Replay an injected issue through the forge's agent end to end, and close the remaining holes #8333

This pull covers most of the #8321 checklist but not all of it. It carries Part of #8321, not Closes. I ran bun x tsc --noEmit and the tests that cover the change, and both pass. bun scripts/gate.ts printed nothing, so I can't confirm it passed. The forge's check has not yet run on the push.

What changed

• End to end (test/conversation-fence.test.ts, three new tests):

- A stand-in model reads an injected issue, the person says "thanks", and every close and visibility attempt is held, so nothing changes. - A read and a write sent together: the read raises the fence when it is sent, so the write is held. - A resume cannot repeat a finished write.

• Fence holes (src/core/fence.ts):

- repo is no longer a bare key, because outsiders choose repository names. - Any other bare key stays bare only for a short run of id-like characters (letters, digits, _ . : / + -, at most 64), so a sentence under status or kind is wrapped. - Object keys that are not field names were already wrapped, and every call from the forge's agent already raises the fence when it is sent (readThrough). - I changed one existing expectation in the fence-parts test, which had repo staying bare, and added status as a new case.

• Resume cannot repeat a finished write: new migration 20261102160000-conversation-write and src/core/conversation_writes.ts. /mcp records each completed write by the agent. A resumed turn marks the cut turn's writes as carried, and an identical write sent again is refused with already_done. A fresh message clears them.
• Mint cap: POST /api/v1/conversation-tokens answers 429 once a person holds 30 live conversation tokens.
• named(): values must now be said as whole words ("bug" no longer matches "debug").
• Bounded history: a conversation keeps its newest 1000 turns (TURNS_KEPT).

Already in place, left as is

• The ro-token test for starting a turn (test/conversation-talk.test.ts, #8230) and the 403 for it in conversation_talk.ts.
• The server never accepted JSON-RPC batch arrays, so for "batched calls" I took it to mean the agent sending parallel calls.

Not done

• The end-to-end replay uses direct /mcp calls rather than the full turn runner with its stub binary.
• I did not exercise the resume path through resumeInterrupted; the test calls carryWrites directly.
• scripts/fast.ts said the diff was too broad to name tests. I ran the conversation, schema-migration and hot-read tests, plus 40 files that mention mcp, fence or conversation tokens: 276 pass, 0 fail.

To try it: bun test test/conversation-fence.test.ts test/conversations.test.ts.

🤖 Generated with Claude Code

Closes #8321

This pull covers most of the #8321 checklist but not all of it. It carries Part of #8321, not Closes. I ran bun x tsc --noEmit and the tests that cover the change, and both pass. bun scripts/gate.ts printed nothing, so I can't confirm it passed. The forge's check has not yet run on the push.

What changed

• End to end (test/conversation-fence.test.ts, three new tests):

- A stand-in model reads an injected issue, the person says "thanks", and every close and visibility attempt is held, so nothing changes. - A read and a write sent together: the read raises the fence when it is sent, so the write is held. - A resume cannot repeat a finished write.

• Fence holes (src/core/fence.ts):

- repo is no longer a bare key, because outsiders choose repository names. - Any other bare key stays bare only for a short run of id-like characters (letters, digits, _ . : / + -, at most 64), so a sentence under status or kind is wrapped. - Object keys that are not field names were already wrapped, and every call from the forge's agent already raises the fence when it is sent (readThrough). - I changed one existing expectation in the fence-parts test, which had repo staying bare, and added status as a new case.

• Resume cannot repeat a finished write: new migration 20261102160000-conversation-write and src/core/conversation_writes.ts. /mcp records each completed write by the agent. A resumed turn marks the cut turn's writes as carried, and an identical write sent again is refused with already_done. A fresh message clears them.
• Mint cap: POST /api/v1/conversation-tokens answers 429 once a person holds 30 live conversation tokens.
• named(): values must now be said as whole words ("bug" no longer matches "debug").
• Bounded history: a conversation keeps its newest 1000 turns (TURNS_KEPT).

Already in place, left as is

• The ro-token test for starting a turn (test/conversation-talk.test.ts, #8230) and the 403 for it in conversation_talk.ts.
• The server never accepted JSON-RPC batch arrays, so for "batched calls" I took it to mean the agent sending parallel calls.

Not done

• The end-to-end replay uses direct /mcp calls rather than the full turn runner with its stub binary.
• I did not exercise the resume path through resumeInterrupted; the test calls carryWrites directly.
• scripts/fast.ts said the diff was too broad to name tests. I ran the conversation, schema-migration and hot-read tests, plus 40 files that mention mcp, fence or conversation tokens: 276 pass, 0 fail.

To try it: bun test test/conversation-fence.test.ts test/conversations.test.ts.

🤖 Generated with Claude Code

This round adds the three missing tests and changes no production code. The tests pass and tsc --noEmit is clean. bun scripts/gate.ts printed nothing, so I could not confirm it passed.

What changed

• Resume wiring. The new test in test/conversation-turn.test.ts drives it through the stub binary with the real cut-and-resume flow.

- A cut turn's recorded write is not yet carried. - After resumeInterrupted it is carried. - A fresh say clears it. - I inverted the carry/clear line in begin() as a mutation check, and the test failed.

• Held writes. A needs_confirm answer returns from heldWrite/askedFirst before recordWrite runs, so it is never recorded as done. The new test in test/conversation-fence.test.ts checks that no conversation_write row exists for a held close. After carryWrites, a repeated close is held again rather than refused as already_done. The person's yes through sayYes then closes the issue.
• 429 path. The new test in test/via-token.test.ts fills a user's token cap and posts to /api/v1/conversation-tokens. It expects 429 with retry-after: 60 and error: rate_limited.
• Fencing. The new fence test checks that mimeType with a space or charset ("text/plain; charset=utf-8") is fenced as text and the answer stays valid JSON. repo is not a bare key, so repo names were already fenced before this pull. The 64-character rule only affects bare keys, so it does not change repo names.

What I did not do

• I did not make the check-then-record atomic for two identical parallel calls. The guard only has to stop a resumed turn repeating a write the cut turn finished, and that case is covered by the carried flag. Making the check atomic would need a unique index, which means another migration and pin. If you want it, say so and I'll do it in this pull.
• I added no docs or README change.
• I did not widen scope beyond this hardening pull.

Merged main into the branch and pushed. bun x tsc --noEmit is clean and 65 tests pass in the fence, turn, via-token, conversations and resume-writes files. bun scripts/gate.ts printed nothing, so I could not confirm it passed. I ran those test files, not the whole suite.

Conflicts. main had already landed the same write-repeat guard (#8257, "A resumed turn of the forge's agent does not repeat a write that finished unreported"), under the same migration filename, 20261102160000-conversation-write. I kept main's versions of all five conflicted files and dropped this pull's recordWrite/alreadyDone design. That covers src/core/conversation_writes.ts, the migration, its pin, src/crew/conversation.ts and src/http/mcp.ts. Its table records a write before it runs, completes it with the answer, and answers a repeat from the record once.

What this pull still adds (the rest of the hardening):

• the whole-word naming and tighter bare keys in src/core/fence.ts
• the cap on live conversation tokens (mintConversationToken) and the 429 with retry-after in src/http/api.ts
• the cap of 1000 turns kept per conversation in src/core/conversations.ts

Tests changed in the merge.

• Resume wiring (test/conversation-turn.test.ts): rewritten to check the resumed column on main's table. A resumed turn carries what the cut one recorded, and a fresh message clears it. Inverting the carry/clear line in begin() fails it.
• Held writes (test/conversation-fence.test.ts): the held-then-confirmed test still holds on main's design. A held write leaves no record, a repeat after a resume is held again rather than refused, and the person's yes closes the issue.
• Fenced mimeType/repo (test/conversation-fence.test.ts): the fenced mimeType and repo test is unchanged.
• 429 test (test/via-token.test.ts): unchanged.
• Removed: my "resume cannot repeat a write" test, because test/conversation-resume-writes.test.ts on main covers it.