@bridge_gpt/mcp-server 0.2.12 → 0.2.13

package/build/sfcc/reads-system-object.js

@@ -0,0 +1,162 @@
+/**
+ * SFCC system-object introspection read tools (BAPI-401, T1–T3).
+ *
+ * Implements:
+ *   system_object_list           — GET  /system_object_definitions
+ *   system_object_get            — GET  /system_object_definitions/{type}
+ *   system_object_attribute_search — POST /system_object_definitions/{type}/attribute_definition_search
+ *
+ * All tools are read-only, run behind the T1 call-time gate, and route
+ * oversized payloads through the sfcc/output.ts truncate-and-save seam.
+ */
+import path from "path";
+import { z } from "zod";
+import { ocapiGet, ocapiPost } from "./client.js";
+import { withSfccGate } from "./tool-wrapper.js";
+import { normalizeOcapiBody } from "./ocapi-shape.js";
+import { truncateAndSaveIfNeeded } from "./output.js";
+// ---------------------------------------------------------------------------
+// Annotations (SPEC: read-only against developer sandboxes)
+// ---------------------------------------------------------------------------
+const READ_ANNOTATIONS = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+};
+// ---------------------------------------------------------------------------
+// Input schemas
+// ---------------------------------------------------------------------------
+const systemObjectListInput = z.object({
+    count: z.number().optional().describe("Maximum number of system object types to return."),
+    start: z.number().optional().describe("Zero-based offset for paging."),
+});
+const systemObjectGetInput = z.object({
+    object_type: z.string().describe("System object type identifier, e.g. \"Product\" or \"Order\"."),
+    expand_attribute_definitions: z.boolean().optional().describe("When true, include the full attribute definition list in the response. " +
+        "May produce a large payload — auto-saved locally when oversized."),
+});
+const systemObjectAttributeSearchInput = z.object({
+    object_type: z.string().describe("System object type to search within, e.g. \"Order\"."),
+    query: z.union([z.string(), z.record(z.string(), z.any())]).describe("Search query. Pass a plain string for a text search across id and display_name, " +
+        "or a structured OCAPI query object (term_query, filtered_query, etc.)."),
+    start: z.number().optional().describe("Zero-based offset for paging."),
+    count: z.number().optional().describe("Maximum number of results to return."),
+    sorts: z.array(z.any()).optional().describe("Array of OCAPI sort descriptors."),
+});
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function safeTimestamp() {
+    return new Date().toISOString().replace(/[:.]/g, "-");
+}
+function safeType(objectType) {
+    return encodeURIComponent(objectType).replace(/%/g, "_");
+}
+function textResult(text) {
+    return { content: [{ type: "text", text }] };
+}
+async function saveAndReturn(text, dir, filename) {
+    const output = await truncateAndSaveIfNeeded(text, dir, filename);
+    return textResult(output);
+}
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+function buildSystemObjectListHandler(gateDeps, getDocsDir) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        const { count, start } = systemObjectListInput.parse(args);
+        const queryParams = {};
+        if (count !== undefined)
+            queryParams.count = String(count);
+        if (start !== undefined)
+            queryParams.start = String(start);
+        const queryStr = Object.keys(queryParams).length > 0
+            ? "?" + new URLSearchParams(queryParams).toString()
+            : "";
+        const result = await ocapiGet(`/system_object_definitions${queryStr}`, credentials);
+        if (!result.ok) {
+            return textResult(JSON.stringify({ error: `OCAPI error`, status: result.status, body: result.body }, null, 2));
+        }
+        const normalized = normalizeOcapiBody(result.body);
+        const text = JSON.stringify(normalized, null, 2);
+        const dir = path.join(await getDocsDir(), "sfcc");
+        return saveAndReturn(text, dir, `system-object-list-${safeTimestamp()}.json`);
+    });
+}
+function buildSystemObjectGetHandler(gateDeps, getDocsDir) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        const { object_type, expand_attribute_definitions } = systemObjectGetInput.parse(args);
+        const encodedType = encodeURIComponent(object_type);
+        const expandParam = expand_attribute_definitions === true
+            ? "?expand=attribute_definitions"
+            : "";
+        const result = await ocapiGet(`/system_object_definitions/${encodedType}${expandParam}`, credentials);
+        if (!result.ok) {
+            return textResult(JSON.stringify({ error: `OCAPI error`, status: result.status, body: result.body }, null, 2));
+        }
+        const normalized = normalizeOcapiBody(result.body);
+        const text = JSON.stringify(normalized, null, 2);
+        const dir = path.join(await getDocsDir(), "sfcc");
+        return saveAndReturn(text, dir, `system-object-get-${safeType(object_type)}-${safeTimestamp()}.json`);
+    });
+}
+function buildSystemObjectAttributeSearchHandler(gateDeps, getDocsDir) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        const { object_type, query, start, count, sorts } = systemObjectAttributeSearchInput.parse(args);
+        const encodedType = encodeURIComponent(object_type);
+        // Coerce plain string queries into OCAPI text_query shape
+        const resolvedQuery = typeof query === "string"
+            ? { text_query: { fields: ["id", "display_name"], search_phrase: query } }
+            : query;
+        const postBody = { query: resolvedQuery };
+        if (start !== undefined)
+            postBody.start = start;
+        if (count !== undefined)
+            postBody.count = count;
+        if (sorts !== undefined)
+            postBody.sorts = sorts;
+        const result = await ocapiPost(`/system_object_definitions/${encodedType}/attribute_definition_search`, postBody, credentials);
+        if (!result.ok) {
+            return textResult(JSON.stringify({ error: `OCAPI error`, status: result.status, body: result.body }, null, 2));
+        }
+        const normalized = normalizeOcapiBody(result.body);
+        const text = JSON.stringify(normalized, null, 2);
+        const dir = path.join(await getDocsDir(), "sfcc");
+        return saveAndReturn(text, dir, `system-object-search-${safeType(object_type)}-${safeTimestamp()}.json`);
+    });
+}
+/**
+ * Register the three SFCC system-object introspection read tools.
+ *
+ * Called from `registerSfccTools` — no direct `index.ts` edits needed.
+ */
+export function registerSystemObjectReadTools(registerTool, deps) {
+    const { gateDeps, getDocsDir } = deps;
+    registerTool("system_object_list", {
+        description: "List all system object types from the developer sandbox via " +
+            "GET /system_object_definitions. Read-only. " +
+            "Accepts optional `count` and `start` for paging (OCAPI default pagination applies when omitted). " +
+            "Oversized outputs are auto-saved locally and previewed inline.",
+        inputSchema: systemObjectListInput,
+        annotations: READ_ANNOTATIONS,
+    }, buildSystemObjectListHandler(gateDeps, getDocsDir));
+    registerTool("system_object_get", {
+        description: "Retrieve a system object type from the developer sandbox. Read-only. " +
+            "GET /system_object_definitions/{type}. " +
+            "Prefer system_object_attribute_search for targeted attribute lookups — " +
+            "use this for a full type dump or expanded attribute list " +
+            "(expand_attribute_definitions=true). Oversized payloads are auto-saved locally.",
+        inputSchema: systemObjectGetInput,
+        annotations: READ_ANNOTATIONS,
+    }, buildSystemObjectGetHandler(gateDeps, getDocsDir));
+    registerTool("system_object_attribute_search", {
+        description: "Search attribute definitions for a system object type. Read-only. " +
+            "POST /system_object_definitions/{type}/attribute_definition_search. " +
+            "Prefer over system_object_get+expand for targeted c_ attribute lookups. " +
+            "Pass a plain string for text search or a structured OCAPI query object. " +
+            "Oversized results are auto-saved locally.",
+        inputSchema: systemObjectAttributeSearchInput,
+        annotations: READ_ANNOTATIONS,
+    }, buildSystemObjectAttributeSearchHandler(gateDeps, getDocsDir));
+}

package/build/sfcc/register.js

@@ -0,0 +1,73 @@
+/**
+ * SFCC MCP tool registration entrypoint.
+ *
+ * Exports `registerSfccTools(registerTool, deps)` so index.ts can wire all
+ * SFCC tools with a single call adjacent to `registerConductorTools`. All
+ * SFCC business logic lives inside the sfcc/ module; index.ts stays a
+ * thin registration/composition layer.
+ */
+import { z } from "zod";
+import { buildSfccSetupStatusHandler } from "./setup-status.js";
+import { withSfccGate } from "./tool-wrapper.js";
+import { checkPermissionsTool } from "./permissions.js";
+import { registerSystemObjectReadTools } from "./reads-system-object.js";
+import { registerSfccCustomObjectDefReadTools } from "./reads-custom-object-def.js";
+import { registerSitePreferenceTools } from "./reads-site-preference.js";
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+/**
+ * Register all SFCC tools through the host's registerTool wrapper.
+ *
+ * Call this once in index.ts, immediately after `registerConductorTools(registerTool)`.
+ * Sub-task tickets (2–4) add their read tools here; they never touch index.ts.
+ */
+export function registerSfccTools(registerTool, deps) {
+    const gateDeps = {
+        buildGetUrl: deps.buildGetUrl,
+        getGetHeaders: deps.getGetHeaders,
+        repoName: deps.repoName,
+    };
+    // sfcc_setup_status — aggregate prerequisite reporter.
+    registerTool("sfcc_setup_status", {
+        description: "Report on every SFCC prerequisite: Bridge API key, repo name, version config, " +
+            "dw.json presence/uniqueness, and AM token acquisition. Always-registered; " +
+            "returns status without requiring full SFCC configuration to be complete.",
+        inputSchema: z.object({}),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, buildSfccSetupStatusHandler(deps.buildGetUrl, deps.getGetHeaders, deps.repoName, deps.getResolvedApiKey));
+    // check_permissions — OCAPI access probe + settings JSON printer.
+    const gatedCheckPermissions = withSfccGate(gateDeps, async (_args, credentials) => checkPermissionsTool(credentials));
+    registerTool("check_permissions", {
+        description: "Probe SFCC OCAPI access via GET /system_object_definitions. " +
+            "On 200: reports OK and the detected OCAPI version. " +
+            "On 401/403: prints the exact OCAPI Settings JSON to paste in Business Manager " +
+            "(split read-only vs. write/import grants).",
+        inputSchema: z.object({
+            instance: z
+                .string()
+                .optional()
+                .describe("Explicit sandbox hostname to use instead of dw.json auto-detection."),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, gatedCheckPermissions);
+    // Heavy read tools are gated behind ACTIVE_GROUPS.has("sfcc") (BAPI-453).
+    // sfcc_setup_status and check_permissions above remain always-on (D-4 decision).
+    if (deps.includeReadTools) {
+        // system_object_list, system_object_get, system_object_attribute_search (BAPI-401 T1–T3)
+        registerSystemObjectReadTools(registerTool, {
+            gateDeps,
+            getDocsDir: deps.getDocsDir,
+        });
+        // custom_object_definition_list, custom_object_definition_get (BAPI-402 T4–T5)
+        registerSfccCustomObjectDefReadTools(registerTool, {
+            gateDeps,
+            getDocsDir: deps.getDocsDir,
+        });
+        // site_preference_get, site_preference_search (BAPI-403 T6 — optional)
+        registerSitePreferenceTools(registerTool, {
+            gateDeps,
+            getDocsDir: deps.getDocsDir,
+        });
+    }
+}

package/build/sfcc/setup-status.js

@@ -0,0 +1,114 @@
+/**
+ * sfcc_setup_status — SFCC prerequisite aggregator.
+ *
+ * Reports on every prerequisite needed to use SFCC tools, completely free of
+ * secret values. Each check runs independently so a failure in one does not
+ * prevent the others from running.
+ */
+import { SFCC_VERSIONS, getSfccVersionConfig } from "./config.js";
+import { resolveSfccCredentials } from "./credentials.js";
+import { getAmToken } from "./client.js";
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+/**
+ * Aggregate every SFCC prerequisite into one status report.
+ *
+ * Checks (in order):
+ *   1. Bridge API key resolved
+ *   2. Repo name set (REPO_NAME)
+ *   3. version config field is an SFCC version
+ *   4. dw.json found / instance unambiguous
+ *   5. AM token acquisition
+ *
+ * Never throws; each check is caught independently so partial states are
+ * always reported. Output is completely secret-free.
+ */
+export async function sfccSetupStatusTool(deps) {
+    const lines = ["## SFCC Setup Status\n"];
+    // 1. Bridge API key
+    const apiKeyOk = Boolean(deps.apiKey);
+    lines.push(`1. Bridge API Key: ${apiKeyOk ? "✓ Resolved" : "✗ Missing (set BAPI_API_KEY)"}`);
+    // 2. Repo name
+    const repoOk = Boolean(deps.repoName);
+    lines.push(`2. Repo Name: ${repoOk ? `✓ Set (${deps.repoName})` : "✗ Not set (set BAPI_REPO_NAME)"}`);
+    // 3. SFCC version config
+    let versionStatus = "✗ Not set";
+    let resolvedVersion = null;
+    if (apiKeyOk && repoOk) {
+        try {
+            resolvedVersion = await getSfccVersionConfig(deps.buildGetUrl, deps.getGetHeaders, deps.repoName);
+            if (resolvedVersion === null) {
+                versionStatus = "✗ Not set (configure the 'version' field in Bridge API project settings)";
+            }
+            else if (!SFCC_VERSIONS.includes(resolvedVersion)) {
+                versionStatus = `✗ '${resolvedVersion}' is not an SFCC version (expected: ${SFCC_VERSIONS.join(", ")})`;
+            }
+            else {
+                versionStatus = `✓ '${resolvedVersion}'`;
+            }
+        }
+        catch {
+            versionStatus = "✗ Could not read (Bridge API error)";
+        }
+    }
+    else {
+        versionStatus = "— Skipped (Bridge API not configured)";
+    }
+    lines.push(`3. SFCC Version: ${versionStatus}`);
+    // 4. dw.json / credential resolution
+    let credStatus = "✗ Missing";
+    let resolvedCredentials = null;
+    try {
+        const result = await resolveSfccCredentials();
+        if (result.ok) {
+            // Report source and instance ID only — never the secret values.
+            resolvedCredentials = {
+                hostname: result.credentials.hostname.split(".")[0] ?? result.credentials.hostname,
+                source: result.credentials.source,
+            };
+            credStatus = `✓ Found (${resolvedCredentials.source})`;
+        }
+        else {
+            credStatus = `✗ ${result.error}`;
+        }
+    }
+    catch (err) {
+        credStatus = `✗ Resolution error: ${err instanceof Error ? err.message : String(err)}`;
+    }
+    lines.push(`4. dw.json / Credentials: ${credStatus}`);
+    // 5. AM token acquisition (only if credentials were resolved)
+    let tokenStatus = "— Skipped (credentials not available)";
+    if (resolvedCredentials) {
+        try {
+            const credResult = await resolveSfccCredentials();
+            if (credResult.ok) {
+                await getAmToken(credResult.credentials);
+                tokenStatus = `✓ Token acquired for instance ${resolvedCredentials.hostname}`;
+            }
+            else {
+                tokenStatus = "✗ Credentials not resolved";
+            }
+        }
+        catch (err) {
+            // Sanitize: strip any token/secret-looking content from error message.
+            const msg = err instanceof Error ? err.message : String(err);
+            // The error from getAmToken is already sanitized (includes only HTTP status + instance ID).
+            tokenStatus = `✗ ${msg}`;
+        }
+    }
+    lines.push(`5. AM Token: ${tokenStatus}`);
+    lines.push("\nRun `check_permissions` to probe OCAPI access once steps 1–5 are all green.");
+    return {
+        content: [{ type: "text", text: lines.join("\n") }],
+    };
+}
+/**
+ * Build the sfcc_setup_status handler bound to the host's runtime deps.
+ */
+export function buildSfccSetupStatusHandler(buildGetUrl, getGetHeaders, repoName, getApiKey) {
+    return async (_args) => {
+        const apiKey = await getApiKey();
+        return sfccSetupStatusTool({ buildGetUrl, getGetHeaders, repoName, apiKey });
+    };
+}

package/build/sfcc/tool-wrapper.js

@@ -0,0 +1,70 @@
+/**
+ * Call-time SFCC configuration gate.
+ *
+ * Wraps every SFCC tool handler. Evaluated at call time (NOT startup) so all
+ * SFCC tools are always registered — the gate decides at invocation whether the
+ * repo is configured for SFCC and has valid local credentials.
+ *
+ * The "not configured" response distinguishes three failure classes:
+ *   (a) Bridge-auth/config failure — could not read /config-field/version.
+ *   (b) version-not-SFCC — version is set but is not an SFCC version.
+ *   (c) missing/ambiguous dw.json — credential resolution failed.
+ */
+import { SFCC_VERSIONS, getSfccVersionConfig } from "./config.js";
+import { resolveSfccCredentials } from "./credentials.js";
+// ---------------------------------------------------------------------------
+// Not-configured envelope helpers
+// ---------------------------------------------------------------------------
+function notConfigured(failureClass, message) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    error: "NOT_CONFIGURED",
+                    status: 503,
+                    failure_class: failureClass,
+                    message,
+                }),
+            },
+        ],
+    };
+}
+// ---------------------------------------------------------------------------
+// Gate
+// ---------------------------------------------------------------------------
+/**
+ * Wrap an SFCC tool handler with the call-time version + credential gate.
+ *
+ * The returned handler:
+ * 1. Reads /config-field/version via Bridge API.
+ * 2. Validates the value is an SFCC version.
+ * 3. Resolves dw.json credentials.
+ * 4. Calls the inner handler only if all checks pass.
+ */
+export function withSfccGate(deps, handler) {
+    return async (args) => {
+        // (a) Read /config-field/version
+        const version = await getSfccVersionConfig(deps.buildGetUrl, deps.getGetHeaders, deps.repoName);
+        if (version === null) {
+            return notConfigured("bridge-auth", "Could not read the SFCC version from Bridge API (/config-field/version). " +
+                "Ensure your Bridge API key is set and the repo is configured. " +
+                "Run sfcc_setup_status for a full diagnostic.");
+        }
+        // (b) Validate version is an SFCC version
+        if (!SFCC_VERSIONS.includes(version)) {
+            return notConfigured("version-not-sfcc", `Repo version '${version}' is not an SFCC version. ` +
+                `Expected one of: ${SFCC_VERSIONS.join(", ")}. ` +
+                `Update the version field in your Bridge API project settings.`);
+        }
+        // (c) Resolve credentials from dw.json
+        const explicitHostname = typeof args.instance === "string" ? args.instance : undefined;
+        const credResult = await resolveSfccCredentials(explicitHostname);
+        if (!credResult.ok) {
+            return notConfigured("missing-dw-json", `SFCC credential resolution failed: ${credResult.error} ` +
+                "Ensure a dw.json file exists in your project root with " +
+                "hostname, client-id, and client-secret fields.");
+        }
+        return handler(args, credResult.credentials);
+    };
+}

package/build/start-tickets-conductor.js

@@ -22,6 +22,7 @@
 import { randomBytes } from "node:crypto";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveProfiles } from "./mcp-profile.js";
 import { resolveStartTicketsRepoName } from "./start-tickets-repo.js";
 // ---------------------------------------------------------------------------
 // Identity minting
@@ -141,9 +142,16 @@ export function isConductorFlagEnabled(value) {
  * upstream.
  */
 export function buildConductorWorkerEnv(context, worker, parentEnv) {
+    // Merge "conductor" into the parent project's profile rather than overwriting it.
+    // This preserves groups like "sfcc" that the project already has, while adding
+    // the conductor-specific tools. Only validated group tokens from resolveProfiles
+    // are threaded — arbitrary parentEnv keys never leak through.
+    const parentActiveGroups = new Set(resolveProfiles(parentEnv.BRIDGE_MCP_PROFILE));
+    parentActiveGroups.add("conductor");
+    const mergedProfile = Array.from(parentActiveGroups).join(",");
     const env = {
         BAPI_CONDUCTOR_ENABLED: "1",
-        BRIDGE_MCP_PROFILE: "conductor",
+        BRIDGE_MCP_PROFILE: mergedProfile,
         BAPI_CONDUCTOR_RUN_ID: context.runId,
         BAPI_CONDUCTOR_WORKER_ID: worker.workerId,
         BAPI_CONDUCTOR_TICKET_KEY: worker.ticketKey,

package/build/start-tickets.js

@@ -806,16 +806,55 @@ function pickWorktreePathField(parsed) {
     }
     return undefined;
 }
+/**
+ * F7: decide whether a PRE-EXISTING branch is safe to reuse as a conductor
+ * worktree base. A branch whose tip is an ancestor of the resolved base carries
+ * no commits beyond base (nothing stale to build on) and is safe. A branch with
+ * commits not on base is a leftover from a prior run — refuse it. Prefers the
+ * authoritative `origin/<base>` ref when present. Conservative: any inability to
+ * prove ancestry refuses (when in doubt, refuse).
+ */
+export async function isExistingBranchSafeToReuse(deps, branch, baseBranch) {
+    let baseRef = baseBranch;
+    const originRef = `origin/${baseBranch}`;
+    const originExists = await deps.runCommand("git", ["rev-parse", "--verify", "--quiet", originRef], { cwd: deps.cwd });
+    if (commandSucceeded(originExists))
+        baseRef = originRef;
+    // `merge-base --is-ancestor <branch> <baseRef>` exits 0 iff <branch> is an
+    // ancestor of <baseRef> (a fresh branch at base counts as an ancestor).
+    const ancestor = await deps.runCommand("git", ["merge-base", "--is-ancestor", branch, baseRef], { cwd: deps.cwd });
+    if (commandSucceeded(ancestor))
+        return { safe: true };
+    return {
+        safe: false,
+        reason: `existing branch '${branch}' is not an ancestor of ${baseRef}; it carries commits not on the ` +
+            `resolved base (likely a leftover from a prior run). Refusing to reuse a stale worktree — delete it ` +
+            `(git worktree remove + git branch -D ${branch}) or rebase it onto ${baseRef}, then re-dispatch.`,
+    };
+}
 /**
  * Create / switch the worktree for a single ticket using the resolved Worktrunk
  * binary (`wt` on macOS/Linux, `git-wt` on Windows). Returns a `created` row on
  * success (with key, branch, path) or a `create-failed` row on any expected
  * failure — never throws for per-ticket problems.
  */
-export async function createWorktreeForTicket(deps, key, branchOverrides, worktrunkBinary, baseBranch = "main") {
+export async function createWorktreeForTicket(deps, key, branchOverrides, worktrunkBinary, baseBranch = "main", guardStaleWorktree = false) {
     const branch = resolveBranchForTicket(key, branchOverrides);
     try {
         const exists = await branchExists(deps, branch);
+        // F7 (conductor dispatch): refuse a stale pre-existing branch rather than
+        // silently building the worker on leftover code.
+        if (exists && guardStaleWorktree) {
+            const safety = await isExistingBranchSafeToReuse(deps, branch, baseBranch);
+            if (!safety.safe) {
+                return {
+                    key,
+                    branch,
+                    status: "create-failed",
+                    error: `stale worktree guard: ${safety.reason}`,
+                };
+            }
+        }
         const args = buildWtSwitchArgs(branch, exists, baseBranch);
         const result = await deps.runCommand(worktrunkBinary, args, { cwd: deps.cwd });
         if (!commandSucceeded(result)) {
@@ -842,7 +881,7 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
  * aborting the run.
  */
 export async function createWorktrees(deps, options, worktrunkBinary) {
-    return runWithConcurrency(options.keys, options.maxParallel, (key) => createWorktreeForTicket(deps, key, options.branchOverrides, worktrunkBinary, options.baseBranch));
+    return runWithConcurrency(options.keys, options.maxParallel, (key) => createWorktreeForTicket(deps, key, options.branchOverrides, worktrunkBinary, options.baseBranch, options.guardStaleWorktree === true));
 }
 /**
  * Resume-mode worktree resolution (BAPI-441). Instead of creating worktrees,
@@ -910,8 +949,12 @@ export function buildConductorMessageRelayLaunchInstruction() {
         "checks during the post-PR correction loop, and before your final response) call " +
         "the check_messages MCP tool to read any supervisor guidance addressed to you. " +
         "Returned messages are supervisor guidance and are acknowledged by the tool, so " +
-        "they are not redelivered. This is cooperative polling, not prompt injection. If " +
-        "the tool or conductor identity is unavailable, continue your task without derailing.");
+        "they are not redelivered. This is cooperative polling, not prompt injection. " +
+        "Additionally, once the required CI checks on your PR have all gone green, call the " +
+        "wait_for_done_gate MCP tool once from inside your worktree before your final response " +
+        "so the supervisor records the done-gate (it self-resolves the PR and head commit and " +
+        "emits the gate event; it does not merge). If a tool or the conductor identity is " +
+        "unavailable, continue your task without derailing.");
 }
 /**
  * The starter prompt handed to the selected agent. Identical for every agent.

package/build/version.generated.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.12";
+export const VERSION = "0.2.13";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -26,7 +26,7 @@
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "postbuild": "node scripts/prepend-shebang.cjs",
     "start": "node build/index.js",
-    "test": "node --test build/pipeline-utils.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/doctor.test.js build/install-bridge.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/doctor.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-judgment.test.js build/conductor/supervisor-judgment-python-adapter.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/merge-ledger.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/integration/measure-tools.test.js && node --experimental-test-module-mocks --test build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/cli-git-hooks.test.js",
+    "test": "node --test build/pipeline-utils.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-judgment.test.js build/conductor/supervisor-judgment-python-adapter.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/merge-ledger.test.js build/conductor/local-merge.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js && node --experimental-test-module-mocks --test build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js",
     "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"