@programinglive/dev-workflow-mcp-server 1.12.1 → 1.13.1

package/workflow-state.js

@@ -1,6 +1,9 @@
+import { safeLog } from './security/sanitizer.js';
 import fs from "fs/promises";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from "fs";
 import path from "path";
+import { assertSafeKnowledge } from './security/policy.js';
+import { sanitize } from './security/sanitizer.js';
 import { fileURLToPath } from "url";
 
 const __filename = fileURLToPath(import.meta.url);
@@ -30,6 +33,14 @@ let cachedUserStateDir = null;
  */
 const PROCESS_TOKEN = `proc-${process.pid}-${Math.random().toString(16).slice(2, 10)}`;
 
+function migrateOwnerMetadata(value) {
+  if(value?.owner && !value.owner.processMarker && /^proc-[A-Za-z0-9-]+$/.test(value.owner.token || '')) {
+    value.owner.processMarker=value.owner.token;
+    delete value.owner.token;
+  }
+  return value;
+}
+
 function generateUserId() {
   const timestamp = Date.now().toString(16);
   const randomSuffix = Math.random().toString(16).slice(2, 10);
@@ -249,6 +260,8 @@ async function migrateLegacyStateFile(targetPath) {
   }
 
   await fs.mkdir(stateDir, { recursive: true });
+  const migrated = migrateOwnerMetadata(JSON.parse(await fs.readFile(legacyPath, 'utf8')));
+  assertSafeKnowledge(migrated);
 
   try {
     await fs.access(targetPath);
@@ -258,7 +271,8 @@ async function migrateLegacyStateFile(targetPath) {
     // New state file doesn't exist yet; fall through to migrate.
   }
 
-  await fs.rename(legacyPath, targetPath);
+  await fs.writeFile(targetPath, JSON.stringify(migrated, null, 2), { flag: 'wx' });
+  await fs.unlink(legacyPath);
 }
 
 function isRootPath(candidate) {
@@ -338,6 +352,7 @@ async function ensureCompatibilityLinks(primaryPath) {
   if (!(await pathExists(resolvedPrimary))) {
     return;
   }
+  assertSafeKnowledge(JSON.parse(await fs.readFile(resolvedPrimary, 'utf8')));
 
   const compatibilityPaths = getCompatibilityPaths(resolvedPrimary);
 
@@ -413,18 +428,38 @@ async function ensureCompatibilityLinks(primaryPath) {
  *
  * MENGAPA ADA
  * -----------
- * Berkas state dulu disimpan per USER, jadi empat proses MCP berbagi satu
+ * Berkas state dulu disimpan per USER, jadi beberapa proses MCP berbagi satu
  * `workflow-state.json`. Akibatnya `start_task` di satu sesi mengganti task
  * sesi lain di tengah jalan, dan gerbang kualitas (ready check, tests, docs)
  * ikut dibagi sehingga sesi B bisa memakai hasil sesi A untuk commit.
  *
  * Sekarang task dan gerbangnya milik SESI; `history` tetap milik PROYEK.
  *
- * Urutannya sengaja: env eksplisit dulu (untuk tes dan pemanggil lain), lalu
- * id sesi editor, lalu proses. Jatuh ke proses membuat identitas tetap stabil
- * walau modul di-reload dalam proses yang sama.
+ * MENGAPA BUKAN ENV SAJA
+ * ----------------------
+ * Percobaan pertama membaca `OPENCODE_SESSION_ID` dari environment. OpenCode
+ * tidak men-set variabel itu, sehingga hampir semua berkas jatuh ke
+ * `pid-<pid>`; karena satu proses MCP dipakai bergantian oleh beberapa sesi,
+ * sesi-sesi itu tetap berbagi satu berkas dan saling menimpa.
+ *
+ * OpenCode v2 mengirim identitas sesi per panggilan di
+ * `CallToolRequest.params._meta["ai.opencode/sessionID"]`. Itu sumber utama
+ * sekarang; env tetap dibaca sebagai cadangan untuk tes dan pemanggil lain.
  */
-export function resolveSessionKey(env = process.env) {
+export const SESSION_META_KEY = "ai.opencode/sessionID";
+
+/** Mengambil identitas sesi dari request metadata MCP, atau null. */
+export function sessionKeyFromRequest(request) {
+  const value = request?.params?._meta?.[SESSION_META_KEY];
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed === "" ? null : trimmed;
+}
+
+export function resolveSessionKey(env = process.env, explicitSessionId = null) {
+  const fromRequest = typeof explicitSessionId === "string" ? explicitSessionId.trim() : "";
+  if (fromRequest) return sanitizeSessionKey(fromRequest);
+
   for (const candidate of [env.DEV_WORKFLOW_SESSION_ID, env.OPENCODE_SESSION_ID, env.CLIENT_SESSION_ID]) {
     const value = typeof candidate === "string" ? candidate.trim() : "";
     if (value) return sanitizeSessionKey(value);
@@ -438,8 +473,8 @@ function sanitizeSessionKey(value) {
 }
 
 /** Nama berkas state untuk sesi ini, di direktori user yang sama. */
-function sessionStateFilename(env = process.env) {
-  return `workflow-state.${resolveSessionKey(env)}.json`;
+function sessionStateFilename(env = process.env, explicitSessionId = null) {
+  return `workflow-state.${resolveSessionKey(env, explicitSessionId)}.json`;
 }
 
 /**
@@ -486,7 +521,7 @@ export function resolveProjectRootForState(stateFilePath) {
   return path.dirname(resolved);
 }
 
-export function resolveStateFile() {
+export function resolveStateFile({ sessionId = null } = {}) {
   const customPath = process.env.DEV_WORKFLOW_STATE_FILE;
   if (customPath) {
     return path.resolve(customPath);
@@ -516,7 +551,7 @@ export function resolveStateFile() {
 
   const stateDir = path.join(projectRoot, STATE_DIR);
   const userDir = getUserScopedDir(stateDir);
-  return path.join(userDir, sessionStateFilename());
+  return path.join(userDir, sessionStateFilename(process.env, sessionId));
 }
 
 export class WorkflowState {
@@ -525,6 +560,55 @@ export class WorkflowState {
     // History milik proyek, state milik sesi. Dalam tata letak nyata keduanya
     // berkas berbeda; untuk path eksplisit keduanya menunjuk berkas yang sama.
     this.historyFile = resolveHistoryFile(stateFilePath);
+    // Task yang terakhir kita baca dari / tulis ke disk. Dipakai untuk
+    // membedakan "task ini milik kita" dari "task ini ditulis proses lain
+    // sesudah kita memuat" - tanpa ini penulis basi menang tanpa perlawanan.
+    this.loadedTask = "";
+    // Konflik penyimpanan terakhir, dibaca oleh lapisan tool untuk memberi tahu
+    // pengguna. Null berarti penyimpanan terakhir aman.
+    this.lastConflict = null;
+    this.state = {
+      currentPhase: "idle",
+      classification: "INTERNAL",
+      taskDescription: "",
+      bugFixed: false,
+      testsCreated: false,
+      testsPassed: false,
+      testsSkipped: false,
+      testsSkippedReason: "",
+      documentationCreated: false,
+      readyToCommit: false,
+      readyCheckCompleted: false,
+      released: false,
+      releaseSkipped: false,
+      releaseSkippedReason: "",
+      releaseCommand: "",
+      releaseNotes: "",
+      commitAndPushCompleted: false,
+      lastCommitMessage: "",
+      lastPushBranch: "",
+      featureFlowCreated: false,
+      featureFlowDescription: "",
+      history: [],
+      taskType: "",
+    };
+  }
+
+  /**
+   * Berpindah ke state milik sesi tertentu.
+   *
+   * Satu proses MCP bisa melayani beberapa sesi bergantian, jadi state harus
+   * ditentukan per panggilan - bukan sekali saat proses start. Mengembalikan
+   * true bila berkas benar-benar berpindah.
+   */
+  async useSession(sessionId) {
+    const target = resolveStateFile({ sessionId });
+    if (target === this.stateFile) return false;
+
+    this.stateFile = target;
+    this.historyFile = resolveHistoryFile(target);
+    // Mulai dari state bersih, lalu muat milik sesi itu. Menyalin state sesi
+    // sebelumnya akan membuat sesi baru mewarisi gerbang kualitas sesi lain.
     this.state = {
       currentPhase: "idle",
       taskDescription: "",
@@ -549,13 +633,15 @@ export class WorkflowState {
       history: [],
       taskType: "",
     };
+    await this.load();
+    return true;
   }
 
   async load() {
     await migrateLegacyStateFile(this.stateFile);
     try {
       const data = await fs.readFile(this.stateFile, "utf-8");
-      const parsed = JSON.parse(data);
+      const parsed = sanitize(migrateOwnerMetadata(JSON.parse(data)));
       this.state = {
         ...this.state,
         ...parsed,
@@ -564,6 +650,7 @@ export class WorkflowState {
       // Run this as non-blocking to speed up startup
       ensureCompatibilityLinks(this.stateFile).catch(() => { });
       await this.mergeSharedHistory();
+      this.loadedTask = this.state.taskDescription || "";
       if (typeof this.state.testsCreated !== "boolean") {
         this.state.testsCreated = false;
       }
@@ -663,11 +750,14 @@ export class WorkflowState {
       }
     }
 
+    const payload = { ...shared, history: merged };
+    assertSafeKnowledge(payload);
     await fs.mkdir(path.dirname(this.historyFile), { recursive: true });
-    await fs.writeFile(this.historyFile, JSON.stringify({ ...shared, history: merged }, null, 2));
+    await fs.writeFile(this.historyFile, JSON.stringify(payload, null, 2));
   }
 
   async ensurePrimaryFile() {
+    assertSafeKnowledge(this.state);
     let created = false;
     try {
       await fs.access(this.stateFile);
@@ -684,10 +774,27 @@ export class WorkflowState {
     return created;
   }
 
-  async save() {
+  async save(options = {}) {
+    assertSafeKnowledge(this.state);
     const reconciled = await this.reconcileWithDisk();
+    assertSafeKnowledge(this.state);
+
+    // Penulis basi tidak boleh menang.
+    //
+    // Bug 29 Okt 2026: satu proses MCP memegang state lama, lalu menyimpan
+    // sesudah proses lain memulai task baru. Task baru tertimpa dan pemanggil
+    // tetap diberi tahu "berhasil" - `get_workflow_status` berikutnya
+    // menampilkan task yang sama sekali lain.
+    const conflict = this.detectStaleOverwrite(reconciled, options);
+    if (conflict) {
+      await this.adoptDiskState();
+      this.lastConflict = conflict;
+      return { ...reconciled, conflict, verified: false };
+    }
+    this.lastConflict = null;
+
     this.state.owner = {
-      token: PROCESS_TOKEN,
+      processMarker: PROCESS_TOKEN,
       pid: process.pid,
       updatedAt: new Date().toISOString(),
     };
@@ -699,9 +806,82 @@ export class WorkflowState {
     await this.updateProjectSummary();
     await this.syncToDatabase();
     this.lastReconcile = reconciled;
+    this.loadedTask = this.state.taskDescription || "";
+    await this.verifyPersisted(this.loadedTask);
     return reconciled;
   }
 
+  /**
+   * Apakah penyimpanan ini akan menimpa task berjalan milik proses lain?
+   *
+   * Konflik hanya kalau SEMUA ini benar:
+   *   - disk memuat task yang SEDANG berjalan (bukan idle),
+   *   - task di disk bukan task yang terakhir kita muat (jadi ditulis orang
+   *     lain sesudah kita membaca),
+   *   - task di disk bukan task yang akan kita tulis (jadi bukan kita sendiri),
+   *   - pemanggil tidak menyatakan maksud mengganti task.
+   *
+   * `start_task` memang bermaksud mengganti task, jadi ia memakai
+   * `allowReplaceRunningTask: true` dan tetap menang - tetapi task yang diganti
+   * diarsipkan oleh `reconcileWithDisk`, bukan dihapus.
+   */
+  detectStaleOverwrite(reconciled, options = {}) {
+    if (options.allowReplaceRunningTask === true) {
+      return null;
+    }
+    const diskTask = reconciled?.diskTask || "";
+    const diskPhase = reconciled?.diskPhase || "idle";
+    if (!diskTask || diskPhase === "idle") {
+      return null;
+    }
+    if (diskTask === this.loadedTask) {
+      return null;
+    }
+    if (diskTask === (this.state.taskDescription || "")) {
+      return null;
+    }
+    return {
+      diskTask,
+      staleTask: this.state.taskDescription || "",
+      diskPhase,
+    };
+  }
+
+  /** Ambil state dari disk apa adanya, dengan history digabung, tanpa menulis. */
+  async adoptDiskState() {
+    const disk = await this.readDiskState();
+    if (!disk) {
+      return false;
+    }
+    const mergedHistory = this.state.history || [];
+    this.state = { ...disk, history: mergedHistory };
+    this.mergeDiskHistory(disk);
+    this.loadedTask = this.state.taskDescription || "";
+    return true;
+  }
+
+  /**
+   * Pastikan tulisan kita benar-benar bertahan.
+   *
+   * Tanpa ini, proses yang kalah balapan tetap melaporkan sukses. Lebih baik
+   * gagal terang-terangan daripada memberi tahu "berhasil" untuk state yang
+   * sudah ditimpa proses lain.
+   */
+  async verifyPersisted(expectedTask) {
+    const disk = await this.readDiskState();
+    if (!disk) {
+      return true;
+    }
+    const actual = disk.taskDescription || "";
+    if (actual !== (expectedTask || "")) {
+      throw new Error(
+        `State workflow tidak bertahan: yang ditulis "${expectedTask}" tetapi di disk "${actual}". ` +
+        `Proses MCP lain menimpanya. Muat ulang state sebelum melanjutkan.`
+      );
+    }
+    return true;
+  }
+
   /**
    * Baca isi berkas state APA ADANYA dari disk (bukan dari memori).
    * Mengembalikan null kalau belum ada / rusak.
@@ -709,7 +889,7 @@ export class WorkflowState {
   async readDiskState() {
     try {
       const data = await fs.readFile(this.stateFile, "utf-8");
-      return JSON.parse(data);
+      return sanitize(migrateOwnerMetadata(JSON.parse(data)));
     } catch {
       return null;
     }
@@ -717,7 +897,7 @@ export class WorkflowState {
 
   /** True kalau berkas di disk terakhir ditulis proses MCP lain. */
   isForeignWrite(diskState) {
-    const token = diskState?.owner?.token;
+    const token = diskState?.owner?.processMarker;
     return typeof token === "string" && token.length > 0 && token !== PROCESS_TOKEN;
   }
 
@@ -756,19 +936,27 @@ export class WorkflowState {
    * pekerjaan resize docker-alma tidak pernah muncul di view_history.
    */
   async reconcileWithDisk() {
-    const result = { mergedHistory: 0, preservedTask: null, foreignToken: null };
+    const result = {
+      mergedHistory: 0,
+      preservedTask: null,
+      foreignToken: null,
+      diskTask: "",
+      diskPhase: "idle",
+    };
     const disk = await this.readDiskState();
     if (!disk) {
       return result;
     }
 
+    result.diskTask = disk.taskDescription || "";
+    result.diskPhase = disk.currentPhase || "idle";
     result.mergedHistory = this.mergeDiskHistory(disk);
 
     if (!this.isForeignWrite(disk)) {
       return result;
     }
 
-    result.foreignToken = disk.owner.token;
+    result.foreignToken = disk.owner.processMarker;
 
     const hasRunningTask =
       typeof disk.taskDescription === "string" &&
@@ -788,6 +976,7 @@ export class WorkflowState {
     }
 
     this.state.history.push({
+      classification: disk.classification || "INTERNAL",
       taskDescription: disk.taskDescription,
       taskType: disk.taskType || "other",
       commitMessage: disk.lastCommitMessage || "",
@@ -796,7 +985,7 @@ export class WorkflowState {
       dropReason:
         "Ditimpa proses agen lain: state workflow dipakai bersama antar sesi di mesin ini",
       interruptedAtPhase: disk.currentPhase,
-      interruptedBy: disk.owner.token,
+      interruptedBy: disk.owner.processMarker,
       timestamp: new Date().toISOString(),
     });
     result.preservedTask = disk.taskDescription;
@@ -804,29 +993,52 @@ export class WorkflowState {
   }
 
   async updateProjectSummary() {
+    assertSafeKnowledge(this.state);
     const summaryPath = path.join(path.dirname(this.stateFile), PROJECT_SUMMARY_FILENAME);
     const summary = this.generateProjectSummaryData();
+    assertSafeKnowledge(summary);
     await fs.mkdir(path.dirname(summaryPath), { recursive: true });
     await fs.writeFile(summaryPath, JSON.stringify(summary, null, 2));
   }
 
-  async syncToDatabase() {
-    try {
-      const { insertHistoryEntry, updateSummaryForUser, saveState } = await import("./db/index.js");
-      const userId = getCurrentUserId();
-      // projectRoot dipakai sebagai identitas proyek di database. Ditentukan
-      // lewat resolveProjectRootForState, bukan dengan menghitung `dirname`
-      // berkali-kali: jumlah itu hanya benar untuk satu kedalaman tertentu.
-      const projectRoot = resolveProjectRootForState(this.stateFile);
-
-      for (const entry of this.state.history || []) {
-        await insertHistoryEntry(userId, projectRoot, entry);
+  /**
+   * Menyalin history, ringkasan, dan state ke database.
+   *
+   * `db` dapat diinjeksi untuk pengujian; pemanggil biasa tidak mengirimnya.
+   *
+   * Satu entri yang gagal TIDAK boleh menghentikan sisanya. Dulu kegagalan
+   * pertama (mis. entri lama tanpa `task_type`) membatalkan seluruh fungsi,
+   * sehingga `updateSummaryForUser` dan `saveState` ikut terlewat dan riwayat
+   * proyek diam-diam berhenti tersimpan sama sekali.
+   */
+  async syncToDatabase(options = {}) {
+    assertSafeKnowledge(this.state);
+    const db = options.db ?? (await import("./db/index.js"));
+    const userId = getCurrentUserId();
+    // projectRoot dipakai sebagai identitas proyek di database. Ditentukan
+    // lewat resolveProjectRootForState, bukan dengan menghitung `dirname`
+    // berkali-kali: jumlah itu hanya benar untuk satu kedalaman tertentu.
+    const projectRoot = resolveProjectRootForState(this.stateFile);
+
+    let skipped = 0;
+    for (const entry of this.state.history || []) {
+      try {
+        await db.insertHistoryEntry(userId, projectRoot, entry);
+      } catch (error) {
+        skipped++;
+        safeLog("error", "History entry skipped:", error.message);
       }
-      await updateSummaryForUser(userId, projectRoot);
-      await saveState(userId, projectRoot, this.state);
+    }
+    if (skipped > 0) {
+      safeLog("error", `History sync skipped ${skipped} entr${skipped === 1 ? "y" : "ies"}.`);
+    }
+
+    try {
+      await db.updateSummaryForUser(userId, projectRoot);
+      await db.saveState(userId, projectRoot, this.state);
     } catch (error) {
-      // Database sync failed; log it but don't crash
-      console.error("Database sync failed:", error.message);
+      // Ringkasan dan state tetap opsional: jangan pernah menggagalkan save().
+      safeLog("error", "Database sync failed:", error.message);
     }
   }
 
@@ -892,6 +1104,7 @@ export class WorkflowState {
     if (archive && hasRunningTask) {
       archivedTask = previous.taskDescription;
       history.push({
+        classification: previous.classification || "INTERNAL",
         taskDescription: previous.taskDescription,
         taskType: previous.taskType || "other",
         commitMessage: previous.lastCommitMessage || "",
@@ -906,6 +1119,7 @@ export class WorkflowState {
 
     this.state = {
       currentPhase: "idle",
+      classification: "INTERNAL",
       taskDescription: "",
       bugFixed: false,
       testsCreated: false,
@@ -934,6 +1148,7 @@ export class WorkflowState {
 
   addToHistory(entry) {
     this.state.history.push({
+      classification: this.state.classification || "INTERNAL",
       ...entry,
       timestamp: new Date().toISOString(),
     });