vibe-gate-mcp 0.1.4 → 0.1.5

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-09-23
+
+### Fixed
+
+- Enforce bounded review inputs, close the conflict loop as deadlocked after a rejected third round, and avoid duplicating or persisting source payloads between rounds.
+- Load Critic `REQUEST:` paths from the workspace with path, file-count, file-size, line-count, and total-context limits; reject traversal and symlink escapes in changed-file reads.
+- Use the OpenAI Responses API so current reasoning models work without model-specific request parameters or a Vibe-Gate model allowlist.
+
+### Docs
+
+- Document the review limits and requested-context behavior, and add a release checklist and scope review.
+
 ## [0.1.4] - 2026-09-21
 
 ### Added

package/README.md

@@ -45,6 +45,8 @@ OPENAI_API_KEY=YOUR_OPENAI_API_KEY
 
 `opencode` is still the separate Zen/Go HTTP provider and needs `OPENCODE_API_KEY`. `opencode-cli` runs the local CLI and requires a `provider/model` value in `CRITIC_MODEL`; see the CLI guide for details.
 
+`CRITIC_MODEL` is passed to the selected provider or CLI without a Vibe-Gate model allowlist; the provider must support that model ID. The OpenAI API provider uses the Responses API. See [provider configuration](docs/USAGE.md#configuration--providers).
+
 See [CLI provider setup and alternatives](docs/CLI_PROVIDERS.md) for CLI installation, login, configuration, OpenCode session details, and other candidates we evaluated. Full variable list: [docs/project/VARIABLES.md](docs/project/VARIABLES.md).
 
 ### 2. Configure Cursor MCP (any consumer repo)
@@ -122,6 +124,7 @@ Probes: `updateStatus: false` or `phaseId` prefixes `mcp-smoke-` / `vibe-gate-pr
 | [docs/USAGE.md](docs/USAGE.md)                                 | First run and providers   |
 | [docs/CLI_PROVIDERS.md](docs/CLI_PROVIDERS.md)                 | Local CLI providers       |
 | [docs/SEMANTIC_DIFF_PAYLOAD.md](docs/SEMANTIC_DIFF_PAYLOAD.md) | `files[]` contract        |
+| [docs/ROADMAP.md](docs/ROADMAP.md)                             | Release checklist         |
 | [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md)             | Stale MCP, path errors    |
 | [docs/project/VARIABLES.md](docs/project/VARIABLES.md)         | Env SSoT                  |
 | [examples/](examples/)                                         | Cursor mcp.json templates |

package/dist/index.mjs

@@ -395,6 +395,18 @@ const SEMANTIC_DIFF_SOURCE_FILES = {
 	MAX_BYTES_PER_FILE: 1048576,
 	MAX_TOTAL_BYTES: 5242880
 };
+/** MCP review input bounds; apply size checks again after files are read. */
+const REVIEW_INPUT_LIMITS = {
+	MAX_PHASE_ID_CHARS: 256,
+	MAX_REPORT_CHARS: 5e4,
+	MAX_SEMANTIC_DIFF_CHARS: 5e5,
+	MAX_PATH_CHARS: 1024,
+	MAX_DEPENDENCIES: 100,
+	MAX_DEPENDENCY_NAME_CHARS: 256,
+	MAX_DEBT_SUBJECT_CHARS: 200,
+	MAX_DEBT_RATIONALE_CHARS: 4e3,
+	MAX_REQUESTED_CONTEXT_LINES: 120
+};
 /**
 * Status.json write policy on ACCEPT.
 * Probe phaseIds must not pollute consumer `.vibe/status.json` unless updateStatus:true.
@@ -693,7 +705,6 @@ const concernVerificationSchema = z.object({
 const reviewRoundSchema = z.object({
 	round: z.number(),
 	report: z.string(),
-	semanticDiff: z.string().optional(),
 	verdict: z.string(),
 	criticResponse: z.string(),
 	concerns: z.array(concernSchema).optional(),
@@ -1847,7 +1858,10 @@ async function verifyCanonicalPathUnderWorkspace(workspaceRoot, absolutePath, pa
 		code: "PATH_OUTSIDE_WORKSPACE",
 		message: `${pathKind} resolves outside VIBE_WORKSPACE_ROOT after canonical resolution.`
 	};
-	return { ok: true };
+	return {
+		ok: true,
+		canonicalPath: fileReal
+	};
 }
 /**
 * Resolve a user-supplied relative path to an absolute path confined to workspaceRoot.
@@ -1946,7 +1960,7 @@ async function loadSemanticDiffFromWorkspacePath(workspaceRoot, userRelativePath
 	};
 	let raw;
 	try {
-		raw = await readFile(absolutePath, "utf8");
+		raw = await readFile(canonical.canonicalPath, "utf8");
 	} catch {
 		return {
 			ok: false,
@@ -1998,9 +2012,10 @@ function mapPathError(code, message) {
 		message
 	};
 }
-function formatFileBlock(relativePath, content) {
+function formatSemanticDiffFileBlock(relativePath, content, truncated = false) {
 	const body = content.endsWith("\n") ? content : `${content}\n`;
-	return `${SEMANTIC_DIFF_PAYLOAD_MARKERS.FILE_LINE_PREFIX}${relativePath}\n${SEMANTIC_DIFF_PAYLOAD_MARKERS.CONTENT_LINE}\n${body}`;
+	const note = truncated ? `[Context limited to ${REVIEW_INPUT_LIMITS.MAX_REQUESTED_CONTEXT_LINES} lines.]\n` : "";
+	return `${SEMANTIC_DIFF_PAYLOAD_MARKERS.FILE_LINE_PREFIX}${relativePath}\n${SEMANTIC_DIFF_PAYLOAD_MARKERS.CONTENT_LINE}\n${body}${note}`;
 }
 function validateFilesArray(paths) {
 	if (paths.length === 0) return {
@@ -2061,7 +2076,8 @@ async function assertReadableSourceFile(workspaceRoot, relativePath, absolutePat
 	};
 	return {
 		ok: true,
-		nextTotalBytes
+		nextTotalBytes,
+		canonicalPath: canonical.canonicalPath
 	};
 }
 async function readSourceFileContent(absolutePath, relativePath) {
@@ -2104,9 +2120,9 @@ async function buildSemanticDiffFromSourceFiles(workspaceRoot, relativePaths) {
 		const sizeCheck = await assertReadableSourceFile(workspaceRoot, relativePath, pathResult.absolutePath, totalBytes);
 		if (!sizeCheck.ok) return sizeCheck.result;
 		totalBytes = sizeCheck.nextTotalBytes;
-		const read = await readSourceFileContent(pathResult.absolutePath, relativePath);
+		const read = await readSourceFileContent(sizeCheck.canonicalPath, relativePath);
 		if (!read.ok) return read.result;
-		blocks.push(formatFileBlock(relativePath, read.content));
+		blocks.push(formatSemanticDiffFileBlock(relativePath, read.content));
 		filesLoaded.push(relativePath);
 	}
 	return {
@@ -2120,32 +2136,27 @@ async function buildSemanticDiffFromSourceFiles(workspaceRoot, relativePaths) {
 /**
 * OpenAI API integration.
 */
-const ROLE_MAP$1 = {
-	user: "user",
-	assistant: "assistant",
-	system: "system"
-};
-function toOpenAIMessages$1(messages) {
+function toOpenAIInput(messages) {
 	return messages.map((m) => ({
-		role: ROLE_MAP$1[m.role],
+		role: m.role,
 		content: m.content
 	}));
 }
 function createOpenAIProvider(apiKey, model) {
 	const client = new OpenAI({ apiKey });
 	return { async complete(messages) {
-		const completion = await client.chat.completions.create({
+		const response = await client.responses.create({
 			model,
-			max_completion_tokens: LLM_MAX_TOKENS,
-			temperature: .3,
-			messages: toOpenAIMessages$1(messages)
+			max_output_tokens: LLM_MAX_TOKENS,
+			input: toOpenAIInput(messages)
 		});
+		const usage = response.usage ? {
+			promptTokens: response.usage.input_tokens,
+			completionTokens: response.usage.output_tokens
+		} : void 0;
 		return {
-			content: completion.choices[0]?.message?.content ?? "",
-			usage: completion.usage ? {
-				promptTokens: completion.usage.prompt_tokens,
-				completionTokens: completion.usage.completion_tokens
-			} : void 0
+			content: response.output_text,
+			usage
 		};
 	} };
 }
@@ -3345,6 +3356,57 @@ function parseVerificationsFromResponse(response, existingConcerns) {
 	}
 	return verifications;
 }
+function splitRequestedPath(part) {
+	let remainder = part.trim();
+	if (!remainder) return null;
+	if (remainder.startsWith("\"") || remainder.startsWith("'")) {
+		const quote = remainder[0];
+		const closingQuote = remainder.indexOf(quote, 1);
+		if (closingQuote < 2) return null;
+		const filePath = remainder.slice(1, closingQuote);
+		remainder = remainder.slice(closingQuote + 1).trim();
+		return {
+			filePath,
+			remainder
+		};
+	}
+	const firstSpace = remainder.search(/\s/);
+	const filePath = firstSpace === -1 ? remainder : remainder.slice(0, firstSpace);
+	remainder = firstSpace === -1 ? "" : remainder.slice(firstSpace).trim();
+	return {
+		filePath,
+		remainder
+	};
+}
+function parseFileRequestPart(part) {
+	const split = splitRequestedPath(part);
+	if (!split) return null;
+	let { filePath, remainder } = split;
+	const pathRange = /:(\d+(?:-\d+)?)$/.exec(filePath);
+	const leadingRange = /^:(\d+(?:-\d+)?)(?:\s+|$)/.exec(remainder);
+	const lineRange = pathRange?.[1] ?? leadingRange?.[1];
+	if (pathRange) filePath = filePath.slice(0, -pathRange[0].length);
+	else if (leadingRange) remainder = remainder.slice(leadingRange[0].length).trim();
+	if (!filePath) return null;
+	return {
+		filePath,
+		lineRange,
+		reason: remainder || void 0
+	};
+}
+function parseRequestsFromResponse(response) {
+	const requests = [];
+	const requestRegex = /\bREQUEST:\s*(.+)/gi;
+	let match;
+	while ((match = requestRegex.exec(response)) !== null) {
+		const parts = match[1].trim().split(",").map((p) => p.trim());
+		for (const part of parts) {
+			const req = parseFileRequestPart(part);
+			if (req) requests.push(req);
+		}
+	}
+	return requests;
+}
 function hasRequestBlocks(response) {
 	if (response.toUpperCase().includes(RESPONSE_BLOCKS.REQUEST)) return true;
 	const upper = response.toUpperCase();
@@ -3578,6 +3640,104 @@ function computeSemanticDiffLineHints(semanticDiff) {
 	return hints;
 }
 //#endregion
+//#region src/summarizer/read-changed-files.ts
+/**
+* Read contents of changed files with truncation.
+* Used for relevance filtering - only read files that were actually changed.
+* Includes auto-import expansion for TypeScript/JavaScript files.
+*/
+async function readChangedFileContent(workspaceRoot, filePath, maxLines = CONTEXT_LIMITS.MAX_LINES_PER_FILE, lineRange) {
+	const pathResult = resolveSafePathInWorkspace(workspaceRoot, filePath, WORKSPACE_PATH_KIND.SOURCE_FILE);
+	if (!pathResult.ok) return {
+		path: filePath,
+		content: CONTEXT_LIMITS.FILE_UNREADABLE,
+		truncated: false,
+		error: pathResult.message
+	};
+	try {
+		const canonical = await verifyCanonicalPathUnderWorkspace(workspaceRoot, pathResult.absolutePath, WORKSPACE_PATH_KIND.SOURCE_FILE);
+		if (!canonical.ok) return {
+			path: filePath,
+			content: CONTEXT_LIMITS.FILE_UNREADABLE,
+			truncated: false,
+			error: canonical.message
+		};
+		const fileStat = await stat(canonical.canonicalPath);
+		if (!fileStat.isFile()) return {
+			path: filePath,
+			content: CONTEXT_LIMITS.FILE_UNREADABLE,
+			truncated: false,
+			error: "Not a regular file."
+		};
+		if (fileStat.size > SEMANTIC_DIFF_SOURCE_FILES.MAX_BYTES_PER_FILE) return {
+			path: filePath,
+			content: CONTEXT_LIMITS.FILE_UNREADABLE,
+			truncated: false,
+			error: "File exceeds size limit."
+		};
+		const lines = (await readFile(canonical.canonicalPath, "utf-8")).split("\n");
+		if (lineRange) {
+			const range = /^(\d+)(?:-(\d+))?$/.exec(lineRange);
+			const start = Number(range?.[1]);
+			const end = range?.[2] ? Number(range[2]) : start;
+			if (!range || start < 1 || end < start) return {
+				path: filePath,
+				content: CONTEXT_LIMITS.FILE_UNREADABLE,
+				truncated: false,
+				error: "Invalid line range."
+			};
+			let startIdx = Math.max(0, start - 1);
+			let endIdx = Math.min(lines.length, end);
+			if (!range[2]) {
+				startIdx = Math.max(0, startIdx - 50);
+				endIdx = Math.min(lines.length, startIdx + 100);
+			}
+			const requestedEndIdx = endIdx;
+			endIdx = Math.min(endIdx, startIdx + REVIEW_INPUT_LIMITS.MAX_REQUESTED_CONTEXT_LINES);
+			return {
+				path: filePath,
+				content: lines.slice(startIdx, endIdx).map((l, i) => `${startIdx + i + 1} | ${l}`).join("\n"),
+				truncated: endIdx < requestedEndIdx
+			};
+		}
+		return {
+			path: filePath,
+			content: lines.slice(0, maxLines).join("\n"),
+			truncated: lines.length > maxLines
+		};
+	} catch {
+		return {
+			path: filePath,
+			content: CONTEXT_LIMITS.FILE_UNREADABLE,
+			truncated: false,
+			error: "File could not be read."
+		};
+	}
+}
+async function readRequestedFiles(workspaceRoot, response) {
+	const requests = parseRequestsFromResponse(response);
+	if (requests.length > SEMANTIC_DIFF_SOURCE_FILES.MAX_COUNT) throw new Error(`Critic requested more than ${SEMANTIC_DIFF_SOURCE_FILES.MAX_COUNT} files.`);
+	const uniqueRequests = [...new Map(requests.map((request) => [`${request.filePath}:${request.lineRange ?? ""}`, request])).values()];
+	const blocks = [];
+	const files = /* @__PURE__ */ new Set();
+	let totalChars = 0;
+	for (const request of uniqueRequests) {
+		if (request.filePath.length > REVIEW_INPUT_LIMITS.MAX_PATH_CHARS) throw new Error(`Critic requested a path longer than ${REVIEW_INPUT_LIMITS.MAX_PATH_CHARS} characters.`);
+		const file = await readChangedFileContent(workspaceRoot, request.filePath, REVIEW_INPUT_LIMITS.MAX_REQUESTED_CONTEXT_LINES, request.lineRange);
+		if (file.error) throw new Error(`Could not read requested file ${request.filePath}: ${file.error}`);
+		const block = formatSemanticDiffFileBlock(request.filePath, file.content, file.truncated);
+		const nextLength = totalChars + block.length;
+		if (nextLength > REVIEW_INPUT_LIMITS.MAX_SEMANTIC_DIFF_CHARS) throw new Error(`Critic requested context exceeds ${REVIEW_INPUT_LIMITS.MAX_SEMANTIC_DIFF_CHARS} characters.`);
+		blocks.push(block);
+		totalChars = nextLength;
+		files.add(request.filePath);
+	}
+	return {
+		semanticDiff: blocks.join(SEMANTIC_DIFF_PAYLOAD_MARKERS.FILE_BLOCK_SEPARATOR),
+		filesAnalyzed: files.size
+	};
+}
+//#endregion
 //#region src/tools/submit-phase-review.ts
 /**
 * MCP tool: submit_phase_review
@@ -3620,15 +3780,16 @@ function buildHistorySummary(history, maxTokens = CRITIC_THRESHOLDS.HISTORY_SUMM
 	}
 	return parts.join("\n\n---\n\n");
 }
-function buildUserContent(args, historySummary) {
-	const parts = [`Phase: ${args.phaseId}`, `<developer_report>\n${args.report}\n</developer_report>`];
+function buildUserContent(args, historySummary, requestedContext = "") {
+	const parts = [`Phase: ${args.phaseId}`];
 	if (historySummary) parts.unshift(`Previous rounds:\n${historySummary}\n`);
-	if (args.semanticDiff?.trim()) parts.push(`## CHANGED FILES (MCP resolved payload from files[], semanticDiffPath, or inline semanticDiff — this is the review corpus):\n<code_content>\n${args.semanticDiff.trim()}\n</code_content>`);
+	parts.push(`<developer_report>\n${args.report}\n</developer_report>`);
+	const codeContent = [args.semanticDiff, requestedContext].filter(Boolean).join("\n\n");
+	parts.push(`## CHANGED FILES\n<code_content>\n${codeContent}\n</code_content>`);
 	if (args.dependencies?.length) parts.push(`Dependencies: ${args.dependencies.join(", ")}`);
-	debugLog(`buildUserContent - semanticDiff length: ${args.semanticDiff?.length ?? 0}`);
 	return parts.join("\n\n");
 }
-async function buildContextBlock(workspaceRoot, newDeps, semanticDiff, report) {
+async function buildContextBlock(workspaceRoot, newDeps, semanticDiff) {
 	const [blueprint, pkgDeps] = await Promise.all([extractProjectBlueprint(workspaceRoot), parseDependencyListFromPackageJson(workspaceRoot).catch(() => ({
 		dependencies: [],
 		devDependencies: []
@@ -3637,46 +3798,12 @@ async function buildContextBlock(workspaceRoot, newDeps, semanticDiff, report) {
 	const bloatWarn = newDeps.length >= DEPENDENCY_THRESHOLDS.BLOAT_WARNING_NEW_PACKAGES || totalDeps >= DEPENDENCY_THRESHOLDS.BLOAT_WARNING_TOTAL_DEPS;
 	const parts = [`Project: ${blueprint.framework}. Structures: ${blueprint.structures.join(", ") || "none"}.`, `Current deps: ${totalDeps}. New/updated: ${newDeps.join(", ") || "none"}.`];
 	if (bloatWarn) parts.push(BLOAT_WARNING_MESSAGE);
-	let filesAnalyzed = 0;
-	const combinedText = [semanticDiff, report].filter(Boolean).join("\n");
-	if (combinedText) {
-		filesAnalyzed = parseSemanticDiff(combinedText).filesChanged.length;
-		const contentBlock = buildContentBlockFromInput(semanticDiff, report);
-		parts.push(contentBlock);
-	}
+	const filesAnalyzed = semanticDiff ? parseSemanticDiff(semanticDiff).filesChanged.length : 0;
 	return {
 		context: parts.join(" "),
 		filesAnalyzed
 	};
 }
-function buildContentBlockFromInput(semanticDiff, report) {
-	const sections = [];
-	if (semanticDiff?.trim()) sections.push(`## CHANGED FILES (MCP resolved FILE:...CONTENT: payload from files[], semanticDiffPath, or inline semanticDiff):\n${semanticDiff.trim()}`);
-	if (report?.trim()) sections.push(`## DEVELOPER REPORT:\n${report.trim()}`);
-	return sections.join("\n\n");
-}
-async function appendRequestedFilesToContext(workspaceRoot, originalContext, criticResponse) {
-	if (!hasRequestBlocks(criticResponse)) return {
-		context: originalContext,
-		filesAnalyzed: 0
-	};
-	return {
-		context: `${originalContext}\n\n## CRITIC REQUESTED MORE CONTEXT\nNote: Resubmit with files[] (or semanticDiffPath / inline semanticDiff) covering every path the Critic needs. MCP reads those workspace paths when you provide them.`,
-		filesAnalyzed: 0
-	};
-}
-async function appendPreviousRoundsFilesToContext(workspaceRoot, originalContext, session) {
-	const previousContents = [];
-	for (const h of session.history) if (h.semanticDiff?.trim()) previousContents.push(`--- Round ${h.round} ---\n${h.semanticDiff.trim()}`);
-	if (previousContents.length === 0) return {
-		context: originalContext,
-		filesAnalyzed: 0
-	};
-	return {
-		context: `${originalContext}\n\n## PREVIOUS ROUNDS CONTENT (preserved):\n${previousContents.join("\n\n")}`,
-		filesAnalyzed: 0
-	};
-}
 function toTextContent(json) {
 	return {
 		type: "text",
@@ -3720,18 +3847,7 @@ async function writeCaseFile(workspaceRoot, caseFile) {
 	await writeFile(path, JSON.stringify(caseFile, null, 2), "utf-8");
 }
 async function checkDeadlockEarly(workspaceRoot, args, session, semanticDiffHints) {
-	const round = args.round ?? 1;
-	if (round > CONFLICT_LOOP.MAX_ROUNDS) {
-		await clearSession(workspaceRoot);
-		await updateConflictCount(workspaceRoot, 1);
-		const caseFile = buildCaseFile(args.phaseId, round, []);
-		await writeCaseFile(workspaceRoot, caseFile);
-		return { content: [toTextContentWithHints({
-			...caseFile,
-			filesAnalyzed: 0
-		}, semanticDiffHints)] };
-	}
-	if (round > 1 && session?.phaseId === args.phaseId && session.round >= CONFLICT_LOOP.MAX_ROUNDS) {
+	if ((args.round ?? 1) > 1 && session?.phaseId === args.phaseId && session.round >= CONFLICT_LOOP.MAX_ROUNDS) {
 		await clearSession(workspaceRoot);
 		await updateConflictCount(workspaceRoot, 1);
 		const caseFile = buildCaseFile(args.phaseId, session.round, session.history);
@@ -3803,25 +3919,23 @@ async function runCriticReview(workspaceRoot, args, session, config, provider) {
 	const model = getEffectiveModel(config);
 	const [status, contextBlockResult, rules, preferencesLog] = await Promise.all([
 		getStatus(workspaceRoot),
-		buildContextBlock(workspaceRoot, args.dependencies ?? [], args.semanticDiff, args.report),
+		buildContextBlock(workspaceRoot, args.dependencies ?? [], args.semanticDiff),
 		loadRules(workspaceRoot),
 		readPreferencesLog(workspaceRoot)
 	]);
-	let enrichedContextBlock = contextBlockResult.context;
+	const enrichedContextBlock = contextBlockResult.context;
 	let totalFilesRead = contextBlockResult.filesAnalyzed;
+	let requestedContext = "";
 	if (round > 1 && session?.history && session.history.length > 0) {
 		const previousCriticResponse = session.history[session.history.length - 1].criticResponse;
 		if (hasRequestBlocks(previousCriticResponse)) {
-			const requestedBlockResult = await appendRequestedFilesToContext(workspaceRoot, enrichedContextBlock, previousCriticResponse);
-			enrichedContextBlock = requestedBlockResult.context;
+			const requestedBlockResult = await readRequestedFiles(workspaceRoot, previousCriticResponse);
+			requestedContext = requestedBlockResult.semanticDiff;
 			totalFilesRead += requestedBlockResult.filesAnalyzed;
 		}
-		const previousRoundsResult = await appendPreviousRoundsFilesToContext(workspaceRoot, enrichedContextBlock, session);
-		enrichedContextBlock = previousRoundsResult.context;
-		totalFilesRead += previousRoundsResult.filesAnalyzed;
 	}
 	const rulesBlock = formatRulesForPrompt(rules);
-	const userContent = buildUserContent(args, session?.phaseId === args.phaseId ? buildHistorySummary(session.history) : void 0);
+	const userContent = buildUserContent(args, session?.phaseId === args.phaseId ? buildHistorySummary(session.history) : void 0, requestedContext);
 	const messages = [{
 		role: "system",
 		content: buildSystemPrompt(personaPrompt, status, enrichedContextBlock, rulesBlock, preferencesLog, round)
@@ -3849,7 +3963,6 @@ async function runCriticReview(workspaceRoot, args, session, config, provider) {
 		roundData: {
 			round,
 			report: args.report,
-			semanticDiff: args.semanticDiff,
 			verdict: String(verdict),
 			criticResponse: response.content,
 			concerns: concerns.length > 0 ? concerns : void 0,
@@ -3894,7 +4007,7 @@ async function handleRejectOrContinue(result, session, workspaceRoot, args, sema
 		const noActivePriorConcerns = !priorConcerns.some((c) => c.reviewStatus === CONCERN_REVIEW_STATUS.REVIEWED_VALID);
 		if (allPriorReviewed && noActivePriorConcerns) return handleAcceptVerdict(result, workspaceRoot, args, semanticDiffHints);
 	}
-	if (round > CONFLICT_LOOP.MAX_ROUNDS) {
+	if (round >= CONFLICT_LOOP.MAX_ROUNDS) {
 		await clearSession(workspaceRoot);
 		await updateConflictCount(workspaceRoot, 1);
 		const caseFile = buildCaseFile(args.phaseId, round, nextSession.history, String(result.verdict));
@@ -3926,17 +4039,17 @@ async function handleRejectOrContinue(result, session, workspaceRoot, args, sema
 * which advertises `properties: {}` to IDEs (agents then cannot discover `files` / `semanticDiffPath`).
 */
 const submitPhaseReviewFieldsSchema = z.object({
-	phaseId: z.string().describe("Phase identifier (e.g., phase-6-§1a or 1.1.1)"),
-	report: z.string().describe("Implementer report. MUST INCLUDE: 1. Specific file paths & line numbers. 2. What changed and why. 3. Confirmation that NO \"future solutions\" or \"TODOs\" remain (instant fixes only)."),
-	files: z.array(z.string()).optional().describe("PREFERRED. Workspace-relative source paths under VIBE_WORKSPACE_ROOT. MCP reads each file and builds FILE:...CONTENT: payload. Exactly one of: files | semanticDiffPath | semanticDiff. Max 10 files."),
-	semanticDiffPath: z.string().optional().describe("Workspace-relative path to a pre-built FILE:...CONTENT: payload file (raw or JSON {\"semanticDiff\":\"...\"}). Exactly one of: files | semanticDiffPath | semanticDiff."),
-	semanticDiff: z.string().optional().describe("Inline FILE:...CONTENT: payload. Prefer files[]. Exactly one of: files | semanticDiffPath | semanticDiff. NOT git diff."),
+	phaseId: z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_PHASE_ID_CHARS).describe("Phase identifier (e.g., phase-6-§1a or 1.1.1)"),
+	report: z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_REPORT_CHARS).describe("Implementer report. MUST INCLUDE: 1. Specific file paths & line numbers. 2. What changed and why. 3. Confirmation that NO \"future solutions\" or \"TODOs\" remain (instant fixes only)."),
+	files: z.array(z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_PATH_CHARS)).min(1).max(SEMANTIC_DIFF_SOURCE_FILES.MAX_COUNT).optional().describe(`PREFERRED. Workspace-relative source paths under VIBE_WORKSPACE_ROOT. MCP reads each file and builds FILE:...CONTENT: payload. Exactly one of: files | semanticDiffPath | semanticDiff. Max ${SEMANTIC_DIFF_SOURCE_FILES.MAX_COUNT} files.`),
+	semanticDiffPath: z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_PATH_CHARS).optional().describe("Workspace-relative path to a pre-built FILE:...CONTENT: payload file (raw or JSON {\"semanticDiff\":\"...\"}). Exactly one of: files | semanticDiffPath | semanticDiff."),
+	semanticDiff: z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_SEMANTIC_DIFF_CHARS).optional().describe("Inline FILE:...CONTENT: payload. Prefer files[]. Exactly one of: files | semanticDiffPath | semanticDiff. NOT git diff."),
 	updateStatus: z.boolean().optional().describe("When false, ACCEPT does not write .vibe/status.json. Default: true except phaseIds with mcp-smoke- / vibe-gate-probe- prefixes."),
-	dependencies: z.array(z.string()).optional().describe("New/updated package names"),
-	round: z.number().optional().describe("Round number (1-3), default 1"),
+	dependencies: z.array(z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_DEPENDENCY_NAME_CHARS)).max(REVIEW_INPUT_LIMITS.MAX_DEPENDENCIES).optional().describe("New/updated package names"),
+	round: z.number().int().min(1).max(CONFLICT_LOOP.MAX_ROUNDS).optional().describe(`Round number (1-${CONFLICT_LOOP.MAX_ROUNDS}), default 1`),
 	logToDebt: z.object({
-		subject: z.string(),
-		rationale: z.string()
+		subject: z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_DEBT_SUBJECT_CHARS),
+		rationale: z.string().trim().min(1).max(REVIEW_INPUT_LIMITS.MAX_DEBT_RATIONALE_CHARS)
 	}).optional().describe("When DEBT verdict and Implementer accepts, log to DEBT.md")
 });
 function countPayloadSources(data) {
@@ -4070,35 +4183,53 @@ async function handleAcceptVerdictFlow(reviewResult, session, workspaceRoot, arg
 	if (session && session.concerns.length > 0 && !(allReviewed && noActiveConcernsLeft)) return handleAcceptWithUnverifiedConcerns(reviewResult, updatedSession ?? session, semanticDiffHints);
 	return handleAcceptVerdict(reviewResult, workspaceRoot, args, semanticDiffHints);
 }
-async function handleSubmitPhaseReview(rawArgs) {
-	const parsed = submitPhaseReviewInputSchema.safeParse(rawArgs);
-	if (!parsed.success) return { content: [toTextContent({
-		error: "Invalid submit_phase_review arguments",
-		issues: z.flattenError(parsed.error)
-	})] };
-	const input = parsed.data;
-	const config = loadConfig();
-	const provider = createLLMProvider(config);
-	if (!provider) return { content: [toTextContent({ error: ERROR_MESSAGES.NO_LLM_PROVIDER })] };
-	const workspaceRoot = getWorkspaceRoot();
+async function resolveSemanticDiffInput(workspaceRoot, input) {
 	let semanticDiff;
-	if (input.files && input.files.some((f) => f.trim().length > 0)) {
+	if (input.files) {
 		const built = await buildSemanticDiffFromSourceFiles(workspaceRoot, input.files);
-		if (!built.ok) return { content: [toTextContent({
+		if (!built.ok) return {
+			ok: false,
 			error: built.message,
 			code: built.code
-		})] };
+		};
 		semanticDiff = built.semanticDiff;
 		debugLog(`semanticDiff built from files[]: ${built.filesLoaded.join(", ")}`);
-	} else if (input.semanticDiffPath?.trim()) {
-		const loaded = await loadSemanticDiffFromWorkspacePath(workspaceRoot, input.semanticDiffPath.trim());
-		if (!loaded.ok) return { content: [toTextContent({
+	} else if (input.semanticDiffPath) {
+		const loaded = await loadSemanticDiffFromWorkspacePath(workspaceRoot, input.semanticDiffPath);
+		if (!loaded.ok) return {
+			ok: false,
 			error: loaded.message,
 			code: loaded.code
-		})] };
+		};
 		semanticDiff = loaded.semanticDiff;
 		debugLog(`semanticDiff loaded from file: ${loaded.resolvedFromPath}`);
 	} else semanticDiff = input.semanticDiff.trim();
+	if (semanticDiff.length > REVIEW_INPUT_LIMITS.MAX_SEMANTIC_DIFF_CHARS) return {
+		ok: false,
+		error: `resolved semanticDiff exceeds the maximum size of ${REVIEW_INPUT_LIMITS.MAX_SEMANTIC_DIFF_CHARS} characters.`
+	};
+	return {
+		ok: true,
+		semanticDiff
+	};
+}
+async function handleSubmitPhaseReview(rawArgs) {
+	const parsed = submitPhaseReviewInputSchema.safeParse(rawArgs);
+	if (!parsed.success) return { content: [toTextContent({
+		error: "Invalid submit_phase_review arguments",
+		issues: z.flattenError(parsed.error)
+	})] };
+	const input = parsed.data;
+	const config = loadConfig();
+	const provider = createLLMProvider(config);
+	if (!provider) return { content: [toTextContent({ error: ERROR_MESSAGES.NO_LLM_PROVIDER })] };
+	const workspaceRoot = getWorkspaceRoot();
+	const resolution = await resolveSemanticDiffInput(workspaceRoot, input);
+	if (!resolution.ok) return { content: [toTextContent({
+		error: resolution.error,
+		...resolution.code ? { code: resolution.code } : {}
+	})] };
+	const { semanticDiff } = resolution;
 	const args = {
 		phaseId: input.phaseId,
 		report: input.report,

package/docs/ROADMAP.md

@@ -0,0 +1,19 @@
+# Roadmap and release checklist
+
+## 0.1.5 — review safety and conflict-loop fixes
+
+- [x] Bound MCP review inputs and resolved payload size.
+- [x] End a rejected third Critic round with a deadlock case.
+- [x] Keep source payloads out of the system prompt and conflict-session history.
+- [x] Read Critic `REQUEST:` paths within the workspace and enforce file and context limits.
+- [x] Use canonical paths for changed-file reads to reject traversal and symlink escapes.
+- [x] Keep model IDs configurable and use the OpenAI Responses API for current reasoning-model compatibility.
+- [x] Add focused tests and update user documentation.
+- [x] Run typecheck, lint, unit tests, build, MCP tool smoke test, and npm package inspection.
+- [ ] Publish `vibe-gate-mcp@0.1.5` from the maintainer's npm account.
+
+## Scope review
+
+The earlier release plan included extra diagnostics and automatic provider fallback. Those do not address a demonstrated defect in the current package. Fallback could also select a different account or incur unexpected provider charges, so providers remain explicitly configured. The 0.1.5 scope is limited to behavior that was broken or unbounded in the existing review path; broader provider work should wait for a concrete user need.
+
+The npm package is not published by the current GitHub Actions workflow; CI only validates and builds it. After the commit is pushed, publish the version from an authenticated maintainer environment.

package/docs/SEMANTIC_DIFF_PAYLOAD.md

@@ -22,6 +22,7 @@ Limits (SSoT: `SEMANTIC_DIFF_SOURCE_FILES` in `src/constants.ts`):
 - Max **10** paths per call
 - Max **1 MiB** per file
 - Max **5 MiB** total
+- The resolved payload must also stay under **500,000 characters**; the same limit applies to inline payloads and payload files.
 
 Paths must be **relative to `VIBE_WORKSPACE_ROOT`**. Absolute paths and `..` traversal are rejected.
 
@@ -44,6 +45,14 @@ Write the same FILE:…CONTENT: string to a UTF-8 file under the workspace (raw
 
 Same FILE:…CONTENT: string as the tool argument. Prefer `files[]`.
 
+## Critic-requested context
+
+On a later review round, the MCP reads paths from the previous Critic response's `REQUEST:` lines under `VIBE_WORKSPACE_ROOT`. Paths are subject to workspace and symlink checks. Each request is limited to 10 files, 1 MiB per file, and 120 context lines; the combined requested context is limited to 500,000 characters. Use a narrower line range when a file needs more context.
+
+The review loop allows three rounds. A rejected or blocked third round produces a deadlock case for human review.
+
+Source payloads are submitted again with each review round and are not stored in `.vibe/review-session.json`.
+
 ## Payload format (what the Critic sees)
 
 ```

package/docs/USAGE.md

@@ -70,6 +70,8 @@ OPENAI_API_KEY=YOUR_OPENAI_API_KEY
 # CRITIC_MODEL=gpt-5.4  # optional, default
 ```
 
+Vibe-Gate sends OpenAI requests through the Responses API. `CRITIC_MODEL` is passed through without a Vibe-Gate model allowlist, so you can select a newer model such as `gpt-6-luna` without waiting for a package update. The model must be available to your OpenAI account and support the Responses API.
+
 ### Anthropic
 
 ```env

package/docs/project/api/mcp-tools.md

@@ -22,14 +22,16 @@ exactly one payload source:
   semanticDiffPath → loadSemanticDiffFromWorkspacePath
   semanticDiff → use inline string
     ↓
-parseSemanticDiff() → filesChanged count / context
+parseSemanticDiff() → filesChanged count
     ↓
-buildContextBlock() → blueprint, deps, FILE:…CONTENT: corpus
+buildContextBlock() → project summary and dependencies
     ↓
-provider.complete([system, user]) → Critic LLM
+provider.complete([system, user]) → Critic LLM (report and source payload sent once in user message)
     ↓
 parseVerdictFromResponse → ACCEPT | REJECT | …
     ↓
+on the next round, read workspace paths from prior REQUEST: blocks (bounded and canonical-path checked)
+    ↓
 if ACCEPT && shouldPersistPhaseStatus(phaseId, updateStatus) → updatePhaseOnAccept → .vibe/status.json
     ↓
 Response JSON: { verdict, model, usage, statusUpdated, statusSkipped?, statusError?, … }
@@ -49,6 +51,8 @@ Response JSON: { verdict, model, usage, statusUpdated, statusSkipped?, statusErr
 | round            | number   | no       | Round (1–3), default 1                                                                         |
 | logToDebt        | object   | no       | When DEBT: `{ subject, rationale }`                                                            |
 
+Input limits are enforced by the MCP schema: phase id 256 characters, report 50,000, dependency list 100 names (256 characters each), and paths 1,024 characters. The resolved source payload is rechecked after loading and limited to 500,000 characters. Critic-requested context is limited to 10 files, 1 MiB per file, and 120 lines per request.
+
 † **Exactly one** of `files` (non-empty), `semanticDiffPath` (non-empty), or `semanticDiff` (non-empty). See [SEMANTIC_DIFF_PAYLOAD.md](../../SEMANTIC_DIFF_PAYLOAD.md).
 
 **ListTools note:** MCP registers `submitPhaseReviewFieldsSchema` (plain ZodObject). Exactly-one rules run in the handler via `submitPhaseReviewInputSchema`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-gate-mcp",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "Adversarial Quality Gate MCP for vibe-coding: IDE AI vs Critic AI, human decides on deadlock",
   "license": "MIT",
@@ -34,6 +34,7 @@
     ".env.example",
     "README.md",
     "CHANGELOG.md",
+    "docs/ROADMAP.md",
     "docs/INSTALLATION.md",
     "docs/CLI_PROVIDERS.md",
     "docs/USAGE.md",