@programinglive/dev-workflow-mcp-server 1.12.1 → 1.13.1

package/.dockerignore

@@ -12,6 +12,30 @@ yarn-error.log
 .env
 .env.local
 .env.*.local
+**/.env*
+**/.npmrc
+**/.ssh
+**/.docker
+**/.aws
+**/.kube
+**/.config/gcloud
+**/.git-credentials
+**/.netrc
+**/.aws
+**/.kube
+**/.config/gcloud
+**/.git-credentials
+**/.netrc
+**/*credentials*.json
+**/service-account*.json
+**/id_rsa*
+**/id_ed25519*
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+.state
+**/*.db*
 
 # Development files
 *.log

package/.env.example

@@ -1,32 +1,12 @@
-# Database Configuration
-# Supported types: sqlite, mysql, postgres
+# Strict mode is the default and the only supported mode.
+DEV_WORKFLOW_SECURITY_MODE=strict
 DEV_WORKFLOW_DB_TYPE=sqlite
-
-# Connection URLs
-# MySQL Example: mysql://user:password@localhost:3306/database
-# Postgres Example: postgres://user:password@localhost:5432/database
-# Postgres Docker Example: postgres://devworkflow:password@postgres:5432/devworkflow
-DEV_WORKFLOW_DB_URL=
-
-# Optional: Override user ID
-# DEV_WORKFLOW_USER_ID=my-custom-user-id
-
-# ── Homelab Development ───────────────────────────────────────────────────────
-# These are reference values. Replace with your actual credentials.
-# Never commit this file with real values — use .env instead.
-
-# GitHub
-GH_TOKEN=
-
-# GitLab (profile mahardhika)
-GL_TOKEN=
-
-# Cloudflare (for wrangler / CDN)
-CF_ACCOUNT_ID=
-CF_API_TOKEN=
-
-# Tailscale (for auth key generation, optional)
-TAILSCALE_AUTH_KEY=
-
-# SSH config — do NOT store private keys here.
-# Private keys stay in ~/.ssh/ on each machine.
+# Supply PROJECT_DATABASE_URL privately through your shell/service manager.
+# Do not put its value in MCP client JSON or knowledge records.
+DEV_WORKFLOW_DB_URL_ENV=
+# For PostgreSQL/MySQL: DEV_WORKFLOW_DB_URL_ENV=PROJECT_DATABASE_URL
+# For SQLite, omit DEV_WORKFLOW_DB_URL_ENV or leave it empty.
+# Knowledge example: secret_ref: env://PROJECT_DATABASE_URL
+# Runtime-only web auth secrets must be independently generated (32+ characters).
+# JWT_SECRET and SESSION_SECRET: provision outside this example file.
+# Never commit real credentials.

package/README.md

@@ -1,5 +1,56 @@
 # Dev Workflow MCP Server
 
+## Credential isolation
+
+Never commit real credentials. Never store raw secrets inside the workflow
+knowledge database. Use environment variables or a secret manager.
+
+`DEV_WORKFLOW_SECURITY_MODE=strict` is the default and only supported mode.
+Knowledge may describe credential locations and requirements using SecretReference:
+
+```yaml
+database:
+  host: db.internal
+  secret_ref: env://PROJECT_DATABASE_URL
+  classification: INTERNAL
+```
+
+Supported reference metadata: `env://VARIABLE_NAME`, `op://vault/item/field`,
+`vault://path/to/secret`, `aws-secrets://secret-name`, `gcp-secret://secret-name`,
+`bitwarden://item/field`. MCP does not resolve these references.
+
+For PostgreSQL/MySQL, client configuration should specify the variable name only:
+
+```json
+{"DEV_WORKFLOW_DB_TYPE":"postgres","DEV_WORKFLOW_DB_URL_ENV":"PROJECT_DATABASE_URL"}
+```
+
+Provision that variable in the server's service manager, shell or secret-manager
+launcher outside the model and client JSON. The legacy direct URL setting remains
+supported with a value-free deprecation warning. SQLite needs neither URL setting.
+
+Raw secret input and writes are rejected with sanitized findings. SECRET-labelled
+records are never returned; PUBLIC, INTERNAL (default) and CONFIDENTIAL records
+still pass through the output scanner. Use `npm run security:audit` or MCP
+`security_audit` for bounded, current-user/project findings. Protected files return
+metadata only; the audit does not read their content, resolve secrets or repair data.
+
+Migration: supply explicit `JWT_SECRET`, `SESSION_SECRET` (32+ characters) for their
+respective web servers and `ADMIN_PASSWORD` (16+ characters) to create an admin.
+Login now uses an HttpOnly cookie; `token` is no longer returned in JSON. Previously
+issued bearer tokens remain accepted until expiry. Update custom clients to cookie
+authentication. Browser cross-site cookie policies may require a same-site API domain.
+Compose requires explicit database credentials and `JWT_SECRET`; build its API from
+the repository root. Strict release tools accept the established `npm run release`
+syntax only; run other deployment commands in a trusted operator session.
+
+Read the [audit, threat model and migration plan](docs/security-audit.md) and
+[verification and remaining risks](docs/security-verification.md). Passing tests
+does not prove that all secrets are detected. Trusted executable repository scripts,
+external tools, runtime authentication stores, historical Git and backups still
+require operational controls. A credential already pasted into a model cannot be
+removed by this server.
+
 An MCP server that enforces development workflow discipline: **tests → documentation → commit → release**, with no way to skip a step.
 
 ```mermaid
@@ -86,12 +137,14 @@ See [MCP client configuration](#mcp-client-configuration).
 | `project_summary_data` | Read the persisted `project-summary.json` |
 | `project_summary_db` | Read the per-user summary from SQLite |
 | `list_factory_tasks` | List your Factory task queue (requires config) |
+| `create_factory_task` | Record a new task with a required definition of done |
+| `update_factory_task` | Edit a task, including filling a missing definition of done |
 | `claim_factory_task` | Claim a Factory task and start a local workflow |
 | `sync_task_status` | Report a status change back to Factory |
 
 ### Factory task integration
 
-Three tools connect this server to the **Factory** board at
+Five tools connect this server to the **Factory** board at
 `factory.programinglive.com`. They read and write the real task table
 (`factory_tasks`), not the retired PocketBase `activity_tasks` collection
 (which still exists but holds 0 records and never reached the board).
@@ -127,6 +180,8 @@ account only sees its own tasks.
 | Tool | Writes? | What it does |
 |---|---|---|
 | `list_factory_tasks` | no | Reads `GET /api/factory`, maps tasks plus their latest work session, and orders them status → priority. Defaults to `running, queued, backlog, review, blocked` |
+| `create_factory_task` | yes | Creates a task (`POST /api/factory {action:create_task}`). Requires `acceptance` and `definitionOfDone`; defaults to `backlog` so recording work never starts a worker run |
+| `update_factory_task` | yes | Edits title, description, acceptance or definitionOfDone (`POST /api/factory {action:update_task}`), sending the task's current version so Factory can reject a stale edit with 409 |
 | `claim_factory_task` | yes | Opens a work session (`POST /api/work {action:start}`), which is what turns the task `running` on the board, then starts a local workflow |
 | `sync_task_status` | yes | Uses the only endpoint that can produce the status; see the table below |
 
@@ -143,10 +198,40 @@ the endpoint that actually supports it:
 | `done` | — rejected | A human approves the work in Factory |
 
 `review` requires an active work session. Asking for it without one fails with
-"no active work session" instead of silently doing nothing — the task must be
+"no active work session" instead of silently doing nothing - the task must be
 claimed first. Full behaviour, limits (summary 2000 chars, step 240 chars) and
 troubleshooting live in [docs/factory-integration.md](docs/factory-integration.md).
 
+#### Review is reported once, not twice
+
+Factory reads a second `review` report as an **approval**, so a task can jump to
+`done` without a human deciding anything. That happened on 29 October 2026 to
+four tasks whose earlier session was already `review` while the board still said
+`backlog`.
+
+The client now refuses `review` when the latest lifecycle event for that task is
+a `work.review` or `task.done`, and says what to do instead:
+
+```
+Task "..." sudah pernah dilaporkan untuk review (work.review pada ...).
+Melaporkan review kedua kali dibaca Factory sebagai approval, ...
+Minta pemilik memutuskan: set done bila pekerjaan diterima, atau kembalikan
+ke backlog bila perlu dikerjakan ulang.
+```
+
+`blocked` and `paused` are unaffected: only `review` carries approval semantics.
+
+A later `work.paused` event re-opens the task, so rework can be reported again.
+That matters because `paused` is the only supported way back from `review` to
+`backlog`; without the exception the guard would block legitimate second
+reviews forever.
+
+#### Task ids are UUIDs
+
+`list_factory_tasks` prints the full UUID, because `sync_task_status` and
+`claim_factory_task` reject the 8-character short key. Earlier versions printed
+the short key, which forced agents to call `GET /api/factory` by hand.
+
 
 ### Example session
 
@@ -275,7 +360,7 @@ supported:
 ```bash
 # .env or environment variable
 DEV_WORKFLOW_DB_TYPE=postgres
-DEV_WORKFLOW_DB_URL=postgresql://user:pass@localhost:5432/devworkflow
+DEV_WORKFLOW_DB_URL=postgresql://USER:[REDACTED]@HOST:5432/database
 ```
 
 | Variable | Default | Description |
@@ -373,8 +458,8 @@ The two skipped tests are the MySQL and PostgreSQL adapters. They run only when
 database is reachable:
 
 ```bash
-TEST_MYSQL_URL=mysql://user:pass@localhost:3306/db npm test
-TEST_POSTGRES_URL=postgres://user:pass@localhost:5432/db npm test
+TEST_MYSQL_URL=mysql://USER:[REDACTED]@HOST:5432/database npm test
+TEST_POSTGRES_URL=postgres://USER:[REDACTED]@HOST:5432/database npm test
 ```
 
 To exercise them against real servers without exposing them publicly:
@@ -518,9 +603,27 @@ installed. Run `npm install` in the repo.
 because there is no prebuild for your Node ABI. Either switch to a Node version
 that has one, or install Visual Studio Build Tools.
 
-**`EPERM ... better_sqlite3.node`** — a running process holds the file. Stop it,
+**`EPERM ... better_sqlite3.node`** - a running process holds the file. Stop it,
 then reinstall.
 
+**`commit_and_push` says "No changes detected" while the project clearly has
+changes** - git ran in the wrong repository. The server used to fall back to its
+own package directory, which is also a git repo, so commits landed there (or
+nowhere) instead of in your project. It now refuses to run git in the package
+repo and asks for the project explicitly:
+
+```bash
+export WORKFLOW_PROJECT_DIR=/path/to/your/project
+```
+
+Point it at any directory inside the project; the repo root is discovered
+upward. Non-git commands are unaffected.
+
+**A task jumped straight to `done` after reporting `review`** - it was reported
+twice. Factory treats the second report as approval. Current versions block that
+at the client, but if it already happened, review the task and move it back to
+`backlog` if the work is not accepted.
+
 **OpenCode does not load the server** — check the config shape. V2 requires
 `mcp.servers` and rejects `enabled`:
 

package/db/adapters/base.js

@@ -1,6 +1,38 @@
+import { assertSafeKnowledge } from '../../security/policy.js';
+import { securityOutputFilter } from '../../security/sanitizer.js';
+
+/**
+ * Nilai `task_type` yang selalu boleh masuk kolom NOT NULL.
+ *
+ * MENGAPA ADA
+ * -----------
+ * Kolom `workflow_history.task_type` adalah NOT NULL, tetapi entri history
+ * yang lebih tua tidak selalu punya nilainya: penanda `dropped` versi lama
+ * ditulis tanpa `taskType` sama sekali, dan sebagian entri `forced` menyimpan
+ * string kosong. Saat `undefined` di-bind, driver mengubahnya menjadi NULL dan
+ * SQLite menolak dengan `NOT NULL constraint failed: workflow_history.task_type`.
+ *
+ * Dulu kegagalan itu membatalkan seluruh `syncToDatabase()`: ringkasan proyek
+ * dan state workflow ikut tidak pernah ditulis, jadi riwayat proyek diam-diam
+ * berhenti tersimpan. Normalisasi di sini membuat data lama tetap dapat
+ * disinkronkan tanpa menebak isi aslinya.
+ */
+export function normalizeTaskType(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : 'other';
+}
+
 export class DbAdapter {
     constructor(config = {}) {
         this.config = config;
+        // Guard direct adapter use as well as the db/index facade.
+        for (const name of ['insertHistoryEntry','saveState','updateSummaryForUser']) {
+            const operation=this[name].bind(this);
+            this[name]=async(...args)=>{assertSafeKnowledge(args);return operation(...args);};
+        }
+        for (const name of ['getState','getHistoryForUser','getSummaryForUser','getHistorySummary']) {
+            const operation=this[name].bind(this);
+            this[name]=async(...args)=>securityOutputFilter(await operation(...args));
+        }
     }
 
     async connect() {

package/db/adapters/mysql.js

@@ -1,5 +1,6 @@
 import mysql from "mysql2/promise";
-import { DbAdapter } from "./base.js";
+import { DbAdapter, normalizeTaskType } from "./base.js";
+import { assertSafeKnowledge, classify } from '../../security/policy.js';
 
 const FREQUENCY_FORMATS = {
     daily: "%Y-%m-%d",
@@ -69,6 +70,8 @@ export class MysqlAdapter extends DbAdapter {
         )
       `);
 
+            const [classificationColumns]=await conn.query("SHOW COLUMNS FROM workflow_history LIKE 'classification'");
+            if(!classificationColumns.length) await conn.query("ALTER TABLE workflow_history ADD COLUMN classification VARCHAR(20) NOT NULL DEFAULT 'INTERNAL'");
             // Indexes are effectively covered by PRIMARY/UNIQUE keys, but we can add secondary if needed.
         } finally {
             conn.release();
@@ -89,27 +92,28 @@ export class MysqlAdapter extends DbAdapter {
         // MySQL INSERT ON DUPLICATE KEY UPDATE
         const query = `
       INSERT INTO workflow_history
-      (user_id, project_path, task_description, task_type, commit_message, timestamp, forced, force_reason, dropped, drop_reason)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      (user_id, project_path, task_description, task_type, commit_message, timestamp, forced, force_reason, dropped, drop_reason, classification)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON DUPLICATE KEY UPDATE
         commit_message=VALUES(commit_message),
         forced=VALUES(forced),
         force_reason=VALUES(force_reason),
         dropped=VALUES(dropped),
-        drop_reason=VALUES(drop_reason)
+        drop_reason=VALUES(drop_reason), classification=VALUES(classification)
     `;
 
         await this.pool.execute(query, [
             userId,
             normalizedProjectPath,
             entry.taskDescription,
-            entry.taskType,
+            normalizeTaskType(entry.taskType),
             entry.commitMessage,
             this.formatDate(entry.timestamp),
             entry.forced ? 1 : 0,
             entry.forceReason || null,
             entry.dropped ? 1 : 0,
-            entry.dropReason || null
+            entry.dropReason || null,
+            classify(entry)
         ]);
 
         await this.updateSummaryForUser(userId, normalizedProjectPath);
@@ -120,7 +124,7 @@ export class MysqlAdapter extends DbAdapter {
         const normalizedProjectPath = projectPath || '';
 
         const [rows] = await this.pool.execute(`
-      SELECT task_type, timestamp, task_description
+      SELECT classification, task_type, timestamp, task_description
       FROM workflow_history
       WHERE user_id = ? AND project_path = ?
       ORDER BY timestamp DESC
@@ -132,7 +136,9 @@ export class MysqlAdapter extends DbAdapter {
             taskTypes[row.task_type] = (taskTypes[row.task_type] || 0) + 1;
         }
 
+        assertSafeKnowledge(rows);
         const recentTasks = rows.slice(0, 5).map(r => ({
+            classification: r.classification,
             description: r.task_description,
             type: r.task_type,
             timestamp: r.timestamp,

package/db/adapters/postgres.js

@@ -1,5 +1,6 @@
 import pg from "pg";
-import { DbAdapter } from "./base.js";
+import { DbAdapter, normalizeTaskType } from "./base.js";
+import { assertSafeKnowledge, classify } from '../../security/policy.js';
 
 const { Pool } = pg;
 
@@ -59,6 +60,7 @@ export class PostgresAdapter extends DbAdapter {
         )
       `);
 
+            await client.query("ALTER TABLE workflow_history ADD COLUMN IF NOT EXISTS classification TEXT NOT NULL DEFAULT 'INTERNAL'");
             // Migration: Add columns to existing table if they don't exist
             const columns = await client.query(`
                 SELECT column_name FROM information_schema.columns WHERE table_name = 'workflow_history'
@@ -125,27 +127,28 @@ export class PostgresAdapter extends DbAdapter {
 
         const query = `
       INSERT INTO workflow_history
-      (user_id, project_path, description, task_type, commit_message, completed_at, forced, force_reason, dropped, drop_reason)
-      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+      (user_id, project_path, description, task_type, commit_message, completed_at, forced, force_reason, dropped, drop_reason, classification)
+      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
       ON CONFLICT (user_id, project_path, completed_at, description) DO UPDATE SET
         commit_message=EXCLUDED.commit_message,
         forced=EXCLUDED.forced,
         force_reason=EXCLUDED.force_reason,
         dropped=EXCLUDED.dropped,
-        drop_reason=EXCLUDED.drop_reason
+        drop_reason=EXCLUDED.drop_reason, classification=EXCLUDED.classification
     `;
 
         await this.pool.query(query, [
             numericUserId,
             normalizedProjectPath,
             entry.taskDescription || entry.description,
-            entry.taskType,
+            normalizeTaskType(entry.taskType),
             entry.commitMessage,
             entry.timestamp || entry.completed_at || new Date().toISOString(),
             entry.forced || false,
             entry.forceReason || null,
             entry.dropped || false,
-            entry.dropReason || null
+            entry.dropReason || null,
+            classify(entry)
         ]);
 
         await this.updateSummaryForUser(userId, normalizedProjectPath);
@@ -157,7 +160,7 @@ export class PostgresAdapter extends DbAdapter {
         const numericUserId = this.getNumericUserId(userId);
 
         const res = await this.pool.query(`
-      SELECT task_type, completed_at as timestamp, description as task_description
+      SELECT classification, task_type, completed_at as timestamp, description as task_description
       FROM workflow_history
       WHERE user_id = $1 AND project_path = $2
       ORDER BY completed_at DESC
@@ -172,7 +175,9 @@ export class PostgresAdapter extends DbAdapter {
             taskTypes[row.task_type] = (taskTypes[row.task_type] || 0) + 1;
         }
 
+        assertSafeKnowledge(rows);
         const recentTasks = rows.slice(0, 5).map(r => ({
+            classification: r.classification,
             description: r.task_description,
             type: r.task_type,
             timestamp: r.timestamp,

package/db/adapters/sqlite.js

@@ -1,7 +1,9 @@
+import { safeLog } from '../../security/sanitizer.js';
 import Database from "better-sqlite3";
 import { existsSync } from "fs";
 import path from "path";
-import { DbAdapter } from "./base.js";
+import { DbAdapter, normalizeTaskType } from "./base.js";
+import { assertSafeKnowledge, classify } from '../../security/policy.js';
 
 const DB_FILENAME = "dev-workflow.db";
 const FREQUENCY_FORMATS = {
@@ -32,7 +34,7 @@ export class SqliteAdapter extends DbAdapter {
             limit--;
         }
         if (limit === 0) {
-            console.error("Warning: Could not find project root effectively, defaulting to INIT_CWD");
+            safeLog('error', "Warning: Could not find project root effectively, defaulting to INIT_CWD");
             projectRoot = initCwd;
         }
         return path.join(projectRoot, ".state", DB_FILENAME);
@@ -89,6 +91,9 @@ export class SqliteAdapter extends DbAdapter {
     `;
 
         this.db.exec(createHistory);
+        if(!this.db.prepare('PRAGMA table_info(workflow_history)').all().some(col=>col.name==='classification')) {
+            this.db.exec("ALTER TABLE workflow_history ADD COLUMN classification TEXT NOT NULL DEFAULT 'INTERNAL'");
+        }
 
         // 2. MIGRATION: Handle existing databases (workflow_history)
         try {
@@ -104,7 +109,7 @@ export class SqliteAdapter extends DbAdapter {
                 // Duplicate entries from old schema (with no project_path) effectively mean project_path='' which matches new default.
             }
         } catch (e) {
-            console.error("Migration error (workflow_history):", e.message);
+            safeLog('error', "Migration error (workflow_history):", e.message);
         }
 
         // 3. MIGRATION: Handle project_summary (Drop and Recreate if schema mismatch)
@@ -147,27 +152,28 @@ export class SqliteAdapter extends DbAdapter {
         // SQLite upsert syntax
         const stmt = this.db.prepare(`
       INSERT INTO workflow_history
-      (user_id, project_path, task_description, task_type, commit_message, timestamp, forced, force_reason, dropped, drop_reason)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      (user_id, project_path, task_description, task_type, commit_message, timestamp, forced, force_reason, dropped, drop_reason, classification)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(user_id, project_path, timestamp, task_description) DO UPDATE SET
         commit_message=excluded.commit_message,
         forced=excluded.forced,
         force_reason=excluded.force_reason,
         dropped=excluded.dropped,
-        drop_reason=excluded.drop_reason
+        drop_reason=excluded.drop_reason, classification=excluded.classification
     `);
 
         stmt.run(
             userId,
             normalizedProjectPath,
             entry.taskDescription,
-            entry.taskType,
+            normalizeTaskType(entry.taskType),
             entry.commitMessage,
             entry.timestamp || new Date().toISOString(),
             entry.forced ? 1 : 0,
             entry.forceReason || null,
             entry.dropped ? 1 : 0,
-            entry.dropReason || null
+            entry.dropReason || null,
+            classify(entry)
         );
 
         await this.updateSummaryForUser(userId, normalizedProjectPath);
@@ -178,7 +184,7 @@ export class SqliteAdapter extends DbAdapter {
         const normalizedProjectPath = projectPath || '';
 
         const getHistory = this.db.prepare(`
-      SELECT task_type, timestamp, task_description
+      SELECT classification, task_type, timestamp, task_description
       FROM workflow_history
       WHERE user_id = ? AND project_path = ?
       ORDER BY timestamp DESC
@@ -191,7 +197,9 @@ export class SqliteAdapter extends DbAdapter {
             taskTypes[row.task_type] = (taskTypes[row.task_type] || 0) + 1;
         }
 
+        assertSafeKnowledge(rows);
         const recentTasks = rows.slice(0, 5).map(r => ({
+            classification: r.classification,
             description: r.task_description,
             type: r.task_type,
             timestamp: r.timestamp,

package/db/index.js

@@ -1,6 +1,7 @@
 import { SqliteAdapter } from "./adapters/sqlite.js";
 import { MysqlAdapter } from "./adapters/mysql.js";
 import { PostgresAdapter } from "./adapters/postgres.js";
+import { databaseConnectionUrl } from '../security/config.js';
 
 let adapterInstance = null;
 
@@ -11,7 +12,7 @@ export async function getAdapter() {
 
   const type = (process.env.DEV_WORKFLOW_DB_TYPE || "sqlite").toLowerCase();
   const config = {
-    connectionUrl: process.env.DEV_WORKFLOW_DB_URL,
+    connectionUrl: databaseConnectionUrl(),
     dbPath: process.env.DEV_WORKFLOW_DB_PATH // optional override for sqlite
   };
 

package/docker-compose.yml

@@ -7,7 +7,7 @@ services:
     restart: unless-stopped
     environment:
       POSTGRES_USER: ${POSTGRES_USER:-devworkflow}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-devworkflow_secure_password_change_me}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Provision POSTGRES_PASSWORD privately}
       POSTGRES_DB: ${POSTGRES_DB:-devworkflow}
     ports:
       - "5432:5432"
@@ -21,14 +21,16 @@ services:
 
   api:
     build:
-      context: ./web
-      dockerfile: Dockerfile.api
+      context: .
+      dockerfile: web/Dockerfile.api
     container_name: dev-workflow-api
     ports:
       - "8080:8080"
     environment:
-      - DEV_WORKFLOW_DB_URL=${DEV_WORKFLOW_DB_URL}
-      - SESSION_SECRET=${SESSION_SECRET:-dev-workflow-secret-change-in-production}
+      - DEV_WORKFLOW_DB_URL_ENV=PROJECT_DATABASE_URL
+      - PROJECT_DATABASE_URL=${PROJECT_DATABASE_URL:?Provision PROJECT_DATABASE_URL privately}
+      - JWT_SECRET=${JWT_SECRET:?Provision JWT_SECRET privately}
+      - DEV_WORKFLOW_SECURITY_MODE=strict
       - NODE_ENV=${NODE_ENV:-production}
       - API_PORT=8080
     depends_on:

package/exec.js

@@ -1,10 +1,22 @@
-import { exec as execCallback } from "child_process";
+import { exec as execCallback, execFile as execFileCallback } from "child_process";
 import { existsSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
+import { sanitize } from './security/sanitizer.js';
 
 const execPromise = promisify(execCallback);
+const execFilePromise = promisify(execFileCallback);
+
+/**
+ * Direktori paket server MCP ini.
+ *
+ * Penting: repo ini juga repo git. Kalau git dijalankan di sini, hasilnya
+ * "No changes detected" sementara perubahan proyek tidak pernah ter-commit -
+ * persis bug yang terjadi 29 Oktober 2026 saat `commit_and_push` melaporkan
+ * commit `docs(release): catat rilis 1.12.3` milik repo paket, bukan repo kerja.
+ */
+export const PACKAGE_DIR = path.dirname(fileURLToPath(import.meta.url));
 
 function findRepoRoot(startDir) {
   if (!startDir) {
@@ -32,18 +44,72 @@ function findRepoRoot(startDir) {
   }
 }
 
-function getDefaultCwd() {
-  const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-  const candidateDirs = [process.cwd(), process.env.INIT_CWD, moduleDir];
-  return candidateDirs.reduce((resolved, candidate) => {
-    if (resolved) {
-      return resolved;
+function samePath(a, b) {
+  return path.resolve(a).toLowerCase() === path.resolve(b).toLowerCase();
+}
+
+/**
+ * Menentukan direktori repo proyek tempat git boleh dijalankan.
+ *
+ * Urutan: eksplisit -> WORKFLOW_PROJECT_DIR/PROJECT_DIR -> kandidat.
+ * Repo paket MCP selalu dilewati; kalau tidak ada pilihan lain, lebih baik
+ * gagal dengan pesan jelas daripada commit ke repo yang salah.
+ */
+export function resolveWorkingDirectory({ explicit = "", env = process.env, candidates = [] } = {}) {
+  if (explicit) {
+    const root = findRepoRoot(explicit);
+    if (!root) {
+      throw new Error(`Direktori "${explicit}" bukan repo git (tidak ada .git).`);
+    }
+    return root;
+  }
+
+  const envDir = (env.WORKFLOW_PROJECT_DIR || env.PROJECT_DIR || "").trim();
+  if (envDir) {
+    const root = findRepoRoot(envDir);
+    if (!root) {
+      throw new Error(`WORKFLOW_PROJECT_DIR "${envDir}" bukan repo git (tidak ada .git).`);
     }
-    return findRepoRoot(candidate) || null;
-  }, null) || process.cwd();
+    return root;
+  }
+
+  const found = candidates.map((candidate) => findRepoRoot(candidate)).filter(Boolean);
+  const usable = found.find((dir) => !samePath(dir, PACKAGE_DIR));
+  if (usable) {
+    return usable;
+  }
+
+  throw new Error(
+    "Tidak bisa menentukan repo proyek: satu-satunya kandidat adalah repo paket server MCP. " +
+    "Set WORKFLOW_PROJECT_DIR ke direktori proyek, atau jalankan server MCP dari direktori proyek.",
+  );
 }
 
-export function exec(command, options = {}) {
-  const execOptions = options.cwd ? options : { ...options, cwd: getDefaultCwd() };
-  return execPromise(command, execOptions);
+function getDefaultCwd(command) {
+  try {
+    return resolveWorkingDirectory({
+      env: process.env,
+      candidates: [process.cwd(), process.env.INIT_CWD],
+    });
+  } catch (error) {
+    // Perintah non-git (echo, npm run release, ...) tidak butuh repo proyek.
+    // Yang berbahaya hanya git: di sana cwd menentukan repo mana yang diubah.
+    if (/^\s*git\b/i.test(String(command))) {
+      throw error;
+    }
+    return process.cwd();
+  }
+}
+
+export async function exec(command, options = {}) {
+  const {executable,arguments:args,...runtimeOptions}=options;
+  const execOptions = runtimeOptions.cwd ? runtimeOptions : { ...runtimeOptions, cwd: getDefaultCwd(executable || command) };
+  try { return sanitize(await (executable ? execFilePromise(executable,args,{...execOptions,shell:false}) : execPromise(command, execOptions))); }
+  catch(error) {
+    const safe=new Error(sanitize(error.message));
+    safe.code=error.code;
+    safe.stdout=sanitize(error.stdout || '');
+    safe.stderr=sanitize(error.stderr || '');
+    throw safe;
+  }
 }