof record.message === 'string' ? record.message : '';
+  if (SdkHttpError.isInstance(error)) {
+    return error.status === 409 && (
+      message.includes(RUNTIME_MCP_CUTOVER_OUTCOME_UNKNOWN)
+      || message.toLowerCase().includes('runtime cutover outcome unknown')
+      || JSON.stringify(record.data ?? '').includes(RUNTIME_MCP_CUTOVER_OUTCOME_UNKNOWN)
+    );
+  }
+  return record.code === -32000 && message === RUNTIME_MCP_CUTOVER_OUTCOME_UNKNOWN;
+}
+
 export function canonicalRuntimeToolCallFailureIsTransient(error: unknown): boolean {
   if (SdkHttpError.isInstance(error)) return error.status === 404;
   if (SdkError.isInstance(error)) {
@@ -516,6 +553,9 @@ export async function callCanonicalRuntimeToolWithReplay<T>(input: {
   try {
     return await input.call();
   } catch (error) {
+    if (canonicalRuntimeToolCallFailureIsCutoverOutcomeUnknown(error)) {
+      throw new Error(`${RUNTIME_MCP_CUTOVER_OUTCOME_UNKNOWN}: Canonical Runtime entered cutover after request admission; reconcile the original request/effect identity before retrying.`);
+    }
     if (!canonicalRuntimeToolCallIsReplaySafe(input.name, input.args)
       || !canonicalRuntimeToolCallFailureIsTransient(error)) {
       throw error;
@@ -989,7 +1029,7 @@ export function createForgeMcpServerFromContext(
     if (isMultiRepositoryContext(ctx)) {
       const rpcId = handlerContext.mcpReq.id;
       return traceControllerMcpRequest(ctx, name, args, typeof rpcId === 'string' || typeof rpcId === 'number' ? rpcId : undefined, async (requestId, _traceId, phaseTimings) => {
-        // The public Gateway only exposes its stable facade schema. It may
+        // The public Gateway serves one complete canonical tool schema. It may
         // proxy execution, but it never discovers one Runtime schema and
         // validates calls against another source checkout.
         if (!getRuntimeWriteClaim() && !runtimeSchema && !canonicalRuntimeSchemaMatchesGateway(ctx)) {
@@ -1013,29 +1053,54 @@ export function createForgeMcpServerFromContext(
         // Gateway processes from acquiring Process Runtime leases or evaluating
         // Runtime source coherence against their own checkout.
         if (!getRuntimeWriteClaim()) {
-          const forwardedArgs = typeof args.request_id === 'string' && args.request_id.trim()
-            ? args
-            : { ...args, request_id: requestId };
+          // Keep trace correlation separate from Tool Contract idempotency. Only
+          // a caller-supplied request_id may authorize semantic replay/dedup.
+          const forwardedArgs = args;
           if (runtimeProxy && runtimeSchema) return runtimeProxy.callTool(ctx, name, forwardedArgs, phaseTimings);
           if (runtimeProxy && observeRuntimeStatus(ctx.controllerHome).ready) return runtimeProxy.callTool(ctx, name, forwardedArgs, phaseTimings);
         }
-        const accessResult = callAccessTool(ctx, name, args);
-        if (accessResult) return accessResult;
-        const executionResult = await callExecutionTool(ctx, name, args);
-        if (executionResult) return executionResult;
-        const processResult = await callProcessTool(ctx, name, args);
-        if (processResult) return processResult;
-        if (isGatewayIsolatedTool(name)) {
-          const isolatedResult = await routeDurableMcpCall(ctx, name, args, { allowReadOnly: true, forceDurable: true });
-          if (isolatedResult) return isolatedResult;
-        }
-        const runtimeResult = await callRuntimeTool(ctx, name, args);
-        if (runtimeResult) return runtimeResult;
-        const durableResult = await routeDurableMcpCall(ctx, name, args);
-        if (durableResult) return durableResult;
-        const repositoryResult = await callRepositoryToolWithPostFinalizeAttribution(ctx.controllerHome, name, args, ctx);
-        if (repositoryResult) return repositoryResult;
-        return callMultiRepositoryTool(ctx, name, args);
+        const executeLocalTool = async (): Promise<CallToolResult> => {
+          if (name === 'execute_command' && args.scope === 'host') {
+            if (args.dry_run === true) {
+              return { content: [{ type: 'text', text: 'HOST_COMMAND_PREVIEW_UNSUPPORTED: host command preview requires a separate explicit grant-aware facility' }], structuredContent: { error: { code: 'HOST_COMMAND_PREVIEW_UNSUPPORTED' } }, isError: true };
+            }
+            if (args.repo_id !== undefined || args.checkout_id !== undefined || args.workspace_root !== undefined) {
+              return { content: [{ type: 'text', text: 'COMMAND_SCOPE_CONFLICT: host execution cannot claim repository or workspace targeting' }], structuredContent: { error: { code: 'COMMAND_SCOPE_CONFLICT', message: 'Host execution cannot claim repository or workspace targeting' } }, isError: true };
+            }
+            // One exposed command, two existing authorization targets. The host
+            // lane checks its canonical ForgeInstance process:exec Grant itself.
+            return executeAuthorizedHostCommand(ctx, args);
+          }
+          const accessResult = callAccessTool(ctx, name, args);
+          if (accessResult) return accessResult;
+          const executionResult = await callExecutionTool(ctx, name, args);
+          if (executionResult) return executionResult;
+          const processResult = await callProcessTool(ctx, name, args);
+          if (processResult) return processResult;
+          if (isGatewayIsolatedTool(name)) {
+            const isolatedResult = await routeDurableMcpCall(ctx, name, args, { allowReadOnly: true, forceDurable: true });
+            if (isolatedResult) return isolatedResult;
+          }
+          const runtimeResult = await callRuntimeTool(ctx, name, args);
+          if (runtimeResult) return runtimeResult;
+          const durableResult = await routeDurableMcpCall(ctx, name, args);
+          if (durableResult) return durableResult;
+          const repositoryResult = await callRepositoryToolWithPostFinalizeAttribution(ctx.controllerHome, name, args, ctx);
+          if (repositoryResult) return repositoryResult;
+          if (name === 'controller_capabilities') {
+            // Legacy read-only diagnostics consume the authoritative tools/list
+            // snapshot; legacy handlers must not import Runtime registries.
+            return await callMultiRepositoryTool({
+              ...ctx,
+              publishedToolNames: controllerExposureSnapshot(ctx).actualToolNames,
+            }, name, args);
+          }
+          return await callMultiRepositoryTool(ctx, name, args);
+        };
+        const localResult = await executeLocalTool();
+        // MCP calls are intermediate. Only the provider-observed final assistant
+        // response can close a Supervisor turn.
+        return settleCognitionAfterTool(ctx, name, args, localResult) ?? localResult;
       });
     }
     return callMcpTool(ctx, name, args);

package/adapters/mcp/setup.ts

@@ -24,8 +24,7 @@ import {
   MAX_AGENT_TIMEOUT_MS,
 } from "../../src/cli/controller/runtime-config";
 import { ensureControllerHome, ensureRepoPreferredControllerHome } from "../../src/cli/repositories/controller-home";
-import { accessModeForLegacyToolset } from "./access-mode";
-import { migrateControllerToolsetConfig } from "./toolset-selection";
+import { configuredControllerAccessMode } from './access-mode';
 import { ensureForgeInstanceIdentity, normalizeConfiguredForgeInstanceId, readForgeInstanceIdentity } from "../../packages/kernel/identity/api/index";
 import { discoverExecutable } from "../../src/runtime/platform/executable-discovery";
 
@@ -383,8 +382,6 @@ export function runMcpSetupChatgpt(opts: {
   const oauth = ensureMcpControllerHomeOAuthPassphrase(controllerHome);
   if (token.changed) changed.push(token.path);
   if (oauth.changed) changed.push(oauth.path);
-  const migratedToolset = migrateControllerToolsetConfig(existingConfig);
-  const toolset = migratedToolset.toolset;
   const config = {
     version: Math.max(existingConfig?.version ?? 1, 3),
     identity: { forgeInstanceId: forgeInstance.instanceId },
@@ -408,10 +405,7 @@ export function runMcpSetupChatgpt(opts: {
       localEndpoint: `http://127.0.0.1:${connectorPort}/mcp`,
     },
     profile: existingConfig?.profile ?? "controller",
-    toolset,
-    toolsetExplicit: migratedToolset.toolsetExplicit,
-    accessMode: existingConfig?.accessMode
-      ?? accessModeForLegacyToolset(existingConfig?.toolset ?? toolset),
+    accessMode: configuredControllerAccessMode(existingConfig),
     accessModeUpdatedAt: existingConfig?.accessModeUpdatedAt,
     accessModeRevision: existingConfig?.accessModeRevision ?? 0,
     localController: opts.userLevel && !existingConfig?.repo
@@ -419,11 +413,10 @@ export function runMcpSetupChatgpt(opts: {
           enabled: false,
           host: existingConfig?.localController?.host ?? "127.0.0.1",
           port: localControllerPort,
-          autoOpen: false,
           mode: "disabled",
         }
       : {
-          ...(existingConfig?.localController ?? { enabled: true, host: "127.0.0.1", autoOpen: false }),
+          ...(existingConfig?.localController ?? { enabled: true, host: "127.0.0.1" }),
           port: localControllerPort,
         },
     devMode: {
@@ -471,7 +464,7 @@ export function runMcpSetupChatgpt(opts: {
       `[forge mcp] Forge instance: ${forgeInstance.instanceId}`,
       opts.userLevel ? `[forge mcp] Scope: user (${controllerHome})` : `[forge mcp] Repo: ${repoRoot}`,
       "[forge mcp] Profile: controller",
-      `[forge mcp] Toolset: ${config.toolset}`,
+      '[forge mcp] Tools: complete Forge capability registry',
       `[forge mcp] ChatGPT MCP server name: ${serverName}`,
       `[forge mcp] Internal Runtime endpoint: http://${host}:${port}/mcp`,
       `[forge mcp] ChatGPT local OAuth endpoint: http://127.0.0.1:${connectorPort}/mcp`,
@@ -687,7 +680,7 @@ export function runMcpDoctor(opts: {
       : "not_adopted",
     repo: repoRoot,
     mcp: {
-      toolset: migrateControllerToolsetConfig(localConfig).toolset,
+      toolset: 'full',
       localConfig: existsSync(mcpControllerHomeLocalConfigPath(controllerHome)) || existsSync(
         join(repoRoot, ".forge", "mcp.local.json"),
       ),
@@ -701,7 +694,6 @@ export function runMcpDoctor(opts: {
         enabled: localConfig?.localController?.enabled ?? true,
         host: localConfig?.localController?.host ?? "127.0.0.1",
         port: localConfig?.localController?.port ?? 8766,
-        autoOpen: localConfig?.localController?.autoOpen ?? false,
       },
       devMode: {
         agentRunner: localConfig?.devMode?.agentRunner === true,

package/adapters/mcp/tool-mapping/access-tools.ts

@@ -167,8 +167,6 @@ function accessStatePayload(
   effective = resolveControllerAccessState({
     controllerHome: ctx.controllerHome,
     repoRoot: ctx.explicitRepository?.canonicalRoot,
-    toolsetOverride: ctx.toolset,
-    toolsetLocked: ctx.toolsetLocked,
   }),
 ) {
   const repositoryPolicy = readRepositoryAccessPolicy(ctx.controllerHome, repository.repoId);
@@ -206,8 +204,6 @@ function previewPayload(
   const currentEffective = resolveControllerAccessState({
     controllerHome: ctx.controllerHome,
     repoRoot: ctx.explicitRepository?.canonicalRoot,
-    toolsetOverride: ctx.toolset,
-    toolsetLocked: ctx.toolsetLocked,
   });
   const currentPolicy = readRepositoryAccessPolicy(ctx.controllerHome, repository.repoId);
   const currentGroups = accessToolGroups(currentEffective.effectiveAccessMode);
@@ -280,8 +276,6 @@ export function callAccessTool(
       const effective = resolveControllerAccessState({
         controllerHome: ctx.controllerHome,
         repoRoot: ctx.explicitRepository?.canonicalRoot,
-        toolsetOverride: ctx.toolset,
-        toolsetLocked: ctx.toolsetLocked,
       });
       return result({
         ...accessStatePayload(ctx, repository, configured, effective),