Codex/fix hosted mcp token issuance (#15)

* Fix ownerless MCP token minting

* Restore workspace-first change routes (#9)

* Fix config-scoped state and unchanged checkpoints (#12)

---------

Co-authored-by: Andrew Brookins <a.m.brookins@gmail.com>

Author: rowantrollope

cmd/afs/afs_live_workspace.go

@@ -120,9 +120,13 @@ func saveLiveWorkspaceCheckpoint(ctx context.Context, store *afsStore, workspace
 	if err != nil {
 		return false, err
 	}
+	var metadata controlplane.SaveCheckpointFromLiveOptions
+	if len(options) > 0 {
+		metadata = options[0]
+	}
 	if dirty, known, err := store.workspaceRootDirtyState(ctx, workspace); err != nil {
 		return false, err
-	} else if known && !dirty {
+	} else if known && !dirty && !metadata.AllowUnchanged {
 		if printResult {
 			fmt.Println("No changes to save")
 		}

cmd/afs/afs_mcp.go

@@ -815,8 +815,9 @@ func (s *afsMCPServer) toolCheckpointCreate(ctx context.Context, args map[string
 		return nil, err
 	}
 	saved, err := saveAFSWorkspaceOrLiveRoot(ctx, s.cfg, s.store, workspace, checkpointID, false, controlplane.SaveCheckpointFromLiveOptions{
-		Kind:   controlplane.CheckpointKindManual,
-		Source: controlplane.CheckpointSourceMCP,
+		Kind:           controlplane.CheckpointKindManual,
+		Source:         controlplane.CheckpointSourceMCP,
+		AllowUnchanged: true,
 	})
 	if err != nil {
 		return nil, err

cmd/afs/afs_mcp_test.go

@@ -219,6 +219,43 @@ func TestAFSMCPCheckpointCreatePersistsPendingWrite(t *testing.T) {
 	}
 }
 
+func TestAFSMCPCheckpointCreateAllowsUnchangedWorkspace(t *testing.T) {
+	t.Helper()
+
+	server, closeFn := setupAFSMCPTestServer(t)
+	defer closeFn()
+	server.profile = controlplane.MCPProfileWorkspaceRWCheckpoint
+
+	checkpointResult := server.callTool(context.Background(), "checkpoint_create", map[string]any{
+		"checkpoint": "unchanged-head",
+	})
+	if checkpointResult.IsError {
+		t.Fatalf("checkpoint_create on unchanged workspace returned error result: %+v", checkpointResult)
+	}
+
+	var checkpointPayload map[string]any
+	if err := decodeStructuredContent(checkpointResult.StructuredContent, &checkpointPayload); err != nil {
+		t.Fatalf("decodeStructuredContent(checkpoint unchanged) returned error: %v", err)
+	}
+	if created, _ := checkpointPayload["created"].(bool); !created {
+		t.Fatalf("checkpoint_create created = %#v, want true", checkpointPayload["created"])
+	}
+	if checkpoint, _ := checkpointPayload["checkpoint"].(string); checkpoint != "unchanged-head" {
+		t.Fatalf("checkpoint_create checkpoint = %#v, want %q", checkpointPayload["checkpoint"], "unchanged-head")
+	}
+
+	if _, err := server.store.getSavepointMeta(context.Background(), "repo", "unchanged-head"); err != nil {
+		t.Fatalf("getSavepointMeta(unchanged-head) returned error: %v", err)
+	}
+
+	restoreResult := server.callTool(context.Background(), "checkpoint_restore", map[string]any{
+		"checkpoint": "unchanged-head",
+	})
+	if restoreResult.IsError {
+		t.Fatalf("checkpoint_restore after unchanged create returned error result: %+v", restoreResult)
+	}
+}
+
 func TestAFSMCPFileWriteDoesNotRematerializeLocalWorkspaceCache(t *testing.T) {
 	t.Helper()
 

cmd/afs/config_state.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"crypto/rand"
+	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
@@ -19,6 +20,10 @@ func configPath() string {
 	if cfgPathOverride != "" {
 		return cfgPathOverride
 	}
+	return defaultConfigPath()
+}
+
+func defaultConfigPath() string {
 	exe, err := executablePath()
 	if err != nil {
 		return "afs.config.json"
@@ -480,24 +485,50 @@ func defaultWorkRoot() string {
 	return filepath.Join(stateDir(), "workspaces")
 }
 
-func statePath() string {
+func defaultStatePath() string {
 	return filepath.Join(stateDir(), "state.json")
 }
 
+func statePathForConfig(configFile string) string {
+	cleanConfig := cleanConfigPath(configFile)
+	if cleanConfig == "" || cleanConfig == cleanConfigPath(defaultConfigPath()) {
+		return defaultStatePath()
+	}
+	sum := sha256.Sum256([]byte(cleanConfig))
+	return filepath.Join(stateDir(), "configs", hex.EncodeToString(sum[:8])+".json")
+}
+
+func statePath() string {
+	return statePathForConfig(configPath())
+}
+
 func saveState(st state) error {
-	if err := os.MkdirAll(stateDir(), 0o700); err != nil {
+	target := statePath()
+	if err := os.MkdirAll(filepath.Dir(target), 0o700); err != nil {
 		return err
 	}
 	b, err := json.MarshalIndent(st, "", "  ")
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(statePath(), b, 0o600)
+	return os.WriteFile(target, b, 0o600)
 }
 
 func loadState() (state, error) {
+	if st, err := loadStateFromPath(statePath()); err == nil {
+		return st, nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return state{}, err
+	}
+	if sameConfigPath(statePath(), defaultStatePath()) {
+		return state{}, os.ErrNotExist
+	}
+	return loadStateFromPath(defaultStatePath())
+}
+
+func loadStateFromPath(path string) (state, error) {
 	var st state
-	b, err := os.ReadFile(statePath())
+	b, err := os.ReadFile(path)
 	if err != nil {
 		return st, err
 	}

cmd/afs/sync_integration_test.go

@@ -1316,6 +1316,77 @@ func TestCmdFileCreateExclusiveRoundTrip(t *testing.T) {
 	}
 }
 
+func TestCmdFileCreateExclusiveUsesConfigScopedState(t *testing.T) {
+	t.Helper()
+
+	env := newSyncTestEnv(t)
+	env.startDaemon(t)
+	defer env.stopDaemon()
+
+	oldCfgPathOverride := cfgPathOverride
+	cfgPathOverride = filepath.Join(t.TempDir(), "afs.config.json")
+	t.Cleanup(func() {
+		cfgPathOverride = oldCfgPathOverride
+	})
+
+	cfg := defaultConfig()
+	cfg.ProductMode = productModeLocal
+	cfg.Mode = modeSync
+	cfg.RedisAddr = env.mr.Addr()
+	cfg.RedisDB = 0
+	cfg.LocalPath = env.localRoot
+	cfg.CurrentWorkspace = env.workspace
+	if err := saveConfig(cfg); err != nil {
+		t.Fatalf("saveConfig() returned error: %v", err)
+	}
+
+	st := state{
+		ProductMode:      productModeLocal,
+		RedisAddr:        env.mr.Addr(),
+		RedisDB:          0,
+		CurrentWorkspace: env.workspace,
+		LocalPath:        env.localRoot,
+		Mode:             modeSync,
+		SyncPID:          os.Getpid(),
+	}
+	if err := saveState(st); err != nil {
+		t.Fatalf("saveState() returned error: %v", err)
+	}
+	if sameConfigPath(statePath(), defaultStatePath()) {
+		t.Fatalf("statePath() = %q, want config-scoped path distinct from legacy %q", statePath(), defaultStatePath())
+	}
+
+	legacyState := state{
+		ProductMode:      productModeLocal,
+		RedisAddr:        "127.0.0.1:1",
+		RedisDB:          99,
+		CurrentWorkspace: "legacy-workspace",
+		LocalPath:        t.TempDir(),
+		Mode:             modeSync,
+		SyncPID:          os.Getpid(),
+	}
+	rawLegacyState, err := json.MarshalIndent(legacyState, "", "  ")
+	if err != nil {
+		t.Fatalf("json.MarshalIndent(legacyState) returned error: %v", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(defaultStatePath()), 0o700); err != nil {
+		t.Fatalf("MkdirAll(defaultStatePath dir) returned error: %v", err)
+	}
+	if err := os.WriteFile(defaultStatePath(), rawLegacyState, 0o600); err != nil {
+		t.Fatalf("WriteFile(defaultStatePath) returned error: %v", err)
+	}
+
+	if err := cmdFS([]string{"fs", "create-exclusive", "--content", "agent-c\n", "/tasks/003.claim"}); err != nil {
+		t.Fatalf("cmdFS(create-exclusive with config-scoped state) returned error: %v", err)
+	}
+	assertEventually(t, 3*time.Second, "remote 003.claim", func() bool {
+		return env.remoteExists(t, "tasks/003.claim")
+	})
+	if got := env.readRemoteFile(t, "tasks/003.claim"); got != "agent-c\n" {
+		t.Fatalf("remote content = %q, want %q", got, "agent-c\n")
+	}
+}
+
 // Scenario 1 (burst variant): a batch of files written before startup all
 // land remotely, and the steady-state has no spurious echo loops.
 func TestSyncStartupUploadBurst(t *testing.T) {

internal/controlplane/database_manager.go

@@ -1161,7 +1161,25 @@ func (m *DatabaseManager) ListChangelog(ctx context.Context, databaseID, workspa
 	if err != nil {
 		return ChangelogListResponse{}, err
 	}
-	return service.ListChangelog(ctx, route.WorkspaceID, req)
+	response, err := service.ListChangelog(ctx, route.WorkspaceID, req)
+	if err != nil {
+		return ChangelogListResponse{}, err
+	}
+	m.attachDatabaseToChangelog(&response, route.DatabaseID)
+	return response, nil
+}
+
+func (m *DatabaseManager) ListResolvedChangelog(ctx context.Context, workspace string, req ChangelogListRequest) (ChangelogListResponse, error) {
+	service, _, route, err := m.resolveWorkspace(ctx, workspace)
+	if err != nil {
+		return ChangelogListResponse{}, err
+	}
+	response, err := service.ListChangelog(ctx, route.WorkspaceID, req)
+	if err != nil {
+		return ChangelogListResponse{}, err
+	}
+	m.attachDatabaseToChangelog(&response, route.DatabaseID)
+	return response, nil
 }
 
 // GetSessionChangelogSummary returns the per-session rollup (op counts, delta bytes).
@@ -1173,6 +1191,14 @@ func (m *DatabaseManager) GetSessionChangelogSummary(ctx context.Context, databa
 	return service.GetSessionChangelogSummary(ctx, route.WorkspaceID, sessionID)
 }
 
+func (m *DatabaseManager) GetResolvedSessionChangelogSummary(ctx context.Context, workspace, sessionID string) (SessionChangelogSummary, error) {
+	service, _, route, err := m.resolveWorkspace(ctx, workspace)
+	if err != nil {
+		return SessionChangelogSummary{}, err
+	}
+	return service.GetSessionChangelogSummary(ctx, route.WorkspaceID, sessionID)
+}
+
 // GetPathLastWriter returns the last-writer metadata for a single path.
 func (m *DatabaseManager) GetPathLastWriter(ctx context.Context, databaseID, workspace, path string) (PathLastWriter, error) {
 	service, _, route, err := m.resolveScopedWorkspace(ctx, databaseID, workspace)
@@ -1182,6 +1208,14 @@ func (m *DatabaseManager) GetPathLastWriter(ctx context.Context, databaseID, wor
 	return service.GetPathLastWriter(ctx, route.WorkspaceID, path)
 }
 
+func (m *DatabaseManager) GetResolvedPathLastWriter(ctx context.Context, workspace, path string) (PathLastWriter, error) {
+	service, _, route, err := m.resolveWorkspace(ctx, workspace)
+	if err != nil {
+		return PathLastWriter{}, err
+	}
+	return service.GetPathLastWriter(ctx, route.WorkspaceID, path)
+}
+
 func (m *DatabaseManager) ForkWorkspace(ctx context.Context, databaseID, sourceWorkspace, newWorkspace string) error {
 	service, _, route, err := m.resolveScopedWorkspace(ctx, databaseID, sourceWorkspace)
 	if err != nil {

internal/controlplane/http.go

@@ -1949,6 +1949,64 @@ func handleResolvedWorkspaceRoute(
 			return
 		}
 		writeJSON(w, http.StatusOK, response)
+	case strings.HasSuffix(workspacePath, "/changes"):
+		workspace := strings.TrimSuffix(workspacePath, "/changes")
+		if r.Method != http.MethodGet {
+			writeError(w, fmt.Errorf("%s not allowed", r.Method))
+			return
+		}
+		limit, err := queryInt(r, "limit", 100)
+		if err != nil {
+			writeError(w, err)
+			return
+		}
+		req := ChangelogListRequest{
+			SessionID: strings.TrimSpace(r.URL.Query().Get("session_id")),
+			Path:      strings.TrimSpace(r.URL.Query().Get("path")),
+			Since:     strings.TrimSpace(r.URL.Query().Get("since")),
+			Until:     strings.TrimSpace(r.URL.Query().Get("until")),
+			Limit:     limit,
+			Reverse:   strings.EqualFold(r.URL.Query().Get("direction"), "desc"),
+		}
+		response, err := manager.ListResolvedChangelog(r.Context(), workspace, req)
+		if err != nil {
+			writeError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, response)
+	case strings.Contains(workspacePath, "/sessions/") && strings.HasSuffix(workspacePath, "/summary"):
+		parts := strings.Split(strings.Trim(workspacePath, "/"), "/")
+		if len(parts) != 4 || parts[1] != "sessions" || parts[3] != "summary" {
+			writeError(w, os.ErrNotExist)
+			return
+		}
+		if r.Method != http.MethodGet {
+			writeError(w, fmt.Errorf("%s not allowed", r.Method))
+			return
+		}
+		response, err := manager.GetResolvedSessionChangelogSummary(r.Context(), parts[0], parts[2])
+		if err != nil {
+			writeError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, response)
+	case strings.HasSuffix(workspacePath, "/path-last"):
+		workspace := strings.TrimSuffix(workspacePath, "/path-last")
+		if r.Method != http.MethodGet {
+			writeError(w, fmt.Errorf("%s not allowed", r.Method))
+			return
+		}
+		path := strings.TrimSpace(r.URL.Query().Get("path"))
+		if path == "" {
+			writeError(w, fmt.Errorf("path query parameter is required"))
+			return
+		}
+		response, err := manager.GetResolvedPathLastWriter(r.Context(), workspace, path)
+		if err != nil {
+			writeError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, response)
 	case strings.HasSuffix(workspacePath, "/mcp-tokens"):
 		workspace := strings.TrimSuffix(workspacePath, "/mcp-tokens")
 		switch r.Method {