@bridge_gpt/mcp-server 0.2.14 → 0.2.18

package/build/start-tickets-prereqs.js

@@ -253,6 +253,75 @@ function agentDescriptor(agent) {
 function uvDescriptor() {
     return commandDescriptor("uv", "uv", UV_INSTALL_HINTS);
 }
+// ---------------------------------------------------------------------------
+// review-tickets git prerequisite (BAPI-474). review-tickets has its own
+// terminal-launcher-only live preflight (runReviewTicketsPreflight in
+// review-tickets.ts) — separate from getPreflightPrereqDescriptors above,
+// which is start-tickets-specific. Since the parent-fetch-once base pin now
+// requires git for review-tickets too (unless --no-refresh-base is passed),
+// this doctor-only descriptor gives it its own distinctly-labeled,
+// read-only-diagnosable entry rather than relying on the generic start-tickets
+// "git" descriptor, so a user running review-tickets alone can self-diagnose.
+// ---------------------------------------------------------------------------
+const REVIEW_TICKETS_GIT_INSTALL_HINTS = {
+    darwin: `${GIT_INSTALL_HINTS.darwin} (or rerun review-tickets with --no-refresh-base to skip the fetch)`,
+    linux: `${GIT_INSTALL_HINTS.linux} (or rerun review-tickets with --no-refresh-base to skip the fetch)`,
+    win32: `${GIT_INSTALL_HINTS.win32} (or rerun review-tickets with --no-refresh-base to skip the fetch)`,
+};
+function reviewTicketsGitDescriptor() {
+    return {
+        id: "review-tickets-git",
+        label: "git (required by review-tickets base-branch fetch)",
+        installHint: REVIEW_TICKETS_GIT_INSTALL_HINTS,
+        probe: async (deps) => {
+            const found = await isCommandOnPath(deps, "git");
+            return found
+                ? { found: true, detail: "found on PATH" }
+                : { found: false, detail: "review-tickets' parent-fetch-once base pin needs git unless --no-refresh-base is passed" };
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// regression-check (BAPI-460) doctor-only tool descriptors. These probe the
+// deterministic tooling regression-check relies on (ast-grep, ripgrep,
+// lizard). They are doctor-diagnosable but NOT preflight blockers: a missing
+// tool degrades the regression-check report rather than failing the command,
+// so these stay in getDoctorOnlyPrereqDescriptors, not getPreflightPrereqDescriptors.
+// ---------------------------------------------------------------------------
+const AST_GREP_INSTALL_HINTS = {
+    darwin: "uv tool install ast-grep-cli",
+    linux: "uv tool install ast-grep-cli",
+    win32: "uv tool install ast-grep-cli",
+};
+const LIZARD_INSTALL_HINTS = {
+    darwin: "uv tool install lizard",
+    linux: "uv tool install lizard",
+    win32: "uv tool install lizard",
+};
+const RIPGREP_SHELL_FUNCTION_CAVEAT = "a shell function/alias will not satisfy this check — ripgrep must be installed as a real PATH binary.";
+const RIPGREP_INSTALL_HINTS = {
+    darwin: `brew install ripgrep (${RIPGREP_SHELL_FUNCTION_CAVEAT})`,
+    linux: `Install ripgrep with your distro package manager, e.g. apt install ripgrep (${RIPGREP_SHELL_FUNCTION_CAVEAT})`,
+    win32: `winget install BurntSushi.ripgrep.MSVC (${RIPGREP_SHELL_FUNCTION_CAVEAT})`,
+};
+/** ast-grep ships two equivalent binary names (`ast-grep` and `sg`); either satisfies the probe. */
+function astGrepDescriptor() {
+    return {
+        id: "ast-grep",
+        label: "ast-grep (or sg)",
+        installHint: AST_GREP_INSTALL_HINTS,
+        probe: async (deps) => {
+            const found = await resolveFirstCommandOnPath(deps, ["ast-grep", "sg"]);
+            return found ? { found: true, detail: `found on PATH (${found})` } : { found: false };
+        },
+    };
+}
+function lizardDescriptor() {
+    return commandDescriptor("lizard", "lizard", LIZARD_INSTALL_HINTS);
+}
+function ripgrepDescriptor() {
+    return commandDescriptor("rg", "ripgrep (rg)", RIPGREP_INSTALL_HINTS);
+}
 /** Secret-free remediation hint shared by the credential-resolution descriptor. */
 const CREDENTIAL_RESOLUTION_HINT = "Rerun /install-bridge to persist the routing credential, set BAPI_API_KEY in the " +
     'environment, or add it under "bapi:<repo_name>" in ~/.config/bridge/credentials.json. ' +
@@ -384,6 +453,10 @@ export function getDoctorOnlyPrereqDescriptors(_platform, _env, agent) {
         agentDescriptor(agent),
         credentialResolutionDescriptor(),
         worktreeMcpReachabilityDescriptor(),
+        astGrepDescriptor(),
+        lizardDescriptor(),
+        ripgrepDescriptor(),
+        reviewTicketsGitDescriptor(),
     ];
 }
 /**

package/build/start-tickets.js

@@ -405,7 +405,10 @@ export function getDefaultSpawnTerminalTabForPlatform(platform) {
  * are always honored). Returns a structured error for unsupported platforms;
  * never throws.
  */
-export function resolveStartTicketsPlatformConfig(deps, agent, autoApprove = false, conductorEnabled = false, repoName = null) {
+export function resolveStartTicketsPlatformConfig(deps, agent, autoApprove = false, conductorEnabled = false, repoName = null, 
+// BAPI-494: a conductor remediation re-dispatch. Appends the full-suite finalize
+// instruction to the resume-mode worker's prompt.
+resumeMode = false) {
     if (!isSupportedStartTicketsPlatform(deps.platform)) {
         return { ok: false, error: unsupportedPlatformMessage(deps.platform) };
     }
@@ -417,7 +420,7 @@ export function resolveStartTicketsPlatformConfig(deps, agent, autoApprove = fal
             worktrunkBinary: resolveWorktrunkBinary(platform, deps.env),
             // Inject the resolved repo identity so the spawned worktree session never
             // falls back to the basename-derived repo name (the 403 root cause).
-            buildAgentShellCommand: (key, worktreePath, modelAlias) => prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled), repoName, platform),
+            buildAgentShellCommand: (key, worktreePath, modelAlias) => prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, resumeMode), repoName, platform),
             spawnTerminalTab: deps.spawnTerminalTab,
         },
     };
@@ -714,6 +717,42 @@ export async function refreshBaseBranch(deps, options) {
 export async function refreshMainBranch(deps, options) {
     return refreshBaseBranch(deps, { refreshMain: options.refreshMain, baseBranch: "main" });
 }
+/**
+ * Non-mutating counterpart to {@link refreshBaseBranch}: fetches
+ * `origin/<baseBranch>` and resolves the fetched tip to an immutable commit
+ * SHA, WITHOUT ever fast-forwarding or force-moving any local branch ref (no
+ * `git merge --ff-only`, no `git branch --force`). Used by review-grounding
+ * (BAPI-474), which must read a pinned base tree without touching the user's
+ * working tree, index, stash, or local branch refs.
+ *
+ * Validates `baseBranch` with {@link validateBranchName} first so an
+ * injection-shaped ref name is rejected before any git invocation. Every git
+ * call uses an argv array (never a shell string), consistent with
+ * {@link refreshBaseBranch}.
+ */
+export async function fetchAndResolveBaseSha(deps, baseBranch) {
+    const validationError = validateBranchName(baseBranch);
+    if (validationError) {
+        return { ok: false, error: `Invalid base branch '${baseBranch}': ${validationError}` };
+    }
+    const fetch = await deps.runCommand("git", ["fetch", "origin", baseBranch], {
+        cwd: deps.cwd,
+    });
+    if (!commandSucceeded(fetch)) {
+        return {
+            ok: false,
+            error: `git fetch origin ${baseBranch} failed. Check your network and 'git remote get-url origin', or pass --no-refresh-base to skip.`,
+        };
+    }
+    const resolve = await deps.runCommand("git", ["rev-parse", "--verify", `origin/${baseBranch}^{commit}`], { cwd: deps.cwd });
+    if (!commandSucceeded(resolve)) {
+        return {
+            ok: false,
+            error: `Failed to resolve origin/${baseBranch} to a commit SHA after fetch (git rev-parse --verify failed).`,
+        };
+    }
+    return { ok: true, base_sha: resolve.stdout.trim() };
+}
 // ---------------------------------------------------------------------------
 // Concurrency + worktree creation
 // ---------------------------------------------------------------------------
@@ -956,6 +995,31 @@ export function buildConductorMessageRelayLaunchInstruction() {
         "emits the gate event; it does not merge). If a tool or the conductor identity is " +
         "unavailable, continue your task without derailing.");
 }
+/**
+ * BAPI-494: the resume-mode remediation finalize instruction. A conductor
+ * re-dispatch (start-tickets resume mode) is spawned to fix a `blocked` ticket —
+ * for a `merge.conflict` block the worker rebases + resolves conflicts. Catalog
+ * E1/F3b proved a clean TEXTUAL merge can still hide a SEMANTIC break (branch A
+ * adds a helper; branch B adds a contract test over all helpers), which only the
+ * FULL suite catches — so this instruction requires the worker to run the full
+ * project test suite (the same gate the advisory pre-push hook enforces) and only
+ * push/complete on green, escalating otherwise.
+ *
+ * Single line (no newlines, no `;`, no quotes/apostrophes) so it stays safe when
+ * single-quoted into a shell command and embedded in terminal-launcher args.
+ */
+export function buildResumeModeRemediationFinalizeInstruction() {
+    return ("Resume-mode remediation finalize: you were re-dispatched to fix a blocked ticket " +
+        "(a merge conflict, a CI failure, or requested review changes). First rebase against " +
+        "the current base branch and resolve the merge conflicts. A clean textual merge can " +
+        "still break behavior, so inspect for semantic conflicts even when there are no textual " +
+        "conflict markers. Before you push or mark the ticket complete, run the full test suite " +
+        "for the project (the full unit suite, the same gate enforced by the advisory pre-push " +
+        "hook described in CLAUDE.md under the CI cost model and advisory pre-push hook section) " +
+        "and do not rely on targeted subsets as your only verification. Push and mark the ticket " +
+        "complete only after the full suite is green. If you cannot make the full suite pass, " +
+        "report the ticket blocked and escalate rather than pushing a green-looking but broken merge.");
+}
 /**
  * The starter prompt handed to the selected agent. Identical for every agent.
  * When `autoApprove` is set, the implementation agent runs hands-off
@@ -966,15 +1030,23 @@ export function buildConductorMessageRelayLaunchInstruction() {
  * flag). A plain run returns the bare `/implement-ticket <KEY> [--auto]` so the
  * worker is not told to poll `check_messages` for a conductor that is not
  * running.
+ *
+ * BAPI-494: when `resumeMode` is set (a conductor remediation re-dispatch), the
+ * full-suite finalize instruction is appended so the rebase/resolve worker proves
+ * semantic compatibility before pushing. Scoped to resume mode only — a normal
+ * fresh dispatch is unaffected.
  */
 export function buildAgentPrompt(key, opts = {}) {
     // `modelAlias` is accepted for signature consistency only — the model is
     // injected as a `--model` flag (see buildAgentInvocationArgv), never embedded
     // in the prompt text.
     const command = `/implement-ticket ${key}${opts.autoApprove ? " --auto" : ""}`;
-    return opts.conductorEnabled
-        ? `${command} ${buildConductorMessageRelayLaunchInstruction()}`
-        : command;
+    const parts = [command];
+    if (opts.conductorEnabled)
+        parts.push(buildConductorMessageRelayLaunchInstruction());
+    if (opts.resumeMode)
+        parts.push(buildResumeModeRemediationFinalizeInstruction());
+    return parts.join(" ");
 }
 /**
  * Build the ordered argv for an agent invocation:
@@ -1013,13 +1085,13 @@ export function buildAgentInvocation(agent, prompt, quote, modelAlias) {
     }
 }
 /** POSIX agent shell command: `cd '<path>' && <agent> [--model '<alias>'] '<prompt>'`. */
-export function buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false) {
-    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled }), (p) => `'${shSquoteInner(p)}'`, modelAlias);
+export function buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false) {
+    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode }), (p) => `'${shSquoteInner(p)}'`, modelAlias);
     return `cd '${shSquoteInner(worktreePath)}' && ${invocation}`;
 }
 /** PowerShell agent shell command: `Set-Location -LiteralPath '<path>'; <agent> [--model '<alias>'] '<prompt>'`. */
-export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false) {
-    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled }), powershellSquote, modelAlias);
+export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false) {
+    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode }), powershellSquote, modelAlias);
     return `Set-Location -LiteralPath ${powershellSquote(worktreePath)}; ${invocation}`;
 }
 /**
@@ -1030,10 +1102,10 @@ export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoA
  * injected as `--model` at the spawn boundary. `conductorEnabled` appends the
  * BAPI-397 message-relay instruction to the prompt (opt-in via `--conductor`).
  */
-export function buildAgentShellCommand(agent, key, worktreePath, platform = "darwin", autoApprove = false, modelAlias, conductorEnabled = false) {
+export function buildAgentShellCommand(agent, key, worktreePath, platform = "darwin", autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false) {
     if (platform === "win32")
-        return buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled);
-    return buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled);
+        return buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode);
+    return buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode);
 }
 /**
  * Build the shell command run inside a spawned tab/session for an ARBITRARY
@@ -1090,15 +1162,36 @@ export function buildTerminalAppleScript(shellCommand, title) {
         "end tell",
     ].join("\n");
 }
+/**
+ * Build the shell command that sets an iTerm2 session **badge** to `badgeText`
+ * via the proprietary `OSC 1337 ; SetBadgeFormat` escape (base64 payload, per
+ * the iTerm2 spec). The badge is a large translucent per-pane label drawn in
+ * the session corner.
+ *
+ * Why a badge and not just the session `name`: iTerm2 lets a running program
+ * overwrite the session name via ordinary title escapes (`OSC 0/1/2`), and
+ * Claude Code re-sets its terminal title continuously while it works — so the
+ * `set name` label is clobbered within a fraction of a second (empirically the
+ * tab ends up reading "claude working", never "<KEY> Implementation"). The
+ * badge lives in a separate namespace those title escapes never touch, so it
+ * sticks for the life of the pane. `printf` emits the escape from inside the
+ * spawned shell, before the agent command runs.
+ */
+export function itermBadgeShellCommand(badgeText) {
+    const b64 = Buffer.from(badgeText, "utf8").toString("base64");
+    return `printf '\\033]1337;SetBadgeFormat=%s\\007' '${b64}'`;
+}
 /**
  * Generate AppleScript that runs `shellCommand` in an iTerm2 tab. We set the
- * session `name` (which drives the tab title) so the label sticks rather than
- * being overwritten by the running agent's program title.
+ * session `name` (labels the tab until the agent starts re-titling) and, when a
+ * `badgeText` is supplied, pin an agent-proof iTerm badge so the pane stays
+ * identifiable even after Claude Code overrides the title — see
+ * {@link itermBadgeShellCommand}.
  */
-export function buildITermAppleScript(shellCommand, title) {
+export function buildITermAppleScript(shellCommand, title, badgeText) {
     const esc = applescriptDquoteInner(shellCommand);
     const titleEsc = applescriptDquoteInner(title);
-    return [
+    const lines = [
         'tell application "iTerm"',
         "    activate",
         "    if (count of windows) = 0 then",
@@ -1108,10 +1201,15 @@ export function buildITermAppleScript(shellCommand, title) {
         "    end if",
         "    tell spawnedSession",
         `        set name to "${titleEsc}"`,
-        `        write text "${esc}"`,
-        "    end tell",
-        "end tell",
-    ].join("\n");
+    ];
+    if (badgeText) {
+        const badgeEsc = applescriptDquoteInner(itermBadgeShellCommand(badgeText));
+        lines.push(`        write text "${badgeEsc}"`);
+    }
+    lines.push(`        write text "${esc}"`);
+    lines.push("    end tell");
+    lines.push("end tell");
+    return lines.join("\n");
 }
 /**
  * Spawn a single macOS terminal tab running `shellCommand`. Selects the
@@ -1123,7 +1221,7 @@ export function buildITermAppleScript(shellCommand, title) {
 export async function spawnMacOSTerminalTab(deps, terminal, shellCommand, context) {
     const title = terminalTitleForTicket(context?.key ?? "");
     const script = terminal === "iterm"
-        ? buildITermAppleScript(shellCommand, title)
+        ? buildITermAppleScript(shellCommand, title, context?.key || undefined)
         : buildTerminalAppleScript(shellCommand, title);
     const result = await deps.runCommand("osascript", ["-e", script]);
     if (commandSucceeded(result))
@@ -2490,7 +2588,9 @@ export async function orchestrateStartTickets(deps, options, overrides = {}) {
             ".bridge/config). Spawned worktrees may fall back to the directory name and " +
             "hit 403 'repository not registered' if it differs from the Bridge API project name.");
     }
-    const platformConfig = resolveStartTicketsPlatformConfig(deps, agent, options.autoApprove, options.conductorEnabled ?? false, resolvedRepoName);
+    const platformConfig = resolveStartTicketsPlatformConfig(deps, agent, options.autoApprove, options.conductorEnabled ?? false, resolvedRepoName, 
+    // BAPI-494: resume-mode dispatches get the full-suite remediation finalize prompt.
+    options.resumeMode ?? false);
     if (!platformConfig.ok)
         return { ok: false, error: platformConfig.error };
     const refresh = await refreshBaseBranch(deps, {

package/build/version.generated.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.14";
+export const VERSION = "0.2.18";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.14",
+  "version": "0.2.18",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -27,7 +27,7 @@
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "postbuild": "node scripts/prepend-shebang.cjs",
     "start": "node build/index.js",
-    "test": "node --test build/pipeline-utils.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-judgment.test.js build/conductor/supervisor-judgment-python-adapter.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/merge-ledger.test.js build/conductor/local-merge.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js && node --experimental-test-module-mocks --test build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js",
+    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/local-merge.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js",
     "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"
@@ -37,12 +37,12 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "better-sqlite3": "^11.8.1"
+    "better-sqlite3": "^12.11.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.12",
-    "@types/node": "^25.9.1",
-    "esbuild": "^0.25.0",
+    "@types/node": "^26.0.1",
+    "esbuild": "^0.28.1",
     "typescript": "^6.0.3"
   },
   "engines": {

package/pipelines/review-ticket.json

@@ -1,7 +1,7 @@
 {
   "name": "review-ticket",
   "description": "Review a ticket with two rounds of analysis (initial + automatic second opinion by default), evaluate suggestions for accuracy, and produce a combined review-and-resolution document with decision trees. The automatic second-opinion step is skippable via --rounds=1 mode (skip_steps: [\"second-opinion-review\"]).",
-  "variables": ["ticket_key", "docs_dir"],
+  "variables": ["ticket_key", "docs_dir", "base_branch", "base_sha", "no_refresh_base"],
   "steps": [
     {
       "type": "mcp_call",
@@ -35,15 +35,37 @@
       "description": "Generate combined clarify+critique review (second opinion)",
       "on_error": "warn_and_continue"
     },
+    {
+      "type": "mcp_call",
+      "id": "materialize-fresh-base",
+      "tool": "materialize_fresh_base",
+      "params": {
+        "base_branch": "{base_branch}",
+        "base_sha": "{base_sha}",
+        "no_refresh_base": "{no_refresh_base}"
+      },
+      "description": "Materialize a freshly-fetched, immutably-pinned origin/<base_branch> tree in an isolated temp dir for grounding",
+      "on_error": "halt"
+    },
     {
       "type": "agent_task",
       "instruction_file": "evaluate-and-recommend.md",
-      "description": "Evaluate ticket-review findings against the codebase and produce the combined review-and-resolution document at {docs_dir}/review/{ticket_key}-review-and-resolution.md"
+      "description": "Evaluate ticket-review findings against the freshly-materialized codebase and produce the combined review-and-resolution document at {docs_dir}/review/{ticket_key}-review-and-resolution.md"
     },
     {
       "type": "agent_task",
       "instruction_file": "capture-review-decisions.md",
       "description": "Generate HTML decision page, capture user decisions, and interpretively rewrite clarifying questions and critique docs"
+    },
+    {
+      "type": "mcp_call",
+      "id": "cleanup-fresh-base",
+      "tool": "cleanup_fresh_base",
+      "params": {
+        "fresh_base_root": "<the fresh_base_root path returned by the earlier materialize_fresh_base step's result>"
+      },
+      "description": "Remove the temp workspace created by materialize_fresh_base. fresh_base_root is a RUNTIME value, not a static recipe variable: call this tool with the actual path string returned by the earlier materialize_fresh_base step's result, not the placeholder text shown in params above.",
+      "on_error": "warn_and_continue"
     }
   ]
 }