@bridge_gpt/mcp-server 0.2.18 → 0.2.20

package/build/mcp-invoke.js

@@ -32,10 +32,15 @@ import { getThirdPartyTargetDefinition, resolveThirdPartyTargetEnv, validateThir
 export function getMcpInvokeUsage() {
     return [
         "Usage:",
-        "  npx -y @bridge_gpt/mcp-server mcp-invoke --target <target> --project-root <ABS_WORKTREE_PATH>",
+        "  node <abs>/mcp_server/build/index.js mcp-invoke --target <target> --project-root <ABS_WORKTREE_PATH>",
+        "",
+        "  (npm-channel fallback may invoke the same shim through a package spec, e.g.",
+        "   npx -y @bridge_gpt/mcp-server@latest mcp-invoke --target <target> --project-root <ABS_WORKTREE_PATH>)",
         "",
         "Internal worktree shim: resolves the target's launch command and credentials",
         "from the given project root, then spawns the real MCP server over stdio.",
+        "Argument parsing is identical regardless of how this process was launched",
+        "(absolute-path node invocation vs npm-channel npx).",
         "",
         "Flags:",
         "  --target <target>            MCP target to launch. 'bapi' launches the Bridge",
@@ -264,11 +269,22 @@ export async function resolveBapiInvocation(projectRoot, deps) {
     if (!credResult.ok) {
         return { ok: false, error: `failed to resolve credentials: ${credResult.error}` };
     }
-    const env = buildChildEnv(deps.env, {
+    const overlay = {
         BAPI_API_KEY: credResult.credentials.apiKey,
         BAPI_PROJECT_ROOT: projectRoot,
         BAPI_REPO_NAME: repoName,
-    });
+    };
+    // BAPI-527: `CONDUCTOR_NODE_PATH` is NON-SECRET operational metadata (the
+    // captured conductor Node path used by the worker-ledger CLI subprocess).
+    // `buildChildEnv` already inherits the full parent env, so this re-affirms the
+    // pass-through explicitly and ONLY when present — it is a non-secret allowlist
+    // entry, never a credential. It is emphatically NOT the MCP server's re-exec
+    // command: the spawned command stays `deps.execPath` + `[scriptPath]` below.
+    const conductorNodePath = deps.env.CONDUCTOR_NODE_PATH;
+    if (typeof conductorNodePath === "string" && conductorNodePath.trim().length > 0) {
+        overlay.CONDUCTOR_NODE_PATH = conductorNodePath;
+    }
+    const env = buildChildEnv(deps.env, overlay);
     return {
         ok: true,
         invocation: { command: deps.execPath, args: [deps.scriptPath], env },

package/build/mcp-provisioning.js

@@ -18,9 +18,9 @@
  * to avoid a runtime import cycle.
  */
 import path from "path";
-import { VERSION } from "./version.generated.js";
 import { readBridgeConfig } from "./bridge-config.js";
 import { getThirdPartyTargetDefinition, validateThirdPartyTargetManifestEntry, } from "./third-party-mcp-targets.js";
+import { buildMcpShimCommand, } from "./mcp-server-invocation.js";
 // ---------------------------------------------------------------------------
 // Pure helpers
 // ---------------------------------------------------------------------------
@@ -55,27 +55,27 @@ export function serverNameForMcpTarget(target) {
     return target === "bapi" ? "bridge-api" : target;
 }
 /**
- * Build a secret-free shim entry for any target. `args` are version-pinned and
- * carry the target name plus the absolute project root; there is intentionally
- * no `env` block.
+ * Build a secret-free shim entry for any target from a structured invocation.
+ * The command/args carry the target name plus the absolute project root; there is
+ * intentionally no `env` block. The absolute-build-path form serializes as
+ * `{ command: "node", args: ["<abs>/build/index.js", "mcp-invoke", …] }` (the
+ * node executable is a single substitutable field), and the npm-channel fallback
+ * as `{ command: "npx", args: ["-y", "<spec>", "mcp-invoke", …] }`.
+ *
+ * BAPI-527: `.mcp.json` remains intentionally ENV-FREE. `CONDUCTOR_NODE_PATH`
+ * (the captured conductor Node path for the worker-ledger CLI subprocess) is NOT
+ * written here — it is inherited at runtime from the worker SHELL env that
+ * `start-tickets` injects at the spawn boundary, never stored as a registration
+ * value. Keeping the shim env-free preserves the credential-safety invariant
+ * (secrets are resolved by the `mcp-invoke` shim at launch, not persisted in the
+ * worktree) and equally avoids persisting non-secret operational metadata here.
  */
-export function buildShimMcpServerEntry(target, absoluteWorktreePath) {
-    return {
-        command: "npx",
-        args: [
-            "-y",
-            `@bridge_gpt/mcp-server@${VERSION}`,
-            "mcp-invoke",
-            "--target",
-            target,
-            "--project-root",
-            absoluteWorktreePath,
-        ],
-    };
+export function buildShimMcpServerEntry(target, absoluteWorktreePath, invocation) {
+    return buildMcpShimCommand(invocation, target, absoluteWorktreePath);
 }
 /** Back-compat wrapper around `buildShimMcpServerEntry("bapi", ...)`. */
-export function buildBridgeApiShimMcpServerEntry(absoluteWorktreePath) {
-    return buildShimMcpServerEntry("bapi", absoluteWorktreePath);
+export function buildBridgeApiShimMcpServerEntry(absoluteWorktreePath, invocation) {
+    return buildShimMcpServerEntry("bapi", absoluteWorktreePath, invocation);
 }
 /**
  * Convert all supported manifest `mcp` entries into a map of server name -> shim
@@ -84,12 +84,12 @@ export function buildBridgeApiShimMcpServerEntry(absoluteWorktreePath) {
  * or incomplete non-`bapi` targets are skipped with a secret-free warning (they
  * never appear in the returned entries).
  */
-export function buildMcpServerEntriesForManifest(manifest, absoluteWorktreePath) {
+export function buildMcpServerEntriesForManifest(manifest, absoluteWorktreePath, invocation) {
     const entries = {};
     const warnings = [];
     for (const mcp of manifest.mcp) {
         if (mcp.target === "bapi") {
-            entries[serverNameForMcpTarget("bapi")] = buildShimMcpServerEntry("bapi", absoluteWorktreePath);
+            entries[serverNameForMcpTarget("bapi")] = buildShimMcpServerEntry("bapi", absoluteWorktreePath, invocation);
             continue;
         }
         const definition = getThirdPartyTargetDefinition(mcp.target);
@@ -102,9 +102,9 @@ export function buildMcpServerEntriesForManifest(manifest, absoluteWorktreePath)
             warnings.push(`MCP target '${mcp.target}' registration skipped: ${validation.error}.`);
             continue;
         }
-        entries[serverNameForMcpTarget(mcp.target)] = buildShimMcpServerEntry(mcp.target, absoluteWorktreePath);
+        entries[serverNameForMcpTarget(mcp.target)] = buildShimMcpServerEntry(mcp.target, absoluteWorktreePath, invocation);
     }
-    return { entries, warnings };
+    return { entries, warnings, registrationForm: invocation.form };
 }
 /** Both registration files written for every provisioned worktree. */
 export function getWorktreeMcpRegistrationTargets(worktreePath, platform) {
@@ -305,7 +305,7 @@ export async function provisionMcpRegistrationForWorktree(row, deps) {
     if (!normalized.ok) {
         return { ...row, status: "spawn-failed", error: `MCP provisioning failed: ${normalized.error}` };
     }
-    const built = buildMcpServerEntriesForManifest(read.manifest, normalized.path);
+    const built = buildMcpServerEntriesForManifest(read.manifest, normalized.path, deps.mcpServerInvocation);
     if (Object.keys(built.entries).length === 0) {
         // Nothing supported to write (e.g. a manifest with no bapi target and no
         // supported Tier-2 targets). Surface any warnings but leave status unchanged.
@@ -318,10 +318,16 @@ export async function provisionMcpRegistrationForWorktree(row, deps) {
             return { ...row, status: "spawn-failed", error: `MCP provisioning failed: ${result.error}` };
         }
     }
+    // Record the resolved registration form for audit (path-free — the form label
+    // only, never the absolute server entry path, which could leak a username).
+    let result = { ...row, mcpRegistrationForm: built.registrationForm };
+    result = withWarnings(result, built.warnings);
+    if (built.registrationForm !== "absolute-build-path") {
+        result = withWarning(result, "MCP registration used npm-channel fallback because an on-disk build entry was not resolvable.");
+    }
     // Pre-approve the just-registered servers so Claude Code does not prompt to
     // trust them in this fresh worktree path. Best-effort: a failure here only
     // loses the convenience of skipping the prompt, so warn and still spawn.
-    let result = withWarnings(row, built.warnings);
     const serverNames = Object.keys(built.entries);
     const trust = await writeClaudeServerTrustSettings(normalized.path, serverNames, deps);
     if (!trust.ok) {

package/build/mcp-registration-doctor.js

@@ -35,22 +35,42 @@ function flagValue(args, flag) {
     return undefined;
 }
 /**
- * True when `entry` is a secret-free Bridge API shim registration that launches
- * `npx -y @bridge_gpt/mcp-server@<version> mcp-invoke --target bapi
- * --project-root <worktreeRoot>`. The `--target` must be `bapi` and the
- * `--project-root` must match the given worktree exactly.
+ * True when `entry` is a secret-free Bridge API shim registration pointing at
+ * THIS worktree. Two forms are accepted (BAPI-526):
+ *
+ *   - Absolute-build-path (PRIMARY): an absolute `node` (or absolute Node-path)
+ *     invocation of the conductor's own compiled server, e.g.
+ *     `{ command: "node", args: ["<abs>/mcp_server/build/index.js", "mcp-invoke",
+ *     "--target", "bapi", "--project-root", "<worktreeRoot>"] }`. `command` may be
+ *     any non-empty string ("node" or a future absolute Node path); `args[0]` is a
+ *     non-empty server entry path.
+ *   - npm-channel (LEGACY/FALLBACK): `{ command: "npx", args: ["-y",
+ *     "@bridge_gpt/mcp-server@<spec>", "mcp-invoke", "--target", "bapi",
+ *     "--project-root", "<worktreeRoot>"] }`.
+ *
+ * In both forms `--target` must be `bapi` and `--project-root` must match the
+ * given worktree exactly. The server entry path is NOT required to sit under any
+ * particular username/path prefix.
  */
 export function isBridgeApiShimEntry(entry, worktreeRoot) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry))
         return false;
     const candidate = entry;
-    if (candidate.command !== "npx")
+    if (typeof candidate.command !== "string" || candidate.command.length === 0)
         return false;
     if (!Array.isArray(candidate.args))
         return false;
     const args = candidate.args.filter((a) => typeof a === "string");
-    if (!args.some((a) => a.startsWith("@bridge_gpt/mcp-server")))
-        return false;
+    if (candidate.command === "npx") {
+        // npm-channel fallback: must reference the package spec.
+        if (!args.some((a) => a.startsWith("@bridge_gpt/mcp-server")))
+            return false;
+    }
+    else {
+        // Absolute-build-path: first arg must be a non-empty server entry path.
+        if (typeof args[0] !== "string" || args[0].length === 0)
+            return false;
+    }
     if (!args.includes("mcp-invoke"))
         return false;
     if (flagValue(args, "--target") !== "bapi")

package/build/mcp-server-invocation.js

@@ -0,0 +1,152 @@
+/**
+ * Shared, dependency-injected model for how a dispatched worker launches the
+ * Bridge MCP `mcp-invoke` shim (BAPI-526, Change A).
+ *
+ * The conductor used to register each dispatched worktree's `.mcp.json` against
+ * an EXACT npm version (`npx -y @bridge_gpt/mcp-server@<VERSION> mcp-invoke …`).
+ * When that version was built but not yet published, `npx` returned ETARGET/404
+ * and the worker had NO Bridge MCP tools. This module lets provisioning instead
+ * invoke the conductor's own on-disk build by ABSOLUTE PATH
+ * (`node <abs>/mcp_server/build/index.js mcp-invoke …`) — removing the
+ * npm-registry publish dependency and guaranteeing the worker runs the exact MCP
+ * code the conductor is running. A resolvable npm-channel spec remains the
+ * fallback when an on-disk build entry cannot be resolved (published-package
+ * install).
+ *
+ * SCOPE BOUNDARY (BAPI-526 is detection/registration only): this selects WHICH
+ * server file is invoked (`node <absPath>/index.js` vs `npx @…`). It does NOT
+ * change WHICH Node binary runs that file — the `nodeExecutable` field is kept as
+ * a single substitutable value (never string-concatenated into the command) so
+ * the later Ticket 3 (P2) work can point it at `CONDUCTOR_NODE_PATH` without
+ * re-plumbing argv construction.
+ */
+import path from "node:path";
+export const MCP_SERVER_PACKAGE_NAME = "@bridge_gpt/mcp-server";
+/**
+ * Resolvable npm-channel fallback spec. Deliberately a moving channel (`@latest`)
+ * rather than an exact generated version pin, so the fallback path can never
+ * reintroduce the ETARGET/404 failure the absolute-path form exists to remove.
+ */
+export const DEFAULT_MCP_SERVER_NPM_CHANNEL_SPEC = "@bridge_gpt/mcp-server@latest";
+/**
+ * Build the concrete `{ command, args }` launch pair for a target + worktree from
+ * a structured invocation. Pure — no filesystem or process access. The
+ * `nodeExecutable` is returned as the standalone `command`, never concatenated
+ * with the server entry path, so `CONDUCTOR_NODE_PATH` can substitute it later.
+ */
+export function buildMcpShimCommand(invocation, target, absoluteWorktreePath) {
+    if (invocation.form === "absolute-build-path") {
+        return {
+            command: invocation.nodeExecutable,
+            args: [
+                invocation.serverEntryPath,
+                "mcp-invoke",
+                "--target",
+                target,
+                "--project-root",
+                absoluteWorktreePath,
+            ],
+        };
+    }
+    return {
+        command: "npx",
+        args: [
+            "-y",
+            invocation.packageSpec,
+            "mcp-invoke",
+            "--target",
+            target,
+            "--project-root",
+            absoluteWorktreePath,
+        ],
+    };
+}
+/**
+ * Secret-free, path-free audit label for summaries and diagnostics. Returns ONLY
+ * the registration form; never the server entry path, username, argv, or package
+ * cache path (any of which can leak a username through a filesystem path).
+ */
+export function formatMcpShimInvocationForAudit(invocation) {
+    return invocation.form;
+}
+/**
+ * Resolve the package root from a module URL by walking the module file path and
+ * locating the nearest `src` or `build` path segment; the package root is the
+ * portion BEFORE that segment. Returns forward-slash form so it is deterministic
+ * across platforms (Node accepts forward slashes on Windows). Does NOT consult
+ * `process.cwd()`. Returns `null` when neither `src` nor `build` appears.
+ */
+export function resolvePackageRootFromModuleUrl(moduleUrl) {
+    // Parse the URL's pathname directly rather than via fileURLToPath: on Windows,
+    // fileURLToPath throws ERR_INVALID_FILE_URL_PATH for a drive-less `file:///…`
+    // URL, whereas the pathname (`/repo/mcp_server/…`) is available on every
+    // platform. This keeps resolution deterministic across POSIX and Windows.
+    let pathname;
+    try {
+        pathname = decodeURIComponent(new URL(moduleUrl).pathname);
+    }
+    catch {
+        return null;
+    }
+    // A real Windows `import.meta.url` is `file:///C:/…`, whose pathname is
+    // `/C:/…`; strip the leading slash so the drive letter leads (Node accepts
+    // forward slashes on Windows). Drive-less POSIX pathnames are left unchanged.
+    if (/^\/[A-Za-z]:/.test(pathname)) {
+        pathname = pathname.slice(1);
+    }
+    // Split on both separators so a Windows-materialized path (backslashes) and a
+    // posix path both segment identically.
+    const segments = pathname.split(/[\\/]/);
+    let markerIndex = -1;
+    for (let i = segments.length - 1; i >= 0; i--) {
+        if (segments[i] === "src" || segments[i] === "build") {
+            markerIndex = i;
+            break;
+        }
+    }
+    if (markerIndex <= 0)
+        return null;
+    return segments.slice(0, markerIndex).join("/");
+}
+/** Manual basename that tolerates either path separator. */
+function basenameAnySep(filePath) {
+    const segments = filePath.split(/[\\/]/);
+    return segments[segments.length - 1] ?? "";
+}
+/**
+ * Resolve how the worker MCP shim should be launched, preferring the conductor's
+ * own on-disk build by absolute path and falling back to a resolvable npm channel.
+ *
+ * Resolution order (never uses `process.cwd()`):
+ *   1. `<packageRoot>/build/index.js` derived from `deps.moduleUrl`.
+ *   2. `deps.argv1` when it is absolute, exists, and its basename is `index.js`.
+ *   3. npm-channel fallback (`deps.npmPackageSpec ?? DEFAULT_MCP_SERVER_NPM_CHANNEL_SPEC`).
+ *
+ * NOTE (scope boundary): this ticket changes WHICH server file is invoked, not
+ * WHICH Node runtime runs it. `nodeExecutable` defaults to `"node"` (NOT
+ * `process.execPath`) to preserve today's worker runtime selection; Ticket 3 (P2)
+ * can later inject `CONDUCTOR_NODE_PATH` into this single field.
+ */
+export function resolveMcpShimInvocationForRuntime(deps) {
+    const nodeExecutable = deps.nodeExecutable ?? "node";
+    const packageRoot = resolvePackageRootFromModuleUrl(deps.moduleUrl);
+    if (packageRoot) {
+        const candidate = `${packageRoot}/build/index.js`;
+        if (deps.fileExists(candidate)) {
+            return { form: "absolute-build-path", nodeExecutable, serverEntryPath: candidate };
+        }
+    }
+    const argv1 = deps.argv1;
+    if (typeof argv1 === "string" &&
+        argv1.length > 0 &&
+        path.isAbsolute(argv1) &&
+        basenameAnySep(argv1) === "index.js" &&
+        deps.fileExists(argv1)) {
+        return { form: "absolute-build-path", nodeExecutable, serverEntryPath: argv1 };
+    }
+    return {
+        form: "npm-channel",
+        command: "npx",
+        packageSpec: deps.npmPackageSpec ?? DEFAULT_MCP_SERVER_NPM_CHANNEL_SPEC,
+    };
+}