feat: hand MCP work to live coding agents

[mariusvniekerk]

Kenn Forge's MCP companion can identify review work, but it could not hand selected work to a coding agent without clients inferring terminal state or session identity. That made automated handoff unsafe after lost responses and left no authoritative way to discover the coding session ID.

This adds a curated, daemon-authoritative handoff for pull requests, issues, and ad-hoc workspaces. The companion launches a new configured agent runtime, waits for its hook-reported session, and submits exactly one initial message. It also lists fresh coding sessions for a workspace. Ambiguous local mutations are not retried or cleaned up, initial-message recovery is receipt-only, and provider writes remain outside the MCP boundary. Follow-up messaging to an existing session remains out of scope.

Validation

• Full Go suite passed with shuffled tests and serialized package execution.
• Non-mutating Go lint and NilAway passed.
• Frontend unit suite passed: 3,507 tests, with two expected skips.
• API generation was idempotent, and Gitleaks found no secrets across all 14 commits.

^{generated by a clanker}

[roborev-ci]

roborev: Combined Review (9c3a89e)

High-risk security and prompt-delivery flaws remain, alongside several medium reliability and performance issues.

High

• Indirect prompt injection enables local process execution — internal/mcpserver/tools_agent_spawn.go:84
  Provider-controlled PR content can influence a model that can create worktrees and launch coding agents with maintainer privileges, without deterministic human approval. Require an out-of-band, human-approved capability bound to the source and target, or separate/disable handoff when provider-reading tools are enabled.

• Owner-managed PTY delivery is falsely acknowledged — internal/workspace/localruntime/manager.go:2463
  Socket encoding is treated as successful delivery even if the PTY write fails. A permitted 64 KiB payload may also exceed the owner’s framed input limit and be silently discarded. Add an acknowledged operation that verifies the complete write, accounts for framing, and has full-stack coverage.

Medium

• Receipt recovery can accept an unrelated delivery — internal/mcpserver/tools_agent_spawn.go:545
  Recovery ignores agent, session, and byte-count identity, so a concurrent receipt may falsely confirm delivery. Verify all identities and preserve ambiguous: true for uncertain or pending states.

• Wait loops overload the daemon — internal/mcpserver/tools_agent_spawn.go:20
  Polling every 10 ms generates 100–200 requests per second during potentially long operations. Use a slower cadence or bounded backoff with a test-configurable interval.

• Validation errors violate the stable MCP envelope — internal/mcpserver/tools_read.go:98
  Several local failures return plain errors without kind, retryable, or ambiguous. Convert them to typed daemonError values and add a fallback wrapper for unclassified errors.

---

Reviewers: 2 done | Synthesis: codex, 12s | Total: 13m15s

[roborev-ci]

roborev: Combined Review (8fb095f)

The PR has three medium-severity correctness issues; no critical or high-severity findings were identified.

Medium

• internal/mcpserver/tools_diff.go:153 — Diff-file generation rejects empty patches, but binary and metadata-only changes such as pure renames can legitimately produce them, causing emit_diff_file to fail. Generate complete patch sections for binary, rename-only, and mode-only changes, with full-stack test coverage.

• internal/mcpserver/tools_agent_spawn.go:168,586 — Possible writes may be reported as ambiguous:false: recovered pending/uncertain receipts become plain errors, while total-timeout handling can discard a mutation error’s ambiguity. Preserve ambiguity independently of timeout classification and return an ambiguous error for every non-delivered receipt that may represent a write.

• internal/mcpserver/tools_candidates.go:135 — Candidate discovery filters item types only after /activity applies its 5,000-row cap, so busy repository-level activity can hide relevant PR or issue activity. Pass the selected item_types=pr and/or item_types=issue filters to /activity.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 13m18s

[roborev-ci]

roborev: Combined Review (f95b481)

Changes need fixes for two medium-severity reliability issues.

Medium

• internal/server/workspaceapi/initial_message.go:171 — Failures occurring before any write, such as AttachSession failures, incorrectly mark the receipt uncertain and permanently block safe retries. Distinguish definitive pre-write failures from possible partial writes; release reservations for pre-write failures and mark only potentially partial writes uncertain.

• internal/mcpserver/difftmp.go:24 — Deterministic per-item diff filenames are atomically overwritten, so concurrent snapshot requests can return summaries referencing files that now contain another request’s diff. Use content-addressed or request-unique filenames.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 12m9s

[roborev-ci]

roborev: Combined Review (4e75578)

High-severity issues prevent safe merge; three additional medium-severity reliability defects need correction.

High

• Persistent daemon token can leak to a stale loopback listener
  Location: internal/mcpserver/daemon.go:186-225
do indefinitely reuses the cached baseURL and sends the daemon bearer token without revalidating the runtime lock or endpoint identity. If the daemon stops and another local process binds the former port, the next MCP request can disclose the persistent token.
  Fix: Revalidate authoritative runtime identity before every credential-bearing request. Use the existing token-derived proof flow, reject stopped or changed runtime records, atomically bind the verified endpoint and token, and disable credential-bearing redirects.

• Duplicate migration version prevents database migration and server startup
  Location: internal/db/migrations/000047_agent_initial_message_receipts.up.sql:1
  Version 000047 is already assigned to 000047_repository_route_generation, making the embedded migration source invalid.
  Fix: Renumber the new up/down migration files to the next unused sequential version and update related references.

Medium

• Valid no-hunk changes cause diff export failure
  Location: internal/mcpserver/tools_diff.go:153
  Diff export treats an empty Patch as a daemon error, although binary files, pure renames, and mode-only changes can legitimately have no hunks. This makes emit_diff_file fail for valid handoffs.
  Fix: Preserve file metadata while omitting or synthesizing representations for legitimate no-hunk patches, with tests at the real diff-building boundary.

• Multiline initial prompts can be silently lost during agent startup
  Location: internal/mcpserver/tools_agent_spawn.go:552
  Session startup does not guarantee bracketed-paste readiness. A proven no-write rejection is not retried, leaving a live agent and workspace without the requested prompt.
  Fix: Expose a stable paste-not-ready error reason and retry only that proven-no-write condition within the existing timeout. Add end-to-end coverage using a multiline prompt and actual terminal readiness.

---

Reviewers: 2 done | Synthesis: codex, 14s | Total: 19m41s

[roborev-ci]

roborev: Combined Review (4fea1e9)

Verdict: One high-severity security issue and four medium-severity correctness/reliability issues require attention.

High

• Agent launch lacks enforceable human approval — internal/mcpserver/tools_agent.go:97, internal/mcpserver/tools_items.go:213, internal/mcpserver/tools_agent_spawn.go:133, internal/mcpserver/tools_agent_spawn.go:163
  Untrusted PR bodies, issue comments, and event text are returned verbatim to the MCP model. Prompt injection could induce it to invoke kenn_forge_spawn_workspace_with_agent, creating an attacker-controlled worktree and launching a local coding agent with a model-selected prompt. Written guidance is not an enforceable security boundary. Require out-of-band, one-time human authorization bound to the source, target, and initial-message digest, or isolate and disable agent-launch tools unless explicitly enabled.

Medium

• Full-diff export rejects valid empty patches — internal/mcpserver/tools_diff.go:153
  Binary and metadata-only changes can legitimately have empty patches, causing the entire emit_diff_file request to fail. Preserve or synthesize records for these changes and add full-stack coverage using a real binary or mode-only change.

• Diff snapshots overwrite one deterministic path — internal/mcpserver/difftmp.go:25
  Later or concurrent exports for the same PR can replace a snapshot before its caller reads it, leaving summary metadata inconsistent with the file contents. Use immutable unique or content-addressed filenames and remove all snapshots when the MCP server closes.

• Pre-write submission failures are incorrectly marked uncertain — internal/server/workspaceapi/initial_message.go:171
  Attachment and agent-kind failures can occur before any terminal write, yet permanently consume the one-shot receipt as an ambiguous delivery. Distinguish pre-write errors and release their pending reservation; reserve uncertain for failures during or after the PTY write.

• MCP dependency addition rolls back unrelated dependencies — go.mod:9
  Huma, GitLab, Kata, SQLite, OpenTelemetry, the OpenAPI generator, and other direct dependencies are downgraded, potentially restoring previously fixed behavior. Restore the prior versions, add only the required MCP dependencies, and regenerate API artifacts with the current generator.

---

Reviewers: 2 done | Synthesis: codex, 15s | Total: 19m0s