@bridge_gpt/mcp-server 0.2.16 → 0.2.19

package/build/executor/http-client.js

@@ -0,0 +1,131 @@
+/** Bound a server-provided diagnostic snippet included in error strings. */
+function boundedDetail(text) {
+    const trimmed = (text ?? "").trim();
+    return trimmed.length > 200 ? `${trimmed.slice(0, 200)}…` : trimmed;
+}
+function isOkBody(bodyText) {
+    try {
+        const parsed = JSON.parse(bodyText);
+        return !!parsed && typeof parsed === "object" && parsed.ok === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Map a mutation (heartbeat/complete/fail) HTTP response onto the fencing
+ * outcome. `allowInvalidResult` maps 422 to `invalid_job_result` (complete only).
+ */
+function mapMutationResponse(status, bodyText, allowInvalidResult) {
+    if (status === 409)
+        return "stale_claim";
+    if (status === 503)
+        return "retry_later";
+    if (status === 422 && allowInvalidResult)
+        return "invalid_job_result";
+    if (status >= 200 && status < 300 && isOkBody(bodyText))
+        return "updated";
+    return "fatal_http_error";
+}
+export function createExecutorHttpClient(config) {
+    const base = config.baseUrl.replace(/\/+$/, "") + "/executor/jobs";
+    function keyForRepo(repoName) {
+        return config.apiKeyByRepo?.[repoName] ?? config.apiKey;
+    }
+    function headersForRepo(repoName) {
+        return {
+            "Content-Type": "application/json",
+            "X-API-Key": keyForRepo(repoName),
+            "X-Bridge-MCP-Version": config.mcpVersion,
+        };
+    }
+    async function post(pathSuffix, body, repoName) {
+        const res = await config.fetch(`${base}${pathSuffix}`, {
+            method: "POST",
+            headers: headersForRepo(repoName),
+            body: JSON.stringify(body),
+        });
+        const text = await res.text();
+        return { status: res.status, text };
+    }
+    async function mutate(pathSuffix, body, allowInvalidResult, repoName) {
+        try {
+            const { status, text } = await post(pathSuffix, body, repoName);
+            return mapMutationResponse(status, text, allowInvalidResult);
+        }
+        catch {
+            // Transient network error — treat as fatal for a single mutation attempt;
+            // the caller's retry/dead-man logic decides whether to keep the worker alive.
+            return "fatal_http_error";
+        }
+    }
+    return {
+        async claim(manifest) {
+            let status;
+            let text;
+            try {
+                const res = await post("/claim", manifest, manifest.repo_name);
+                status = res.status;
+                text = res.text;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                return { kind: "retryable", error: `claim network error: ${boundedDetail(message)}` };
+            }
+            if (status === 204)
+                return { kind: "none" };
+            if (status === 200) {
+                try {
+                    const job = JSON.parse(text);
+                    if (!job || typeof job !== "object" || typeof job.claim_token !== "string") {
+                        return { kind: "fatal", error: "claim returned a malformed job payload" };
+                    }
+                    return { kind: "claimed", job };
+                }
+                catch {
+                    return { kind: "fatal", error: "claim returned invalid JSON" };
+                }
+            }
+            if (status === 401 || status === 403 || status === 422) {
+                return { kind: "fatal", error: `claim rejected (HTTP ${status}): ${boundedDetail(text)}` };
+            }
+            // 5xx and any other unexpected status are retryable.
+            return { kind: "retryable", error: `claim failed (HTTP ${status}): ${boundedDetail(text)}` };
+        },
+        heartbeat(job, payload) {
+            return mutate(`/${job.id}/heartbeat`, {
+                repo_name: job.repo_name,
+                claim_token: job.claim_token,
+                local_commit_count: payload.local_commit_count,
+                last_commit_sha: payload.last_commit_sha,
+                telemetry: payload.telemetry,
+            }, false, job.repo_name);
+        },
+        complete(job, completion) {
+            return mutate(`/${job.id}/complete`, {
+                repo_name: job.repo_name,
+                claim_token: job.claim_token,
+                job_type: completion.job_type,
+                exit_code: completion.exit_code,
+                classification: completion.classification,
+                result: completion.result,
+                artifacts: completion.artifacts,
+                local_commit_count: completion.local_commit_count,
+                last_commit_sha: completion.last_commit_sha,
+                telemetry: completion.telemetry,
+            }, true, job.repo_name);
+        },
+        fail(job, failure) {
+            return mutate(`/${job.id}/fail`, {
+                repo_name: job.repo_name,
+                claim_token: job.claim_token,
+                error_kind: failure.error_kind,
+                error_message: failure.error_message,
+                classification: failure.classification,
+                local_commit_count: failure.local_commit_count,
+                last_commit_sha: failure.last_commit_sha,
+                telemetry: failure.telemetry,
+            }, false, job.repo_name);
+        },
+    };
+}

package/build/executor/index.js

@@ -0,0 +1,10 @@
+/**
+ * Epic Conductor v2 executor module entrypoint (BAPI-534).
+ *
+ * Public surface only — internal helpers stay module-private unless another
+ * production module needs them. Imports NOTHING from the v1 conductor
+ * event/ledger graph (see `types.ts` for the boundary contract).
+ */
+export { runExecutorCli, getExecutorUsage, parseExecutorArgs } from "./cli.js";
+export { runExecutor } from "./runner.js";
+export { runExecutorWatchCli, getExecutorWatchUsage, parseExecutorWatchArgs, } from "./watch-cli.js";

package/build/executor/job-errors.js

@@ -0,0 +1,55 @@
+/** Stable executor failure-kind constants (posted verbatim as `error_kind`). */
+export const MissingVerdictArtifact = "MissingVerdictArtifact";
+export const WorktreeLostBeforePush = "WorktreeLostBeforePush";
+export const BranchMismatch = "BranchMismatch";
+export const WorkerFinalizationMissingRemoteBranchAndPr = "WorkerFinalizationMissingRemoteBranchAndPr";
+/** Bound a failure message so no unbounded/secret-bearing text is posted. */
+const ERROR_MESSAGE_MAX_CHARS = 300;
+/**
+ * An `Error` subclass carrying a stable `errorKind` plus a bounded
+ * `errorMessage`. Named executor failures default to the `crashed` wire
+ * classification (they are deterministic local aborts, not worker timeouts/kills).
+ */
+export class ExecutorNamedError extends Error {
+    errorKind;
+    errorMessage;
+    classification;
+    constructor(errorKind, errorMessage, classification = "crashed") {
+        const bounded = String(errorMessage ?? "").slice(0, ERROR_MESSAGE_MAX_CHARS);
+        super(`${errorKind}: ${bounded}`);
+        this.name = "ExecutorNamedError";
+        this.errorKind = errorKind;
+        this.errorMessage = bounded;
+        this.classification = classification;
+    }
+}
+/** Type-guard for a named executor error. */
+export function isExecutorNamedError(value) {
+    return value instanceof ExecutorNamedError;
+}
+/** Map a named executor error into the `/fail` payload shape. */
+export function toExecutorFailure(error) {
+    return {
+        error_kind: error.errorKind,
+        error_message: error.errorMessage,
+        classification: error.classification,
+    };
+}
+/**
+ * Produce a bounded, secret-free fallback message for an UNEXPECTED (non-named)
+ * local failure. Token-shaped and credential-shaped substrings are stripped so a
+ * raw exception message can never carry a secret into a `/fail` payload or log.
+ */
+export function secretFreeErrorMessage(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    const redacted = raw
+        // `key=value` / `token: value` credential pairs → drop the value.
+        .replace(/\b(token|password|passwd|pwd|secret|api[_-]?key|apikey|authorization|auth|bearer)\b\s*[:=]\s*\S+/gi, "$1=[REDACTED]")
+        // Standalone secret-shaped tokens (GitHub PATs, long opaque strings).
+        .replace(/\bgh[posru]_[A-Za-z0-9]{16,}\b/g, "[REDACTED_TOKEN]")
+        .replace(/\b[A-Za-z0-9_-]{40,}\b/g, "[REDACTED_TOKEN]");
+    const bounded = redacted.slice(0, ERROR_MESSAGE_MAX_CHARS).trim();
+    return bounded.length > 0
+        ? `unexpected executor failure: ${bounded}`
+        : "unexpected executor failure";
+}

package/build/executor/job-log-registry.js

@@ -0,0 +1,110 @@
+/**
+ * Local executor job-log registry (BAPI-535, TDD §8).
+ *
+ * Persists a small, SECRET-FREE mapping from an executor job id to its worker-log
+ * path so a SEPARATE CLI process (`executor watch <job>`) can attach read-only to
+ * the log. Records carry only routing metadata (ids, repo, job type, paths,
+ * timestamps) — never job payloads, API tokens, or auth material. All filesystem
+ * / env access is injected so the registry is unit-testable with no real I/O.
+ */
+import { pathApiForExecutorPlatform } from "./worktree-inspection.js";
+/** Default state-dir basename under the system temp dir. */
+const DEFAULT_STATE_DIR_NAME = "bridge-executor-job-logs";
+/** Env var that overrides the executor state directory. */
+export const EXECUTOR_STATE_DIR_ENV = "BAPI_EXECUTOR_STATE_DIR";
+/**
+ * Resolve the executor state directory: the `BAPI_EXECUTOR_STATE_DIR` override
+ * when set, else a stable directory under the system temp dir (independent of
+ * cwd).
+ */
+export function resolveExecutorStateDir(deps) {
+    const override = deps.env[EXECUTOR_STATE_DIR_ENV];
+    if (typeof override === "string" && override.trim().length > 0) {
+        return override.trim();
+    }
+    const pathApi = pathApiForExecutorPlatform(deps.platform ?? process.platform);
+    return pathApi.join(deps.tmpdir(), DEFAULT_STATE_DIR_NAME);
+}
+/**
+ * Derive the record file path for a numeric job id. The id is coerced to digits
+ * only so a malformed id can never escape the state directory (path traversal).
+ */
+export function jobLogRecordPath(stateDir, jobId, platform = process.platform) {
+    const pathApi = pathApiForExecutorPlatform(platform);
+    const safeId = String(jobId).replace(/[^0-9]/g, "") || "0";
+    return pathApi.join(stateDir, `job-${safeId}.json`);
+}
+/** Whitelist the persisted fields so no extra (possibly secret) field leaks in. */
+function normalizeRecord(record) {
+    const out = {
+        job_id: record.job_id,
+        repo_name: record.repo_name,
+        job_type: record.job_type,
+        log_path: record.log_path,
+        started_at: record.started_at,
+    };
+    if (record.ticket_key)
+        out.ticket_key = record.ticket_key;
+    if (record.worktree_path)
+        out.worktree_path = record.worktree_path;
+    if (record.finished_at)
+        out.finished_at = record.finished_at;
+    return out;
+}
+function isValidRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.job_id === "number" &&
+        typeof v.repo_name === "string" &&
+        typeof v.job_type === "string" &&
+        typeof v.log_path === "string" &&
+        typeof v.started_at === "string");
+}
+/** Write the secret-free registry record when a worker log is initialized. */
+export async function registerExecutorJobLog(record, deps) {
+    const stateDir = resolveExecutorStateDir(deps);
+    await deps.mkdir(stateDir, { recursive: true });
+    const filePath = jobLogRecordPath(stateDir, record.job_id, deps.platform ?? process.platform);
+    await deps.writeFile(filePath, JSON.stringify(normalizeRecord(record), null, 2));
+}
+/**
+ * Stamp `finished_at` on an existing record after terminal completion/failure,
+ * preserving all existing fields. A missing/invalid record is a no-op (the watch
+ * registry is a visibility nicety, not load-bearing).
+ */
+export async function markExecutorJobLogFinished(jobId, finishedAt, deps) {
+    const existing = await readExecutorJobLogRecord(jobId, deps);
+    if (!existing.ok)
+        return;
+    const updated = { ...existing.record, finished_at: finishedAt };
+    const stateDir = resolveExecutorStateDir(deps);
+    const filePath = jobLogRecordPath(stateDir, jobId, deps.platform ?? process.platform);
+    await deps.writeFile(filePath, JSON.stringify(normalizeRecord(updated), null, 2));
+}
+/**
+ * Load and validate a record for `executor watch <job>`. Returns a structured
+ * missing/invalid result rather than throwing raw filesystem/JSON errors.
+ */
+export async function readExecutorJobLogRecord(jobId, deps) {
+    const stateDir = resolveExecutorStateDir(deps);
+    const filePath = jobLogRecordPath(stateDir, jobId, deps.platform ?? process.platform);
+    let raw;
+    try {
+        raw = await deps.readFile(filePath);
+    }
+    catch {
+        return { ok: false, reason: `no registry record for job ${jobId} (expected ${filePath})` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: `registry record for job ${jobId} is not valid JSON` };
+    }
+    if (!isValidRecord(parsed)) {
+        return { ok: false, reason: `registry record for job ${jobId} is missing required fields` };
+    }
+    return { ok: true, record: parsed };
+}