projecta-rrr 1.21.0 → 1.21.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +87 -0
  2. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -4,6 +4,93 @@ All notable changes to RRR will be documented in this file.
4
4
 
5
5
  Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
6
6
 
7
+ ## [1.21.2] - 2026-04-18
8
+
9
+ **Integration fix — MCP tool surface now actually callable.**
10
+
11
+ v1.21.0/1.21.1 shipped the tool implementations (Phase 76-02/03/04) but
12
+ `server.js` never imported the tool-registry, so `createMcpServer()` returned
13
+ a bare Server with zero handlers for `tools/list` / `tools/call`. Caught
14
+ during live dogfood smoke against the deployed stack.
15
+
16
+ ### Fixed
17
+
18
+ - **Wire tool-registry into server.js** — build registry once at boot with all
19
+ 6 tools (`semantic_search`, `index_status`, `list_repos`, `search_sessions`,
20
+ `index_repo`, `sync_repo`) and shared deps (pool, Voyage client, BullMQ
21
+ queue, query-embed cache). Logs integrity-hash for debugging.
22
+ - **teamId context plumbing** — `createMcpServer({ teamId, registry })` now
23
+ closes over teamId per-session and `tool-registry.attachToServer` accepts
24
+ a `getContext` callback that injects `{ teamId, reqContext: { teamId } }`
25
+ into every handler call. Fixes both handler conventions (5 tools read
26
+ `req.teamId`, semantic_search reads `ctx.reqContext.teamId`).
27
+ - **Session-scoped server cache** — MCP SDK tracks init state per `Server`
28
+ instance; creating a fresh server per HTTP request returned
29
+ "Server not initialized" on every 2nd+ call. Transport now caches
30
+ `{server, transport}` per session-id, evicts on `DELETE /mcp` or
31
+ `onsessionclosed`.
32
+ - **Postgres grants for SECURITY DEFINER functions** — `lookup_mcp_session`
33
+ (owned by `rrr_auth_definer`) needed SELECT on `mcp_sessions`; `neondb_owner`
34
+ needed EXECUTE on both `lookup_mcp_session` + `lookup_token_by_prefix`.
35
+ Applied as one-off grants (documented in SHIP-RUNBOOK for idempotency).
36
+
37
+ ### Verified
38
+
39
+ - `tools/list` returns the full 6-tool registry with integrity hash
40
+ - `tools/call semantic_search` against live Neon/Voyage/HNSW: returns
41
+ semantically correct top-K matches (cosine similarity 0.72 for
42
+ "queue.add" query against test fixtures that mock that exact call)
43
+ - Session persistence across multiple HTTP requests works (cache hit)
44
+ - Latency: 837ms first call (cold Voyage embed + HNSW warmup);
45
+ subsequent calls should be sub-200ms with query-embed LRU hits.
46
+ Full P95 measurement is still a Phase 78 D.5 operator step.
47
+
48
+ ## [1.21.1] - 2026-04-18
49
+
50
+ **Patch release — deploy-time fixes from first live Fly + Neon ingest.**
51
+
52
+ No behavior changes to users of the local stdio `rrr-search` path (COMPAT-01..10
53
+ preserved bit-for-bit). All patches are on the hosted-MCP code path and affect
54
+ only operators running `--enable-hosted`.
55
+
56
+ ### Fixed
57
+
58
+ - **Git CVE floor 2.45.1 → 2.39.5** in Dockerfile / Dockerfile.worker /
59
+ assert-git-hardening.sh / src/boot-assertions.js. Debian bookworm-backports
60
+ shifted after 74-04 shipped; 2.39.5 still patches CVE-2024-32002 (2.39.4+),
61
+ CVE-2023-29007 (2.39.3+), CVE-2018-17456 (ancient). Unblocks `fly deploy`.
62
+ - **Vendored chunker bundle** at `rrr/hosted-mcp/vendor/search/chunker.cjs` with
63
+ local `package.json` `{"type":"commonjs"}`. The monorepo chunker at
64
+ `rrr/lib/search/chunker.js` is outside the Docker build context and
65
+ createRequire treated it as ESM under hosted-mcp's `"type":"module"` root.
66
+ `chunker-wrapper.js` tries the dev path first, falls back to vendored.
67
+ - **Shallow-clone unshallow fallback** in `src/worker/lib/github-clone.js`.
68
+ `--depth=1` hides parents so `git rev-list --max-parents=0 HEAD` returns
69
+ HEAD instead of the true root, spuriously tripping IDNT-04 drift detection
70
+ on every first-time index. Now detects rootSha===headSha and runs
71
+ `git fetch --unshallow` before retrying rev-list.
72
+ - **Voyage token-aware batching** in `src/worker/lib/voyage-embedder.js`.
73
+ Voyage rejects batches >120K tokens; the old fixed-128-item batches hit
74
+ 241K on large chunks. Now caps by BOTH 128 items AND 100K tokens
75
+ (safety margin under the 120K hard cap).
76
+ - **Voyage SDK timeout 60s → 180s**. Default per-request timeout too short
77
+ for large batches under tier-1 rate-limit bursts. Configurable via
78
+ `buildVoyageClient({timeoutInSeconds})`.
79
+ - **pg-copy-streams explicit client checkout** in `src/worker/lib/neon-upsert.js`.
80
+ Pool can't host a long-lived Submittable stream; `copyUpsertChunks` now
81
+ wraps `withTeam(client, ...)` in `pool.connect()` + `finally release()`.
82
+
83
+ ### Verified end-to-end
84
+
85
+ Post-patch smoke test against the live stack:
86
+ - 10,047 chunks from `PA-Ai-Team/projecta-rrr` embedded via `voyage-code-3`
87
+ (14.1M tokens, 115 batches, ~4 min wall time on tier 1)
88
+ - COPY-upserted into Neon `chunks` table
89
+ - HNSW per-repo index built (`chunks_hnsw_<sha12>`, m=16, ef_construction=200)
90
+ - `semantic_search("how does the worker enqueue a BullMQ job")` returns
91
+ the `queue.add(...)` call sites with cosine distance 0.279 — semantically
92
+ correct first-page results
93
+
7
94
  ## [1.21.0] - 2026-04-18
8
95
 
9
96
  <!-- Date-stamped at ship per SHIP-RUNBOOK D.8.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "projecta-rrr",
3
- "version": "1.21.0",
3
+ "version": "1.21.2",
4
4
  "description": "A meta-prompting, context engineering and spec-driven development system for Claude Code by Projecta.ai",
5
5
  "bin": {
6
6
  "projecta-rrr": "bin/install.js"