@bridge_gpt/mcp-server 0.2.16 → 0.2.19

package/build/conductor/doctor.js

@@ -8,8 +8,110 @@
  * migration, no event emission, and no scheduler unit creation.
  */
 import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
 import { doctorConductorLedger } from "./store.js";
 import { inspectConductorGitHooks } from "./git-hooks.js";
+import { resolveMcpShimInvocationForRuntime, resolvePackageRootFromModuleUrl, } from "../mcp-server-invocation.js";
+/**
+ * Explicit not-run state for the `deny_enforcement` section when the probe is
+ * skipped via `--no-deny-probe`. Enforcement is UNVERIFIED, so the state is
+ * fail-safe: `enforced: false` with `status: "skip"` distinguishing a deliberate
+ * skip from a probed FATAL failure.
+ */
+export function skippedDenyEnforcementResult() {
+    return {
+        enforced: false,
+        layer: "none",
+        degraded: true,
+        status: "skip",
+        detail: "deny-enforcement preflight skipped via --no-deny-probe (no agent spawned)",
+        warnings: [
+            "Deny-enforcement preflight was SKIPPED (--no-deny-probe): enforcement is UNVERIFIED " +
+                "on this host. Do not treat this report as evidence the deny layer works.",
+        ],
+    };
+}
+/**
+ * Default reader for the package.json text (BAPI-526). Resolves the package root
+ * from this module's URL and reads `<packageRoot>/package.json`. Throws internally
+ * when the root cannot be resolved so the caller degrades to `engines_node: null`.
+ */
+export async function defaultReadPackageJson() {
+    const packageRoot = resolvePackageRootFromModuleUrl(import.meta.url);
+    if (!packageRoot) {
+        throw new Error("unable to resolve package root for package.json");
+    }
+    return readFileSync(`${packageRoot}/package.json`, "utf8");
+}
+/**
+ * Parse package.json text and return `engines.node` when it is a string; `null`
+ * otherwise. Never throws on malformed JSON — returns `null`.
+ */
+export function readExpectedNodeEngine(packageJsonText) {
+    try {
+        const pkg = JSON.parse(packageJsonText);
+        const node = pkg.engines?.node;
+        return typeof node === "string" ? node : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the read-only native-ledger inspection (BAPI-526). Composes the ledger
+ * doctor's native-load result with the expected Node engine and the resolved MCP
+ * shim invocation. Never opens the ledger, never throws to callers, and never
+ * includes raw package paths, stack traces, or the absolute server entry path.
+ */
+export async function inspectNativeLedger(nativeLoad, deps = {}) {
+    const warnings = [];
+    // Expected Node engine (fail-soft to null on any read/parse failure).
+    let engines_node = null;
+    try {
+        const readPkg = deps.readPackageJson ?? defaultReadPackageJson;
+        engines_node = readExpectedNodeEngine(await readPkg());
+    }
+    catch {
+        engines_node = null;
+    }
+    // MCP shim invocation (resolvable absolute-build-path vs npm-channel fallback).
+    const invocation = deps.resolveMcpInvocation
+        ? deps.resolveMcpInvocation()
+        : resolveMcpShimInvocationForRuntime({
+            moduleUrl: import.meta.url,
+            nodeExecutable: "node",
+            argv1: process.argv[1],
+            fileExists: existsSync,
+        });
+    // Path-safe: expose only the node executable for the absolute form (never the
+    // server entry path), and null for the npm-channel fallback.
+    const mcp_shim_node = invocation.form === "absolute-build-path" ? invocation.nodeExecutable : null;
+    const binding_loads = nativeLoad.loads;
+    const failure_kind = nativeLoad.failure_kind;
+    if (nativeLoad.degraded && nativeLoad.warning) {
+        warnings.push(nativeLoad.warning);
+    }
+    if (invocation.form !== "absolute-build-path") {
+        warnings.push("Worker MCP registration would use the npm-channel fallback (no resolvable on-disk build entry); " +
+            "registration reliability depends on the package being published.");
+    }
+    if (engines_node === null) {
+        warnings.push("Could not read package.json engines.node; expected Node version is unknown.");
+    }
+    const degraded = nativeLoad.degraded || invocation.form !== "absolute-build-path" || engines_node === null;
+    return {
+        cli_node_version: process.version,
+        engines_node,
+        mcp_shim_node,
+        mcp_registration_form: invocation.form,
+        module: nativeLoad.module,
+        node_modules_abi: nativeLoad.node_modules_abi,
+        binding_loads,
+        failure_kind,
+        degraded,
+        warnings,
+    };
+}
 /**
  * Inspect the local schedule metadata store for a registered epic-tick schedule.
  * Strictly read-only: composes orchestrateScheduleList (read-only list path) and
@@ -175,21 +277,58 @@ export async function buildConductorDoctorReport(deps = {}) {
     const inspectHooks = deps.inspectHooks ?? inspectConductorGitHooks;
     const epicTick = await inspectEpicTickSchedule(deps.scheduleDeps, deps.orchestrateList);
     const mcp_profile = inspectMcpProfile(deps.env ?? process.env, epicTick);
+    // Resolve the ledger once so the native-load probe reflects the same report.
+    const ledger = await doctorLedger();
+    const native_ledger = await inspectNativeLedger(ledger.native_load, deps);
+    const deny_enforcement = deps.skipDenyProbe
+        ? skippedDenyEnforcementResult()
+        : await inspectDenyEnforcementSafe(deps.inspectDenyEnforcement);
     return {
-        ledger: await doctorLedger(),
+        ledger,
         git_hooks: inspectHooks(deps.hooksDeps),
         epic_tick: epicTick,
         mcp_profile,
         local_merge: inspectLocalMerge(deps.runCommand),
+        native_ledger,
+        deny_enforcement,
     };
 }
+/**
+ * Run the deny-enforcement inspector and convert any thrown exception into degraded
+ * report data — a deny-probe failure must never throw out of doctor. The underlying
+ * predicate is already exception-safe; this is defense-in-depth for an injected fake.
+ */
+async function inspectDenyEnforcementSafe(inspect) {
+    try {
+        let run = inspect;
+        if (!run) {
+            // Lazy import keeps the agent-capabilities graph out of doctor.ts's static
+            // module graph (see the import-site comment above).
+            const mod = await import("./deny-enforcement-preflight.js");
+            run = mod.runDenyEnforcementPreflight;
+        }
+        return await run();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            enforced: false,
+            layer: "none",
+            degraded: true,
+            warnings: [
+                `Deny-layer enforcement inspection failed: ${msg}`,
+                "The executor claim loop MUST refuse to claim jobs until the deny layer is enforced.",
+            ],
+        };
+    }
+}
 /**
  * Render the combined doctor report as human-readable text: ledger health,
  * git hooks section, and an Epic Supervisor Schedule section using semantic
  * status tags consistent with the git hooks section's visual hierarchy.
  */
 export function formatConductorDoctorReport(report) {
-    const { ledger, git_hooks, epic_tick, mcp_profile, local_merge } = report;
+    const { ledger, git_hooks, epic_tick, mcp_profile, local_merge, native_ledger, deny_enforcement } = report;
     const lines = [
         "Conductor ledger doctor",
         "───────────────────────",
@@ -270,5 +409,47 @@ export function formatConductorDoctorReport(report) {
         for (const w of local_merge.warnings)
             lines.push(`  - ${w}`);
     }
+    lines.push("");
+    lines.push("Native ledger module (required for conductor coordination)");
+    lines.push("─────────────────────────────────────────────────────────");
+    const nativeTag = native_ledger.binding_loads && !native_ledger.degraded ? "[OK]" : "[WARNING] degraded";
+    // Strictly diagnostic — reports the skew but never suggests an automatic
+    // install/rebuild/migration (BAPI-526 is detection only).
+    lines.push(`binding loads:         ${native_ledger.binding_loads} ${nativeTag}`);
+    lines.push(`module:                ${native_ledger.module}`);
+    lines.push(`CLI Node:              ${native_ledger.cli_node_version}`);
+    lines.push(`engines.node:          ${native_ledger.engines_node ?? "n/a"}`);
+    lines.push(`MCP shim Node:         ${native_ledger.mcp_shim_node ?? "n/a"}`);
+    lines.push(`NODE_MODULE_VERSION:   ${native_ledger.node_modules_abi}`);
+    lines.push(`registration form:     ${native_ledger.mcp_registration_form}`);
+    lines.push(`failure kind:          ${native_ledger.failure_kind}`);
+    lines.push(`degraded:              ${native_ledger.degraded}`);
+    if (native_ledger.warnings.length > 0) {
+        lines.push("native ledger warnings:");
+        for (const w of native_ledger.warnings)
+            lines.push(`  - ${w}`);
+    }
+    lines.push("");
+    lines.push("Deny-layer enforcement preflight (required for executor claim)");
+    lines.push("─────────────────────────────────────────────────────────────");
+    // OK when enforced by settings-deny (non-degraded); WARNING when relying on the
+    // PreToolUse fallback; SKIPPED when the probe was deliberately not run
+    // (--no-deny-probe, enforcement unverified); FATAL when nothing enforces — the
+    // executor must refuse to claim.
+    const denyTag = deny_enforcement.status === "skip"
+        ? "[SKIPPED] probe not run (--no-deny-probe) — enforcement unverified"
+        : !deny_enforcement.enforced
+            ? "[FATAL] deny not enforced — executor must refuse to claim jobs"
+            : deny_enforcement.degraded
+                ? "[WARNING] degraded — relying on PreToolUse fallback"
+                : "[OK]";
+    lines.push(`enforced:              ${deny_enforcement.enforced} ${denyTag}`);
+    lines.push(`layer:                 ${deny_enforcement.layer}`);
+    lines.push(`degraded:              ${deny_enforcement.degraded}`);
+    if (deny_enforcement.warnings.length > 0) {
+        lines.push("deny enforcement warnings:");
+        for (const w of deny_enforcement.warnings)
+            lines.push(`  - ${w}`);
+    }
     return lines.join("\n");
 }

package/build/conductor/done-gate.js

@@ -403,10 +403,15 @@ export function normalizeReviewSnapshot(raw) {
     const headSha = typeof detail.head_sha === "string" && detail.head_sha.trim().length > 0
         ? detail.head_sha.trim()
         : null;
+    // BAPI-493 (D-5): head-scope the dedupe hash so two otherwise-identical review
+    // snapshots observed on DIFFERENT PR heads hash differently (the producer dedupe
+    // dimension was not head-scoped before). Uses the already-normalized local
+    // `headSha` (trimmed string or null) so a missing head stays deterministic.
     const reviewStateHash = stableJsonHash({
         review_decision: reviewDecision,
         approvals,
         sticky_verdict: stickyVerdict,
+        head_sha: headSha,
     });
     return { review_decision: reviewDecision, approvals, sticky_verdict: stickyVerdict, head_sha: headSha, review_state_hash: reviewStateHash };
 }

package/build/conductor/epic-reconcile.js

@@ -19,6 +19,21 @@
  */
 import { computeReadySet, decideRemediation, DEFAULT_MAX_SPEC_REVIEW_ATTEMPTS } from "./epic-state.js";
 import { extractMergeActionIdentityFromGateEvent } from "./merge-ledger.js";
+/**
+ * Sanitize a thrown value into a single-line, bounded diagnostic string for a
+ * tick warning (BAPI-487 Requirement 2). Surfaces the real `err.message` (the
+ * remediation messages — `remediate: no PR binding for <KEY>`, `remediate: no
+ * head_sha for PR <N>` — are safe, secret-free text) instead of the opaque
+ * constructor name that hid the true failure for an entire smoke test. Collapses
+ * whitespace (defeating multiline log injection), caps length, and falls back to
+ * the constructor name for an empty message or `fallback` for a non-Error throw.
+ */
+export function safeDiagnosticMessage(err, fallback) {
+    const raw = err instanceof Error
+        ? (err.message.trim() || err.constructor.name)
+        : fallback;
+    return raw.replace(/\s+/g, " ").slice(0, 500);
+}
 // ---------------------------------------------------------------------------
 // reconcileEpic
 // ---------------------------------------------------------------------------
@@ -43,14 +58,35 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
         catch (err) {
             const safeMsg = err instanceof Error ? err.constructor.name : "cas error";
             result.warnings.push(`cas-error folding ${signal.signal_type} for ${signal.ticket_key}: ${safeMsg}`);
+            // BAPI-500: the fold CAS did not durably run, so any PREDICTED post-fold
+            // row version for this ticket is unconfirmed. Clear it so the same-pass
+            // remediation CAS falls back to the tick-start snapshot instead of trusting
+            // a snapshot+1 that was never written.
+            observed.ticket_post_fold_row_versions?.delete(signal.ticket_key);
             continue;
         }
         if (casResult.ok) {
             result.signals_folded += 1;
+            // BAPI-500: confirm the post-fold row version from the ACTUAL CAS response
+            // (never the tick-start snapshot or a re-derived `+ 1`), so a follow-on
+            // remediation CAS in this same pass CASes against the durable snapshot+1.
+            // Keyed per ticket — one status CAS per ticket per tick. Do NOT touch
+            // `observed.ticket_row_versions`; it stays the tick-start snapshot so
+            // callers can distinguish fallback values from same-pass post-fold values.
+            observed.ticket_post_fold_row_versions ??= new Map();
+            observed.ticket_post_fold_row_versions.set(signal.ticket_key, casResult.ticket_status.row_version);
             deps.log(`[epic-reconcile] folded ${signal.signal_type} for ${signal.ticket_key} → ${signal.next_status}`);
             // BAPI-442: fire teardown + Jira transition strictly after merge.succeeded
             // CAS → done. Both are fail-open: errors are logged and never abort the pass.
-            if (signal.signal_type === "merge.succeeded") {
+            // BAPI-527: additionally require next_status === "done". Post-merge parse
+            // (parse-after-merge) folds a merge.succeeded signal to `parse_pending` while
+            // the repository re-index runs, and to `blocked` on permanent parse failure —
+            // teardown/Jira transition must NOT fire in either of those non-done folds, or
+            // the merged branch/worktree would be torn down (and Jira transitioned) before
+            // the ticket is truly done. They fire only once the ticket actually reaches
+            // `done` (either an immediate merge.succeeded fold when parse-after-merge is
+            // off, or the later parse-success fold that re-tags next_status back to "done").
+            if (signal.signal_type === "merge.succeeded" && signal.next_status === "done") {
                 if (supervisorConfig?.teardown_enabled && deps.teardownSeam) {
                     await deps.teardownSeam(observed.epic_key, signal.ticket_key).catch((e) => {
                         const safeMsg = e instanceof Error ? e.constructor.name : "teardown error";
@@ -66,18 +102,25 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
             }
         }
         else {
-            // CAS conflict: another tick already advanced this ticket — non-fatal
+            // CAS conflict: another tick already advanced this ticket — non-fatal.
+            // BAPI-500: the predicted post-fold version is unconfirmed (the real row
+            // version is whatever the other writer left), so clear it and let the
+            // same-pass remediation CAS fall back to the tick-start snapshot.
+            observed.ticket_post_fold_row_versions?.delete(signal.ticket_key);
             result.warnings.push(`cas-conflict folding ${signal.signal_type} for ${signal.ticket_key}`);
         }
     }
-    // Step 1.5: Seed planned status rows for every plan node (idempotent — ON CONFLICT DO NOTHING)
+    // Step 1.5: Seed planned status rows for every plan node. Idempotent: the
+    // backend read-back no-ops a re-seed of an existing row (A6/BAPI-507), so a
+    // normal multi-tick run no longer produces per-node seed warnings. When a seed
+    // DOES fail, the warning carries safe backend diagnostics (status/code/message
+    // preview) rather than the opaque `ConductorBridgeApiError` constructor name.
     for (const ticket of plan.tickets) {
         try {
             await deps.seedTicketStatus(observed.epic_key, ticket.ticket_key, plan.plan_version);
         }
         catch (err) {
-            const safeMsg = err instanceof Error ? err.constructor.name : "seed error";
-            result.warnings.push(`seed-error for ${ticket.ticket_key}: ${safeMsg}`);
+            result.warnings.push(`seed-error for ${ticket.ticket_key}: ${safeDiagnosticMessage(err, "seed error")}`);
         }
     }
     // Step 2: Compute the ready-set (pure — never calls LLM)
@@ -307,18 +350,30 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
                 }
                 // The attempt being recorded is the next one (1-based).
                 const attempt = counters.attempts + 1;
-                const attemptKind = decision;
                 // The folding reason frames the nudge (message type + digest). Default to
                 // the review path when the ledger no longer carries the blocking event.
                 // spec_review.changes_requested is impossible here (skipped above) but
                 // narrow explicitly so the remediation seams keep their tight reason type.
+                // BAPI-494: `merge.conflict` is normalized as a first-class reason.
                 const blockedReason = observed.ticket_blocked_reasons?.get(ticketKey);
-                const reason = blockedReason === "ci.failed" ? "ci.failed" : "review.changes_requested";
+                const normalizedReason = blockedReason === "ci.failed"
+                    ? "ci.failed"
+                    : blockedReason === "merge.conflict"
+                        ? "merge.conflict"
+                        : "review.changes_requested";
+                // BAPI-494: a conflict ALWAYS redispatches a resume-mode worker (it needs a
+                // working tree to rebase + resolve, not a message), regardless of whether the
+                // original worker is still alive — so the alive-worker nudge is forced to a
+                // redispatch here. Budget-exhaustion escalation already fired above, so at this
+                // point the budget is not exhausted. CI/review keep their liveness-driven
+                // nudge-vs-redispatch decision unchanged.
+                const attemptKind = normalizedReason === "merge.conflict" ? "redispatch" : decision;
                 // A nudge needs a worker to address it to. The liveness scan already
                 // resolved the worker id from the same heartbeat that proved the worker
                 // alive; if it is missing we cannot relay, so skip BEFORE recording an
                 // attempt — otherwise the CAS would burn a budget unit with nothing sent.
-                if (decision === "nudge" && !liveness.workerId) {
+                // A redispatch (including every conflict) needs no worker id, so it is exempt.
+                if (attemptKind === "nudge" && !liveness.workerId) {
                     result.warnings.push(`remediation nudge skipped for ${ticketKey}: alive worker has no worker_id`);
                     continue;
                 }
@@ -329,10 +384,10 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
                 // the pass still runs (crash-replay safe).
                 let casOutcome;
                 try {
-                    casOutcome = await remediateCas(observed.epic_key, ticketKey, attemptKind, reason);
+                    casOutcome = await remediateCas(observed.epic_key, ticketKey, attemptKind, normalizedReason);
                 }
                 catch (err) {
-                    const safeMsg = err instanceof Error ? err.constructor.name : "remediate error";
+                    const safeMsg = safeDiagnosticMessage(err, "remediate error");
                     result.warnings.push(`remediate-cas-failed for ${ticketKey} (${attemptKind}): ${safeMsg}`);
                     continue;
                 }
@@ -342,16 +397,18 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
                     result.warnings.push(`remediation replay swallowed for ${ticketKey} (${attemptKind})`);
                     continue;
                 }
-                if (decision === "nudge") {
-                    await sendNudge(observed.epic_key, ticketKey, attempt, casOutcome.reviewDigest, casOutcome.truncated, reason, liveness.workerId);
+                if (attemptKind === "nudge") {
+                    // Nudge is CI/review only (conflict never nudges), so narrow the reason.
+                    const nudgeReason = normalizedReason === "ci.failed" ? "ci.failed" : "review.changes_requested";
+                    await sendNudge(observed.epic_key, ticketKey, attempt, casOutcome.reviewDigest, casOutcome.truncated, nudgeReason, liveness.workerId);
                 }
                 else {
                     await resumeDispatch(observed.epic_key, ticketKey, attempt);
                 }
-                deps.log(`[epic-reconcile] remediation ${decision} ${ticketKey} attempt=${attempt}`);
+                deps.log(`[epic-reconcile] remediation ${attemptKind} ${ticketKey} attempt=${attempt} reason=${normalizedReason}`);
             }
             catch (err) {
-                const safeMsg = err instanceof Error ? err.constructor.name : "remediation error";
+                const safeMsg = safeDiagnosticMessage(err, "remediation error");
                 result.warnings.push(`remediation-error for ${ticketKey}: ${safeMsg}`);
             }
         }