@mrrlin-dev/mcp 0.4.137 → 0.4.139

package/dist/bin.cjs

@@ -39293,7 +39293,7 @@ var mrrlinTaskUpdateSchema = external_exports.object({
   // fingerprint moved but the topology still maps the label to the same workflow. Never sent
   // by any other caller.
   reverifyRequested: external_exports.boolean().optional()
-}).refine((value) => value.assignee !== void 0 || value.autoDeploy !== void 0 || value.domains !== void 0 || value.autonomyLevel !== void 0 || value.autonomyReason !== void 0 || value.category !== void 0 || value.directorThreadId !== void 0 || value.directorThreadProvider !== void 0 || value.dueDate !== void 0 || value.followUpAt !== void 0 || value.impact !== void 0 || value.notes !== void 0 || value.planId !== void 0 || value.specApproved !== void 0 || value.specWikiPageId !== void 0 || value.status !== void 0 || value.subcategory !== void 0 || value.tags !== void 0 || value.title !== void 0 || value.type !== void 0 || value.verificationDueAt !== void 0 || value.deployTargets !== void 0 || value.reverifyRequested !== void 0, { message: "TaskUpdate requires at least one field" }).superRefine((value, context) => {
+}).refine((value) => value.assignee !== void 0 || value.autoDeploy !== void 0 || value.declaredOutcome !== void 0 || value.domains !== void 0 || value.autonomyLevel !== void 0 || value.autonomyReason !== void 0 || value.category !== void 0 || value.directorThreadId !== void 0 || value.directorThreadProvider !== void 0 || value.dueDate !== void 0 || value.followUpAt !== void 0 || value.impact !== void 0 || value.notes !== void 0 || value.planId !== void 0 || value.specApproved !== void 0 || value.specWikiPageId !== void 0 || value.status !== void 0 || value.subcategory !== void 0 || value.tags !== void 0 || value.title !== void 0 || value.type !== void 0 || value.verificationDueAt !== void 0 || value.deployTargets !== void 0 || value.reverifyRequested !== void 0, { message: "TaskUpdate requires at least one field" }).superRefine((value, context) => {
   if (value.autonomyLevel !== void 0 && value.autonomyReason === void 0) {
     context.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -58392,6 +58392,12 @@ function buildLocalStepEnv(baseEnv = process.env) {
   }
   return env;
 }
+function diagnoseGpgError(rawError) {
+  if (/gpg failed to sign|secret key not available|no pinentry|verifySignatures|gpgSign|gpg\.format/i.test(rawError)) {
+    return `git_gpg_signing_failed: operator git config has commit.gpgSign, tag.gpgSign, or merge.verifySignatures enabled, but headless bridge has no gpg-agent/pinentry. Operation aborted. Please configure headless gpg signing or disable commit.gpgSign for Mrrlin repository. (Details: ${rawError})`;
+  }
+  return rawError;
+}
 function git(repo, args) {
   return (0, import_node_child_process15.execFileSync)("git", gitArgs(repo, args), {
     encoding: "utf8",
@@ -58682,7 +58688,8 @@ function integrateDefaultBranch(input) {
     return { state: "conflict", defaultTipSha, files, preMergeHead, outsideConflicts: indexOutside(input.worktreePath, files) };
   }
   gitTry(input.worktreePath, ["merge", "--abort"]);
-  throw new Error(`local_integration_failed: ${merge2.stderr || merge2.stdout}`);
+  const errorMsg = diagnoseGpgError(merge2.stderr || merge2.stdout);
+  throw new Error(`local_integration_failed: ${errorMsg}`);
 }
 function restoreRunBranch(input) {
   if (!isDeliveryLockHeld(input.deliveryLock.locksDir, input.deliveryLock.key)) {
@@ -59393,8 +59400,33 @@ async function applyLocalRunForTool(deps, input) {
       timeout: 3e4,
       env: gitEnv()
     }).split("\n").filter((line) => line.length > 3).map((line) => line.slice(3));
-    if (changedByBuild.length > 0) {
-      const detail = `the build changed tracked files: ${changedByBuild.join(", ")}`;
+    const LOCKFILE_NAMES = /* @__PURE__ */ new Set([
+      "package-lock.json",
+      "pnpm-lock.yaml",
+      "yarn.lock",
+      "bun.lockb",
+      "bun.lock",
+      "Cargo.lock",
+      "Gemfile.lock",
+      "poetry.lock"
+    ]);
+    const isLockfile = (file2) => LOCKFILE_NAMES.has(import_node_path20.default.basename(file2));
+    const nonLockfiles = changedByBuild.filter((f) => !isLockfile(f));
+    const lockfilesChanged = changedByBuild.filter((f) => isLockfile(f));
+    if (lockfilesChanged.length > 0) {
+      for (const lf of lockfilesChanged) {
+        try {
+          (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "add", lf], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            env: gitEnv()
+          });
+        } catch {
+        }
+      }
+    }
+    if (nonLockfiles.length > 0) {
+      const detail = `the build changed tracked files: ${nonLockfiles.join(", ")}`;
       record2({ integration, applied: false, reason: "build_failed", headSha, detail, steps: build.steps, logs: build.logs });
       return { outcome: "build_failed", previousSha: null, headSha, detail };
     }
@@ -61195,7 +61227,19 @@ function createMrrlinTools(options) {
       "Unable to close task as won't-do.",
       async (c, { projectSlug, taskId, reason }) => {
         await checkTenantBoundary(projectSlug, "task");
-        return await c.closeTaskAsWontDo(projectSlug, taskId, reason);
+        const inboxItemId = `II-${taskId}-wont-do-${Date.now().toString(36)}`;
+        await c.createInboxItem(projectSlug, {
+          id: inboxItemId,
+          kind: "question",
+          taskId,
+          body: `Director proposes closing task ${taskId} as won't-do: ${reason}`,
+          questionOptions: [
+            { label: "Close as won't-do", answer: "close_as_wont_do", description: reason, recommended: true },
+            { label: "Keep task open", answer: "keep_open", description: "Keep the task open" }
+          ]
+        });
+        const task = await c.getTask(projectSlug, taskId);
+        return task;
       }
     ),
     // Task 8.2: routed through deliverBuiltIn, not c.updateWikiPage directly.
@@ -63666,7 +63710,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.137";
+var PKG_VERSION = "0.4.139";
 
 // src/bridge-allowed-origins.ts
 var DEFAULT_DIRECTOR_BRIDGE_ALLOWED_ORIGINS = [
@@ -74645,6 +74689,41 @@ function defaultReadinessRunner(provider) {
     return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
   };
 }
+function sanitizeExecutorEnv(baseEnv = process.env) {
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "TERM",
+    "TMPDIR",
+    "LANG",
+    "LC_ALL",
+    "NODE_ENV",
+    "NODE_PATH",
+    "NVM_BIN",
+    "NVM_DIR",
+    "PNPM_HOME",
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "GEMINI_API_KEY",
+    "CODEX_API_KEY",
+    "CODEX_HOME",
+    "EDITOR",
+    "GIT_AUTHOR_NAME",
+    "GIT_AUTHOR_EMAIL",
+    "GIT_COMMITTER_NAME",
+    "GIT_COMMITTER_EMAIL"
+  ]);
+  const sanitized = {};
+  for (const [key, value] of Object.entries(baseEnv)) {
+    if (value !== void 0 && (allowedKeys.has(key) || key.startsWith("NPM_CONFIG_") || key.startsWith("GIT_CONFIG_"))) {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
 function buildVerificationEnv(baseEnv = process.env) {
   const allowedKeys = /* @__PURE__ */ new Set([
     "PATH",
@@ -74692,8 +74771,8 @@ async function startExecutorServer(opts) {
     throw error51;
   }
   const isVerification = opts.brokerSocket != null || opts.brokerSocketFd != null;
-  const rawBaseEnv = opts.env ?? (isVerification ? buildVerificationEnv(process.env) : process.env);
-  const baseEnv = isVerification ? buildVerificationEnv(rawBaseEnv) : { ...rawBaseEnv };
+  const rawBaseEnv = opts.env ?? (isVerification ? buildVerificationEnv(process.env) : sanitizeExecutorEnv(process.env));
+  const baseEnv = isVerification ? buildVerificationEnv(rawBaseEnv) : sanitizeExecutorEnv(rawBaseEnv);
   const childEnv = withDisabledGitHooksEnv(baseEnv, opts.disabledGitHooksDir);
   const baseSpawn = opts.spawn ?? import_node_child_process25.spawn;
   const hasExtraFd = opts.brokerSocket != null || opts.brokerSocketFd != null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.4.137",
+  "version": "0.4.139",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"