@programinglive/dev-workflow-mcp-server 1.12.1 → 1.13.1

package/tools/handler-modules/factory-handlers.js

@@ -6,6 +6,7 @@ import {
   findTask,
   claimTask,
   updateTaskStatus,
+  updateTaskDetails,
   createTask,
   listProjects,
   formatTaskList,
@@ -149,6 +150,7 @@ export async function handleClaimFactoryTask(args = {}, { workflowState } = {})
           : "",
         `Factory status is now running (work session ${session.id}).`,
         task.projectName ? `Project: ${task.projectName}` : "",
+        task.definitionOfDone ? `Definition of done:\n${task.definitionOfDone}` : "",
         "",
         "Local workflow started for this task.",
         "Use 'sync_task_status' with review, blocked or paused to close the session, or done to approve the task once it is in review.",
@@ -199,10 +201,23 @@ export async function handleSyncTaskStatus(args = {}) {
     // ditolak server dan hanya mengaburkan keadaan papan.
     stopKeeping();
 
+    // Checklist dibaca lagi setelah status berubah: DoD bisa saja dilengkapi
+    // sejak claim, dan agen perlu kriteria terbaru saat melaporkan selesai.
+    // Kegagalan bacaan tambahan ini tidak boleh membuat laporan status yang
+    // sudah berhasil terlihat gagal.
+    let definitionOfDone = "";
+    try {
+      const task = await findTask(config, recordId);
+      definitionOfDone = String(task?.definitionOfDone || "").trim();
+    } catch {
+      definitionOfDone = "";
+    }
+
     return textResponse(
       [
         `Updated ${recordId} to ${result.status}.`,
         result.session?.summary ? `Summary: ${result.session.summary}` : "",
+        definitionOfDone ? `Definition of done:\n${definitionOfDone}` : "",
         result.status === "review" ? "Waiting for human approval in Factory." : "",
       ]
         .filter(Boolean)
@@ -241,6 +256,7 @@ export async function handleCreateFactoryTask(args = {}) {
 
   const title = typeof args.title === "string" ? args.title.trim() : "";
   const acceptance = typeof args.acceptance === "string" ? args.acceptance.trim() : "";
+  const definitionOfDone = typeof args.definitionOfDone === "string" ? args.definitionOfDone.trim() : "";
 
   if (!title) {
     return textResponse("Provide 'title' for the task (3-140 characters).");
@@ -253,6 +269,17 @@ export async function handleCreateFactoryTask(args = {}) {
       ].join("\n"),
     );
   }
+  if (!definitionOfDone) {
+    return textResponse(
+      [
+        "Provide 'definitionOfDone': the checklist that must be true before this task can be marked done.",
+        "Use one condition per line, for example:",
+        "- [ ] build lulus",
+        "- [ ] halaman login terverifikasi",
+        "It is stored separately from 'acceptance', which also carries the ```run block for the worker.",
+      ].join("\n"),
+    );
+  }
   if (!args.projectId) {
     return textResponse(
       "Provide 'projectId'. Run 'list_factory_projects' first - Factory needs a real project UUID.",
@@ -265,6 +292,7 @@ export async function handleCreateFactoryTask(args = {}) {
       title,
       description: args.description,
       acceptance,
+      definitionOfDone,
       priority: args.priority,
       status: args.status,
     });
@@ -286,3 +314,59 @@ export async function handleCreateFactoryTask(args = {}) {
     return textResponse(`Could not create the task: ${error.message}`);
   }
 }
+
+/**
+ * Edits an existing task, mainly to fill the definition of done of a task that
+ * was created before Factory required it.
+ *
+ * Local validation runs first so an empty request never reaches the network.
+ */
+export async function handleUpdateFactoryTask(args = {}) {
+  const { config, response } = requireConfig();
+  if (!config) return response;
+
+  const recordId = typeof args.recordId === "string" ? args.recordId.trim() : "";
+  if (!recordId) {
+    return textResponse("Provide the 'recordId' of the task to update (see list_factory_tasks).");
+  }
+
+  const hasField = ["title", "description", "acceptance", "definitionOfDone"].some(
+    (field) => typeof args[field] === "string",
+  );
+  if (!hasField) {
+    return textResponse(
+      [
+        "Provide at least one field to update: title, description, acceptance or definitionOfDone.",
+        "To fill a missing definition of done, pass definitionOfDone as a checklist, one condition per line.",
+      ].join("\n"),
+    );
+  }
+
+  try {
+    const result = await updateTaskDetails(config, {
+      recordId,
+      title: args.title,
+      description: args.description,
+      acceptance: args.acceptance,
+      definitionOfDone: args.definitionOfDone,
+    });
+
+    return textResponse(
+      [
+        `Updated ${recordId}.`,
+        result.updatedAt ? `Task version is now ${result.updatedAt}.` : "",
+      ]
+        .filter(Boolean)
+        .join("\n"),
+    );
+  } catch (error) {
+    // Factory menjawab 409 kalau task berubah sejak dibaca. Menyebut ulang
+    // langkah yang harus diambil lebih berguna daripada kode HTTP saja.
+    if (error?.status === 409) {
+      return textResponse(
+        `Could not update the task: ${error.message}\nReload the task with list_factory_tasks and try again with the current version.`,
+      );
+    }
+    return textResponse(`Could not update the task: ${error.message}`);
+  }
+}

package/tools/handler-modules/index.js

@@ -1,10 +1,16 @@
 import { textResponse, isReleaseSatisfied, isErrorResponse } from "./shared.js";
+import { assertSafeKnowledge } from '../../security/policy.js';
+import { safeLog, securityOutputFilter } from '../../security/sanitizer.js';
+import { securityAudit } from '../../security/audit.js';
+import path from 'node:path';
+import { assertSafeToolCommand } from '../../security/commands.js';
+import { sessionKeyFromRequest } from "../../workflow-state.js";
 import { handleStartTask, handleMarkBugFixed, handleCreateTests, handleSkipTests, handleRunTests, handleCreateDocumentation, handleCreateFeatureFlow } from "./workflow-handlers.js";
 import { handleSkipRelease, handlePerformRelease } from "./release-handlers.js";
 import { handleCommitAndPush, handleCompleteTask, handleForceCompleteTask, handleDropTask } from "./commit-handlers.js";
 import { handleProjectSummary, handleProjectSummaryData, handleProjectSummaryDb, handleViewHistory } from "./summary-handlers.js";
 import { handleGetWorkflowStatus, handleReadyCheck, handleContinueWorkflow, handleRerunWorkflow } from "./status-handlers.js";
-import { handleListFactoryTasks, handleClaimFactoryTask, handleSyncTaskStatus, handleListFactoryProjects, handleCreateFactoryTask } from "./factory-handlers.js";
+import { handleListFactoryTasks, handleClaimFactoryTask, handleSyncTaskStatus, handleListFactoryProjects, handleCreateFactoryTask, handleUpdateFactoryTask } from "./factory-handlers.js";
 
 function summarizeResponse(label, response) {
   const text = response?.content?.[0]?.text || "";
@@ -156,7 +162,7 @@ async function handleRunFullWorkflow(args, { workflowState, exec, git, utils })
   return textResponse(message);
 }
 
-export async function handleToolCall({
+async function dispatchToolCall({
   request,
   normalizeRequestArgs,
   workflowState,
@@ -166,6 +172,14 @@ export async function handleToolCall({
 }) {
   try {
     const { name } = request.params;
+
+    // Identitas sesi datang dari request metadata, bukan dari environment.
+    // Tanpa ini, satu proses MCP yang dipakai bergantian oleh beberapa sesi
+    // akan berbagi satu state dan saling menimpa task.
+    const sessionId = sessionKeyFromRequest(request);
+    if (sessionId && workflowState?.useSession) {
+      await workflowState.useSession(sessionId);
+    }
     const { args, error: argumentsError } = normalizeRequestArgs(request.params.arguments);
 
     if (argumentsError) {
@@ -173,6 +187,14 @@ export async function handleToolCall({
     }
 
     switch (name) {
+      case 'security_audit': {
+        const file=workflowState?.stateFile;
+        const marker=file?.replaceAll('\\','/').lastIndexOf('/.state/');
+        const root=marker>=0 ? file.slice(0,marker) : file ? path.dirname(file) : process.cwd();
+        const userId=process.env.DEV_WORKFLOW_USER_ID || (marker>=0?path.basename(path.dirname(file)):'default');
+        const report=await securityAudit({root,state:workflowState?.state,stateFile:file,userId});
+        return textResponse(JSON.stringify(report));
+      }
       case "start_task":
         return handleStartTask(args, workflowState);
       case "mark_bug_fixed":
@@ -223,6 +245,8 @@ export async function handleToolCall({
         return handleListFactoryProjects(args);
       case "create_factory_task":
         return handleCreateFactoryTask(args);
+      case "update_factory_task":
+        return handleUpdateFactoryTask(args);
       case "claim_factory_task":
         return handleClaimFactoryTask(args, { workflowState });
       case "sync_task_status":
@@ -231,9 +255,60 @@ export async function handleToolCall({
         throw new Error(`Unknown tool: ${name}`);
     }
   } catch (error) {
-    console.error("Tool handler error:", error);
+    safeLog('error', "Tool handler error:", error);
     return textResponse(
       "⚠️ Internal server error while processing the tool request. Please try again."
     );
   }
 }
+
+// Await every handler here so asynchronous rejections cannot bypass egress checks.
+export async function handleToolCall(context) {
+  try {
+    const {args,error}=context.normalizeRequestArgs(context.request.params.arguments);
+    if(error) return securityOutputFilter(textResponse(error));
+    assertSafeKnowledge({tool:context.request.params.name,args});
+    assertSafeToolCommand(context.request.params.name,args);
+    if (context.workflowState) context.workflowState.lastConflict = null;
+    const response=await dispatchToolCall({...context,request:{...context.request,params:{...context.request.params,arguments:args}}});
+    return securityOutputFilter(withConflictNotice(response, context.workflowState));
+  } catch(error) {
+    if(['SECRET_CONTENT_DENIED','UNSAFE_COMMAND_DENIED'].includes(error.code)) {
+      return {isError:true,content:[{type:'text',text:JSON.stringify({error:error.code,message:error.message,findings:error.findings})}]};
+    }
+    safeLog('error','Tool request failed',error);
+    return {isError:true,content:[{type:'text',text:'⚠️ Internal server error while processing the tool request.'}]};
+  }
+}
+
+/**
+ * Tempelkan peringatan bila penyimpanan terakhir kalah dari proses lain.
+ *
+ * Tanpa ini, tool menjawab "berhasil" untuk state yang sebenarnya tidak
+ * tersimpan. Kejadian 29 Okt 2026: `start_task` menjawab "✅ Task Started",
+ * tetapi `get_workflow_status` berikutnya menampilkan task lain.
+ */
+function withConflictNotice(response, workflowState) {
+  const conflict = workflowState?.lastConflict;
+  if (!conflict) {
+    return response;
+  }
+  const text = response?.content?.[0]?.text;
+  if (typeof text !== "string") {
+    return response;
+  }
+  // Peringatan ditaruh DI DEPAN, dan menyebut terus terang bahwa aksi tadi
+  // tidak berlaku. Menempelkan "✅ berhasil" di atas peringatan membuat agen
+  // membaca baris pertama lalu melanjutkan seolah semuanya tersimpan.
+  const notice =
+    `⚠️ AKSI TIDAK BERLAKU - proses MCP lain memulai task yang lebih baru.\n` +
+    `   Task di disk : "${conflict.diskTask}"\n` +
+    `   Task Anda    : "${conflict.staleTask || '(kosong)'}"\n` +
+    `   State Anda sudah dimuat ulang dari disk, jadi langkah berikutnya mengikuti task di disk.\n` +
+    `   Jalankan ulang aksi ini bila memang untuk task tersebut, atau 'start_task' untuk menggantinya.\n\n` +
+    `--- pesan asli tool (TIDAK tersimpan) ---\n`;
+  return {
+    ...response,
+    content: [{ ...response.content[0], text: notice + text }, ...response.content.slice(1)],
+  };
+}

package/tools/handler-modules/shared.js

@@ -2,6 +2,7 @@ import fs from "fs/promises";
 import { existsSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
+import { sanitize } from '../../security/sanitizer.js';
 
 export const PROJECT_SUMMARY_FILENAME = "project-summary.json";
 
@@ -12,7 +13,7 @@ export const textResponse = (text) => ({
   content: [
     {
       type: "text",
-      text,
+      text: sanitize(text),
     },
   ],
 });
@@ -54,6 +55,7 @@ export function formatChecklist(checks) {
 }
 
 export function summarizeHistory(history, limit) {
+  history = sanitize(history);
   const recent = history.slice(-limit).reverse();
   if (recent.length === 0) {
     return null;
@@ -70,6 +72,7 @@ export function summarizeHistory(history, limit) {
 }
 
 export function generateProjectSummary(history) {
+  history = sanitize(history);
   if (!history || history.length === 0) {
     return "No workflow history available.";
   }
@@ -137,7 +140,7 @@ export async function loadProjectSummary(workflowState) {
   const summaryPath = path.join(path.dirname(workflowState.stateFile), PROJECT_SUMMARY_FILENAME);
   try {
     const data = await fs.readFile(summaryPath, "utf-8");
-    return JSON.parse(data);
+    return sanitize(JSON.parse(data));
   } catch (error) {
     if (error?.code === "ENOENT") {
       return null;

package/tools/handler-modules/status-handlers.js

@@ -14,7 +14,7 @@ export async function handleGetWorkflowStatus(workflowState) {
       const owner = disk.owner || {};
       sharedWarning =
         `\n\n⚠️ PERINGATAN: berkas state ini terakhir ditulis proses MCP LAIN ` +
-        `(${owner.token || "tanpa-token"}, pid ${owner.pid ?? "?"}).\n` +
+        `(${owner.processMarker || "tanpa-token"}, pid ${owner.pid ?? "?"}).\n` +
         `   State workflow dipakai bersama antar sesi di mesin ini.\n` +
         `   Periksa apakah "Task:" di atas benar-benar milik Anda SEBELUM commit_and_push.`;
       if (disk.currentPhase && disk.currentPhase !== "idle" && disk.taskDescription) {

package/tools/handler-modules/summary-handlers.js

@@ -1,5 +1,6 @@
 import fs from "fs/promises";
 import path from "path";
+import { sanitize } from '../../security/sanitizer.js';
 import { textResponse, generateProjectSummary, summarizeHistory, PROJECT_SUMMARY_FILENAME } from "./shared.js";
 
 export function handleProjectSummary(workflowState) {
@@ -11,7 +12,7 @@ export async function handleProjectSummaryData(workflowState) {
   const summaryPath = path.join(path.dirname(workflowState.stateFile), PROJECT_SUMMARY_FILENAME);
   try {
     const data = await fs.readFile(summaryPath, "utf-8");
-    const parsed = JSON.parse(data);
+    const parsed = sanitize(JSON.parse(data));
     const formatted = `🧠 Project Knowledge Summary (from persisted data)\n\n📊 Stats\n- Total tasks completed: ${parsed.totalTasks}\n- Recent task mix: ${Object.entries(parsed.taskTypes).map(([t, c]) => `${t}: ${c}`).join(", ")}\n- Last active: ${parsed.lastActive ? new Date(parsed.lastActive).toLocaleDateString() : "Never"}\n- Updated: ${new Date(parsed.updatedAt).toLocaleString()}\n\n📝 Recent tasks (last 5)\n${parsed.recentTasks.map((e, i) => `${i + 1}. ${e.description} (${e.type})`).join("\n")}`;
     return textResponse(formatted);
   } catch (error) {

package/tools/handler-modules/workflow-handlers.js

@@ -1,3 +1,4 @@
+import { classify } from '../../security/policy.js';
 import { textResponse, isReleaseSatisfied, isErrorResponse, ensurePrdExists } from "./shared.js";
 
 export async function handleStartTask(args, workflowState) {
@@ -8,6 +9,7 @@ export async function handleStartTask(args, workflowState) {
   const { archivedTask } = workflowState.reset({ archive: true });
 
   workflowState.state.currentPhase = "coding";
+  workflowState.state.classification = classify(args);
   workflowState.state.taskDescription = args.description;
   workflowState.state.taskType = args.type;
   workflowState.state.testsSkipped = false;
@@ -15,7 +17,10 @@ export async function handleStartTask(args, workflowState) {
   workflowState.state.commitAndPushCompleted = false;
   workflowState.state.lastCommitMessage = "";
   workflowState.state.lastPushBranch = "";
-  const reconciled = await workflowState.save();
+  // start_task memang bermaksud MENGGANTI task, jadi ia boleh menang atas
+  // task berjalan. Task yang diganti tetap diarsipkan oleh reconcileWithDisk,
+  // bukan dihapus.
+  const reconciled = await workflowState.save({ allowReplaceRunningTask: true });
 
   const warnings = [];
   const preservedForeign = reconciled?.preservedTask || preservedBeforeSave?.preservedTask;

package/utils.js

@@ -3,6 +3,7 @@ const isWindows = process.platform === "win32";
 export function shellEscape(value) {
   const stringValue = String(value);
   if (isWindows) {
+    if(/["%!\r\n]/.test(stringValue)) throw new Error('Unsafe Windows shell argument denied; use a trusted operator session for complex messages.');
     // Windows cmd.exe requires double quotes for arguments with spaces.
     // Escape existing double quotes with backslash.
     return `"${stringValue.replace(/"/g, '\\"')}"`;

package/verify-build.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { safeLog } from './security/sanitizer.js';
 
 /**
  * Build Verification Script
@@ -22,16 +23,16 @@ let failedTests = 0;
 function test(name, fn) {
   try {
     fn();
-    console.log(`✓ ${name}`);
+    safeLog('info', `✓ ${name}`);
     passedTests++;
   } catch (error) {
-    console.error(`✗ ${name}`);
-    console.error(`  Error: ${error.message}`);
+    safeLog('error', `✗ ${name}`);
+    safeLog('error', `  Error: ${error.message}`);
     failedTests++;
   }
 }
 
-console.log('\n🧪 Running Build Verification Tests...\n');
+safeLog('info', '\n🧪 Running Build Verification Tests...\n');
 
 // Test 1: Build succeeds
 test('Build completes successfully', () => {
@@ -166,11 +167,11 @@ test('Vertical monitor responsive design', () => {
   }
 });
 
-console.log(`\n📊 Test Results: ${passedTests} passed, ${failedTests} failed\n`);
+safeLog('info', `\n📊 Test Results: ${passedTests} passed, ${failedTests} failed\n`);
 
 if (failedTests > 0) {
   process.exit(1);
 } else {
-  console.log('✅ All tests passed!\n');
+  safeLog('info', '✅ All tests passed!\n');
   process.exit(0);
 }

package/vite.config.js

@@ -1,6 +1,7 @@
 import { defineConfig } from 'vite';
 import { fileURLToPath } from 'url';
 import path from 'path';
+import { builtinModules } from 'node:module';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -17,6 +18,9 @@ export default defineConfig({
         format: 'es',
       },
       external: [
+        ...builtinModules,
+        ...builtinModules.map(name=>`node:${name}`),
+        'pg','mysql2','mysql2/promise','better-sqlite3',
         '@modelcontextprotocol/sdk',
         // dotenv ships CommonJS only (dist/index.cjs). Bundling it into an ES
         // module leaks its `require.main === module` guard, which throws