projecta-rrr 1.21.0 → 1.21.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +87 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,93 @@ All notable changes to RRR will be documented in this file.
|
|
|
4
4
|
|
|
5
5
|
Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
6
6
|
|
|
7
|
+
## [1.21.2] - 2026-04-18
|
|
8
|
+
|
|
9
|
+
**Integration fix — MCP tool surface now actually callable.**
|
|
10
|
+
|
|
11
|
+
v1.21.0/1.21.1 shipped the tool implementations (Phase 76-02/03/04) but
|
|
12
|
+
`server.js` never imported the tool-registry, so `createMcpServer()` returned
|
|
13
|
+
a bare Server with zero handlers for `tools/list` / `tools/call`. Caught
|
|
14
|
+
during live dogfood smoke against the deployed stack.
|
|
15
|
+
|
|
16
|
+
### Fixed
|
|
17
|
+
|
|
18
|
+
- **Wire tool-registry into server.js** — build registry once at boot with all
|
|
19
|
+
6 tools (`semantic_search`, `index_status`, `list_repos`, `search_sessions`,
|
|
20
|
+
`index_repo`, `sync_repo`) and shared deps (pool, Voyage client, BullMQ
|
|
21
|
+
queue, query-embed cache). Logs integrity-hash for debugging.
|
|
22
|
+
- **teamId context plumbing** — `createMcpServer({ teamId, registry })` now
|
|
23
|
+
closes over teamId per-session and `tool-registry.attachToServer` accepts
|
|
24
|
+
a `getContext` callback that injects `{ teamId, reqContext: { teamId } }`
|
|
25
|
+
into every handler call. Fixes both handler conventions (5 tools read
|
|
26
|
+
`req.teamId`, semantic_search reads `ctx.reqContext.teamId`).
|
|
27
|
+
- **Session-scoped server cache** — MCP SDK tracks init state per `Server`
|
|
28
|
+
instance; creating a fresh server per HTTP request returned
|
|
29
|
+
"Server not initialized" on every 2nd+ call. Transport now caches
|
|
30
|
+
`{server, transport}` per session-id, evicts on `DELETE /mcp` or
|
|
31
|
+
`onsessionclosed`.
|
|
32
|
+
- **Postgres grants for SECURITY DEFINER functions** — `lookup_mcp_session`
|
|
33
|
+
(owned by `rrr_auth_definer`) needed SELECT on `mcp_sessions`; `neondb_owner`
|
|
34
|
+
needed EXECUTE on both `lookup_mcp_session` + `lookup_token_by_prefix`.
|
|
35
|
+
Applied as one-off grants (documented in SHIP-RUNBOOK for idempotency).
|
|
36
|
+
|
|
37
|
+
### Verified
|
|
38
|
+
|
|
39
|
+
- `tools/list` returns the full 6-tool registry with integrity hash
|
|
40
|
+
- `tools/call semantic_search` against live Neon/Voyage/HNSW: returns
|
|
41
|
+
semantically correct top-K matches (cosine similarity 0.72 for
|
|
42
|
+
"queue.add" query against test fixtures that mock that exact call)
|
|
43
|
+
- Session persistence across multiple HTTP requests works (cache hit)
|
|
44
|
+
- Latency: 837ms first call (cold Voyage embed + HNSW warmup);
|
|
45
|
+
subsequent calls should be sub-200ms with query-embed LRU hits.
|
|
46
|
+
Full P95 measurement is still a Phase 78 D.5 operator step.
|
|
47
|
+
|
|
48
|
+
## [1.21.1] - 2026-04-18
|
|
49
|
+
|
|
50
|
+
**Patch release — deploy-time fixes from first live Fly + Neon ingest.**
|
|
51
|
+
|
|
52
|
+
No behavior changes to users of the local stdio `rrr-search` path (COMPAT-01..10
|
|
53
|
+
preserved bit-for-bit). All patches are on the hosted-MCP code path and affect
|
|
54
|
+
only operators running `--enable-hosted`.
|
|
55
|
+
|
|
56
|
+
### Fixed
|
|
57
|
+
|
|
58
|
+
- **Git CVE floor 2.45.1 → 2.39.5** in Dockerfile / Dockerfile.worker /
|
|
59
|
+
assert-git-hardening.sh / src/boot-assertions.js. Debian bookworm-backports
|
|
60
|
+
shifted after 74-04 shipped; 2.39.5 still patches CVE-2024-32002 (2.39.4+),
|
|
61
|
+
CVE-2023-29007 (2.39.3+), CVE-2018-17456 (ancient). Unblocks `fly deploy`.
|
|
62
|
+
- **Vendored chunker bundle** at `rrr/hosted-mcp/vendor/search/chunker.cjs` with
|
|
63
|
+
local `package.json` `{"type":"commonjs"}`. The monorepo chunker at
|
|
64
|
+
`rrr/lib/search/chunker.js` is outside the Docker build context and
|
|
65
|
+
createRequire treated it as ESM under hosted-mcp's `"type":"module"` root.
|
|
66
|
+
`chunker-wrapper.js` tries the dev path first, falls back to vendored.
|
|
67
|
+
- **Shallow-clone unshallow fallback** in `src/worker/lib/github-clone.js`.
|
|
68
|
+
`--depth=1` hides parents so `git rev-list --max-parents=0 HEAD` returns
|
|
69
|
+
HEAD instead of the true root, spuriously tripping IDNT-04 drift detection
|
|
70
|
+
on every first-time index. Now detects rootSha===headSha and runs
|
|
71
|
+
`git fetch --unshallow` before retrying rev-list.
|
|
72
|
+
- **Voyage token-aware batching** in `src/worker/lib/voyage-embedder.js`.
|
|
73
|
+
Voyage rejects batches >120K tokens; the old fixed-128-item batches hit
|
|
74
|
+
241K on large chunks. Now caps by BOTH 128 items AND 100K tokens
|
|
75
|
+
(safety margin under the 120K hard cap).
|
|
76
|
+
- **Voyage SDK timeout 60s → 180s**. Default per-request timeout too short
|
|
77
|
+
for large batches under tier-1 rate-limit bursts. Configurable via
|
|
78
|
+
`buildVoyageClient({timeoutInSeconds})`.
|
|
79
|
+
- **pg-copy-streams explicit client checkout** in `src/worker/lib/neon-upsert.js`.
|
|
80
|
+
Pool can't host a long-lived Submittable stream; `copyUpsertChunks` now
|
|
81
|
+
wraps `withTeam(client, ...)` in `pool.connect()` + `finally release()`.
|
|
82
|
+
|
|
83
|
+
### Verified end-to-end
|
|
84
|
+
|
|
85
|
+
Post-patch smoke test against the live stack:
|
|
86
|
+
- 10,047 chunks from `PA-Ai-Team/projecta-rrr` embedded via `voyage-code-3`
|
|
87
|
+
(14.1M tokens, 115 batches, ~4 min wall time on tier 1)
|
|
88
|
+
- COPY-upserted into Neon `chunks` table
|
|
89
|
+
- HNSW per-repo index built (`chunks_hnsw_<sha12>`, m=16, ef_construction=200)
|
|
90
|
+
- `semantic_search("how does the worker enqueue a BullMQ job")` returns
|
|
91
|
+
the `queue.add(...)` call sites with cosine distance 0.279 — semantically
|
|
92
|
+
correct first-page results
|
|
93
|
+
|
|
7
94
|
## [1.21.0] - 2026-04-18
|
|
8
95
|
|
|
9
96
|
<!-- Date-stamped at ship per SHIP-RUNBOOK D.8.
|
package/package.json
CHANGED