@bridge_gpt/mcp-server 0.2.12 → 0.2.13

package/build/conductor/local-merge.js

@@ -0,0 +1,212 @@
+/**
+ * Client-side (local) conductor merge executor (F4).
+ *
+ * Performs the GitHub merge in the epic-tick process using the agent's OWN
+ * granted `gh` credentials, instead of the hosted Bridge API merge route (which
+ * would require the backend to hold global GitHub write scope — the reason a
+ * smoke-test merge failed with `provider_unauthorized`). Opt-in only: the runtime
+ * selects this executor when `policy_json.local_merge.enabled === true`.
+ *
+ * It mirrors the backend merge guard's decision order — approval precondition →
+ * re-read PR head (drift / not-open guard) → revalidate required CI for the EXACT
+ * head SHA → provider merge — and returns the SAME `merge.*` ledger events the
+ * backend route returns, so the rest of {@link processGateMetMerge} is unchanged.
+ *
+ * Subprocess safety: argument arrays (never a shell string), a validated numeric
+ * PR number, a merge method from a fixed allowlist, `GH_PROMPT_DISABLED` to avoid
+ * interactive hangs, and no token/secret ever logged. Default OFF everywhere.
+ */
+import { spawnSync } from "child_process";
+import { pollCiChecksForCommit, } from "./bridge-api-client.js";
+const MERGE_METHODS = new Set(["squash", "merge", "rebase"]);
+/**
+ * Hard wall-clock cap on every `gh` subprocess. The epic-tick runs in a single
+ * stateless process with no separate scheduler thread — a `gh` call that hangs
+ * (network stall, an auth prompt that slips past GH_PROMPT_DISABLED) would block
+ * the Node event loop indefinitely, freezing the whole tick. Killing at 60s
+ * yields a `timedOut` result the executor maps to a distinct `*_timeout` reason.
+ */
+const DEFAULT_COMMAND_TIMEOUT_MS = 60_000;
+/** Coerce an untrusted method value to a safe allowlisted method (default squash). */
+export function resolveLocalMergeMethod(value) {
+    return typeof value === "string" && MERGE_METHODS.has(value)
+        ? value
+        : "squash";
+}
+function defaultRunCommand(cmd, args, env) {
+    const result = spawnSync(cmd, args, {
+        encoding: "utf8",
+        env: { ...process.env, ...env },
+        timeout: DEFAULT_COMMAND_TIMEOUT_MS,
+    });
+    // On timeout spawnSync kills the child (status: null, signal: "SIGTERM") and
+    // sets `error.code === "ETIMEDOUT"`. Surface that as a first-class flag.
+    const timedOut = result.error?.code === "ETIMEDOUT" ||
+        result.signal === "SIGTERM";
+    return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        timedOut,
+    };
+}
+function buildResponse(request, status, reason, terminal, ledgerEvents) {
+    return {
+        action_key: request.action_key,
+        repo_name: request.repo_name,
+        pr_number: request.pr_number,
+        expected_head_sha: request.expected_head_sha,
+        status,
+        reason,
+        terminal,
+        ledger_events: ledgerEvents,
+    };
+}
+/**
+ * Decide whether every required CI check is green for the polled head SHA. When
+ * the gate lists no required checks, fall back to the poll's `all_passed` flag.
+ * Defensive against the poll response's exact shape: a check counts as green if
+ * any of `conclusion==="success"`, `status==="success"`, `green===true`, or
+ * `bucket==="pass"`.
+ */
+export function allRequiredChecksGreen(pollResponse, requiredChecks) {
+    if (pollResponse === null || typeof pollResponse !== "object")
+        return false;
+    let obj = pollResponse;
+    // pollCiChecksForCommit returns the `{available, reason, action, detail}`
+    // envelope; checks/all_passed live under `detail`. Unwrap it (envelope-
+    // tolerant, mirroring normalizeCiSnapshot) — reading the top level alone made
+    // every required check look missing → merge always failed ci_not_green.
+    const maybeDetail = obj.detail;
+    if (maybeDetail &&
+        typeof maybeDetail === "object" &&
+        (Array.isArray(maybeDetail.checks) ||
+            "all_passed" in maybeDetail)) {
+        obj = maybeDetail;
+    }
+    const rawChecks = Array.isArray(obj.checks) ? obj.checks : [];
+    if (requiredChecks.length === 0) {
+        return obj.all_passed === true;
+    }
+    const byName = new Map();
+    for (const c of rawChecks) {
+        const name = typeof c.name === "string" ? c.name : null;
+        if (name !== null)
+            byName.set(name, c);
+    }
+    const isGreen = (c) => {
+        if (!c)
+            return false;
+        const conclusion = typeof c.conclusion === "string" ? c.conclusion.toLowerCase() : "";
+        const status = typeof c.status === "string" ? c.status.toLowerCase() : "";
+        const bucket = typeof c.bucket === "string" ? c.bucket.toLowerCase() : "";
+        return c.green === true || conclusion === "success" || status === "success" || bucket === "pass";
+    };
+    return requiredChecks.every((name) => isGreen(byName.get(name)));
+}
+/**
+ * Build a `(access, request) => Promise<ConductorMergeResponse>` that performs the
+ * merge locally via `gh`. Drop-in replacement for `mergePullRequestForGate` used
+ * by {@link processGateMetMerge}'s `merge` seam.
+ */
+export function makeLocalMergeExecutor(options = {}, deps = {}) {
+    const method = resolveLocalMergeMethod(options.method);
+    const run = deps.runCommand ?? defaultRunCommand;
+    const pollCi = deps.pollCi ?? pollCiChecksForCommit;
+    // Non-interactive + no-noise env for gh; the caller's env (incl. any token)
+    // is overlaid first, then the safety pins.
+    const ghEnv = {
+        ...deps.env,
+        GH_PROMPT_DISABLED: "1",
+        GH_NO_UPDATE_NOTIFIER: "1",
+    };
+    return async (access, request) => {
+        const pr = request.pr_number;
+        const expectedSha = request.expected_head_sha;
+        const requiredChecks = request.gate?.required_checks ?? [];
+        const baseDetails = {
+            action_key: request.action_key,
+            repo: request.repo_name,
+            pr_number: pr,
+            expected_head_sha: expectedSha,
+            merge_method: method,
+            executor: "local",
+        };
+        const fail = (reason) => buildResponse(request, "failed", reason, false, [
+            { type: "merge.failed", status: "failed", reason, details: baseDetails },
+        ]);
+        // 1. Approval precondition — never merge when approval is required.
+        if (options.approvalRequired) {
+            return buildResponse(request, "pending_approval", "local_merge_approval_required", false, [
+                {
+                    type: "merge.pending_approval",
+                    status: "pending_approval",
+                    reason: "local_merge_approval_required",
+                    details: baseDetails,
+                },
+            ]);
+        }
+        // 2. Re-read PR head + open-state (head-drift / closed guard).
+        const view = run("gh", ["pr", "view", String(pr), "--json", "headRefOid,state"], ghEnv);
+        if (view.timedOut)
+            return fail("gh_pr_view_timeout");
+        if (view.status !== 0)
+            return fail("gh_pr_view_failed");
+        let headOid;
+        let state;
+        try {
+            const parsed = JSON.parse(view.stdout);
+            headOid = parsed.headRefOid;
+            state = parsed.state;
+        }
+        catch {
+            return fail("gh_pr_view_unparseable");
+        }
+        if (typeof state === "string" && state.toUpperCase() !== "OPEN")
+            return fail("pr_not_open");
+        if (typeof headOid !== "string" || headOid.toLowerCase() !== expectedSha.toLowerCase()) {
+            return fail("head_drift");
+        }
+        // 3. Revalidate required CI green for the exact head SHA.
+        let pollResponse;
+        try {
+            pollResponse = await pollCi(access, expectedSha);
+        }
+        catch {
+            return fail("ci_poll_failed");
+        }
+        if (!allRequiredChecksGreen(pollResponse, requiredChecks))
+            return fail("ci_not_green");
+        // 4. Provider merge.
+        const merge = run("gh", ["pr", "merge", String(pr), `--${method}`, "--match-head-commit", expectedSha], ghEnv);
+        if (merge.status !== 0) {
+            const mergeFailReason = merge.timedOut ? "gh_merge_timeout" : "gh_merge_failed";
+            return buildResponse(request, "failed", mergeFailReason, false, [
+                { type: "merge.attempted", status: "attempted", details: baseDetails },
+                { type: "merge.failed", status: "failed", reason: mergeFailReason, details: baseDetails },
+            ]);
+        }
+        // 5. Best-effort resolve the squash/merge commit SHA for the audit trail.
+        let mergeCommitSha;
+        const post = run("gh", ["pr", "view", String(pr), "--json", "mergeCommit"], ghEnv);
+        if (post.status === 0) {
+            try {
+                const oid = JSON.parse(post.stdout)?.mergeCommit;
+                if (oid && typeof oid === "object" && typeof oid.oid === "string") {
+                    mergeCommitSha = oid.oid;
+                }
+            }
+            catch {
+                /* best-effort only */
+            }
+        }
+        const succeededDetails = {
+            ...baseDetails,
+            ...(mergeCommitSha ? { merge_commit_sha: mergeCommitSha } : {}),
+        };
+        return buildResponse(request, "succeeded", null, true, [
+            { type: "merge.attempted", status: "attempted", details: baseDetails },
+            { type: "merge.succeeded", status: "succeeded", details: succeededDetails },
+        ]);
+    };
+}

package/build/conductor/pr-ci-producer.js

@@ -9,7 +9,7 @@
  * check. All event types come from the existing conductor taxonomy and use only
  * allowlisted top-level data keys.
  */
-import { GIT_CI_PRODUCER, } from "./git-ci-types.js";
+import { GIT_CI_PRODUCER, REVIEW_STATE, } from "./git-ci-types.js";
 import { evaluateDoneGate, normalizeCiSnapshot, parseDoneGateConfig } from "./done-gate.js";
 import { observeReviewWithResolved } from "./pr-review-producer.js";
 import { fetchEffectiveSupervisorSetup, fetchActiveEpicRuns, fetchEpicRunState, pollCiChecksForCommit, resolveConductorBridgeApiAccess, } from "./bridge-api-client.js";
@@ -455,7 +455,17 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
                 rawConfig = undefined;
             }
             const gateConfig = parseDoneGateConfig(rawConfig);
-            if (gateConfig.enabled && gateConfig.valid) {
+            // F6: this poll-driven path observes CI only — it has NO review snapshot
+            // (unlike observeWithResolved, which fetches one via observeReviewWithResolved).
+            // A composite gate with any review_state condition can therefore never be
+            // satisfied here and would only fail closed silently. Rather than pretend to
+            // be a gate path, refuse to evaluate review-gated configs and defer to
+            // `wait_for_done_gate` (the complete observer). CI-only gates still emit here.
+            const requiresReview = gateConfig.conditions.some((c) => c.type === REVIEW_STATE);
+            if (gateConfig.enabled && gateConfig.valid && requiresReview) {
+                result.reason = "review-gated config: gate.met deferred to wait_for_done_gate (poll path is CI-only)";
+            }
+            if (gateConfig.enabled && gateConfig.valid && !requiresReview) {
                 const evaluation = evaluateDoneGate(gateConfig, binding, snapshot, now());
                 if (evaluation.met) {
                     result.gate_met = true;

package/build/conductor/store.js

@@ -180,11 +180,14 @@ export function resolveConductorStoreConfig(env = process.env) {
  * event type to the same CHECK vocabulary. Bumped to 6 in BAPI-445 because the
  * pre-implementation spec re-review verdict feature adds the `spec_review.passed`
  * and `spec_review.changes_requested` event types to the same `events.type`
- * CHECK vocabulary. Older ledgers stamped at a lower version are rebuilt by
- * {@link migrateConductorSchemaIfNeeded} so their CHECK clause accepts the
- * current taxonomy.
+ * CHECK vocabulary. Bumped to 7 because the durable parse-after-merge fold adds
+ * the `parse.triggered` event type to the same `events.type` CHECK vocabulary
+ * (replacing the in-memory parse-wait map so stateless epic-tick invocations can
+ * fold a merged ticket to `done`). Older ledgers stamped at a lower version are
+ * rebuilt by {@link migrateConductorSchemaIfNeeded} so their CHECK clause accepts
+ * the current taxonomy.
  */
-export const CURRENT_CONDUCTOR_SCHEMA_VERSION = 6;
+export const CURRENT_CONDUCTOR_SCHEMA_VERSION = 7;
 /** Render the taxonomy `CHECK (type IN (...))` clause from the single source of truth. */
 function buildTypeCheckClause() {
     const list = SEMANTIC_EVENT_TYPES.map((t) => `'${t}'`).join(", ");

package/build/conductor/taxonomy.js

@@ -43,6 +43,10 @@ export const SEMANTIC_EVENT_TYPES = [
     // mis-folds a spec-review outcome as the implementation PR's review state.
     "spec_review.passed",
     "spec_review.changes_requested",
+    // Durable parse-after-merge marker. Emitted by epic-tick when it triggers a
+    // post-merge repository re-index, so the (stateless) reconcile loop can fold a
+    // merged ticket to `done` from the ledger instead of an in-memory wait map.
+    "parse.triggered",
 ];
 /**
  * Type guard: returns `true` only when `value` is one of the exact taxonomy