@bridge_gpt/mcp-server 0.2.18 → 0.2.20

package/build/conductor/cli.js

@@ -14,8 +14,9 @@
  * `process.exit` itself (the bin wrapper owns that).
  */
 import { readFileSync, unlinkSync } from "node:fs";
-import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
+import { ConductorValidationError, ConductorEpicTickV1FrozenError, toConductorErrorEnvelope, } from "./errors.js";
 import { emitConductorEvent, purgeConductorLedger, sendWorkerMessage, checkWorkerMessages, } from "./store.js";
+import { isDuplicateConstraintError } from "./producer-ledger.js";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
 import { installConductorGitHooks } from "./git-hooks.js";
 import { runFileScopeGuardCli } from "./file-scope-guard.js";
@@ -26,6 +27,21 @@ import { resolveSupervisorConfig } from "./supervisor-config.js";
 // pulls in the SQLite store, and a static import here would force every conductor
 // CLI invocation (and every test that mocks ./store.js for the other commands) to
 // resolve the full supervisor/store graph eagerly.
+/**
+ * Human-readable error line for a sanitized conductor error envelope. For the
+ * BAPI-526 LEDGER_NATIVE_MODULE_LOAD_FAILED envelope ONLY, append a compact,
+ * allowlisted `details:` suffix (module / node_version / node_modules_abi) so a
+ * CLI operator can see the ABI skew. Never prints arbitrary detail keys, paths,
+ * stacks, argv, or raw caught messages.
+ */
+export function formatConductorErrorLine(envelope) {
+    if (envelope.error === "LEDGER_NATIVE_MODULE_LOAD_FAILED" && envelope.details) {
+        const d = envelope.details;
+        return (`${envelope.message} ` +
+            `details: module=${d.module} node_version=${d.node_version} node_modules_abi=${d.node_modules_abi}`);
+    }
+    return envelope.message;
+}
 /** Human-readable usage text for the conductor CLI. */
 export function getConductorUsage() {
     return [
@@ -103,6 +119,9 @@ export function getConductorUsage() {
         "",
         "doctor / purge options:",
         "  --json               Print machine-readable JSON",
+        "  --no-deny-probe      (doctor only) Skip the deny-enforcement preflight — no headless",
+        "                       agent is spawned; the deny_enforcement section reports an",
+        "                       explicit skipped state (enforcement UNVERIFIED, never enforced)",
         "",
         "Examples:",
         "  conductor emit-event --type run.started --source git-hook --run-id BAPI-393 \\",
@@ -217,6 +236,7 @@ function tokenizeFlags(argv, valueFlags, boolFlags) {
 const EMIT_VALUE_FLAGS = new Set([
     "--type",
     "--source",
+    "--id",
     "--subject",
     "--run-id",
     "--worker-id",
@@ -315,6 +335,10 @@ export function parseEmitEventArgs(argv, deps = {}) {
     const input = {
         source,
         type: type,
+        // Optional caller-supplied deterministic id (BAPI-527): forwarded to the store
+        // so a duplicate collides on the `events.id` UNIQUE constraint, giving the
+        // worker gate path server-side dedup without an in-process ledger poll.
+        id: values.get("--id"),
         subject: values.get("--subject"),
         run_id: values.get("--run-id"),
         worker_id: values.get("--worker-id"),
@@ -344,7 +368,22 @@ export async function runEmitEventCommand(argv, deps = {}) {
         console.log(getConductorUsage());
         return 0;
     }
-    const result = await emitConductorEvent(parsed.input);
+    let result;
+    try {
+        result = await emitConductorEvent(parsed.input);
+    }
+    catch (error) {
+        // A forwarded deterministic `--id` (BAPI-527) that collides on the events.id
+        // UNIQUE constraint is a server-side dedup, not a failure: report it as a
+        // structured duplicate so the worker gate path can treat it as a no-op emit
+        // without ever polling the ledger in-process.
+        if (isDuplicateConstraintError(error)) {
+            const dup = { ok: false, reason: "duplicate" };
+            console.log(parsed.json ? JSON.stringify(dup) : JSON.stringify(dup, null, 2));
+            return 0;
+        }
+        throw error;
+    }
     if (parsed.json) {
         console.log(JSON.stringify(result));
     }
@@ -516,21 +555,25 @@ export async function runCheckMessagesCommand(argv) {
     return 0;
 }
 const DIAGNOSTIC_BOOL_FLAGS = new Set(["--json", "--help"]);
+const DOCTOR_BOOL_FLAGS = new Set([...DIAGNOSTIC_BOOL_FLAGS, "--no-deny-probe"]);
 /**
  * Run the strictly read-only `doctor` command. Combines ledger health, git hook
  * health, and epic-tick schedule enablement status. `--json` emits the full
  * report with `epic_tick` alongside `git_hooks` at the top level.
+ * `--no-deny-probe` skips the deny-enforcement preflight (no headless agent
+ * spawn); the report then carries an explicit skipped state, never enforced.
  */
-export async function runDoctorCommand(argv) {
-    const { bools } = tokenizeFlags(argv, new Set(), DIAGNOSTIC_BOOL_FLAGS);
+export async function runDoctorCommand(argv, deps = {}) {
+    const { bools } = tokenizeFlags(argv, new Set(), DOCTOR_BOOL_FLAGS);
     if (bools.has("--help")) {
         console.log(getConductorUsage());
         return 0;
     }
     // scheduleDeps omitted: buildConductorDoctorReport lazily loads schedule-run.
-    const report = await buildConductorDoctorReport({});
+    // A caller may inject deps (e.g. a fake deny inspector in tests) to stay hermetic.
+    const report = await buildConductorDoctorReport(bools.has("--no-deny-probe") ? { ...deps, skipDenyProbe: true } : deps);
     if (bools.has("--json")) {
-        console.log(JSON.stringify({ ...report.ledger, git_hooks: report.git_hooks, epic_tick: report.epic_tick, mcp_profile: report.mcp_profile }));
+        console.log(JSON.stringify({ ...report.ledger, git_hooks: report.git_hooks, epic_tick: report.epic_tick, mcp_profile: report.mcp_profile, native_ledger: report.native_ledger, deny_enforcement: report.deny_enforcement }));
         return 0;
     }
     console.log(formatConductorDoctorReport(report));
@@ -687,7 +730,17 @@ export function applyEpicTickPreToolUseDefault(env = process.env) {
  * `conductor doctor` / `emit-event` invocation never eagerly resolves the
  * epic/store graph.
  */
-export async function runEpicTickCommand(argv) {
+export async function runEpicTickCommand(_argv) {
+    // BAPI-534 (Epic Conductor v2 slice 0): the v1 epic-tick path is FROZEN. This
+    // fail-loud guard is the FIRST executable statement — before argument parsing,
+    // `applyEpicTickPreToolUseDefault()`, and any lazy `import("./epic-runtime.js")`
+    // — so no v1 tick (or its store/supervisor graph) can ever run. Interactive
+    // `/start-tickets` is unaffected. `runConductorCli` catches this named error
+    // and formats it consistently (EPIC_TICK_V1_FROZEN → exit 1).
+    throw new ConductorEpicTickV1FrozenError();
+}
+/** @deprecated v1 epic-tick body — retained unreachable behind the freeze guard. */
+export async function runEpicTickCommandLegacy(argv) {
     const parsed = parseEpicTickArgs(argv);
     if (parsed.help) {
         console.log(getConductorUsage());
@@ -763,7 +816,7 @@ export async function runApprovePlanCommand(argv) {
     }
     catch (error) {
         const envelope = toConductorErrorEnvelope(error);
-        console.error(`Error: ${envelope.message}`);
+        console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         return 1;
     }
     if (parsed.help) {
@@ -811,7 +864,7 @@ export async function runApprovePlanCommand(argv) {
             console.log(JSON.stringify(envelope));
         }
         else {
-            console.error(`Error: ${envelope.message}`);
+            console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         }
         return envelope.status >= 500 ? 2 : 1;
     }
@@ -849,7 +902,7 @@ export async function runEpicStatusCommand(argv) {
     }
     catch (error) {
         const envelope = toConductorErrorEnvelope(error);
-        console.error(`Error: ${envelope.message}`);
+        console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         return 1;
     }
     if (parsed.help) {
@@ -915,7 +968,7 @@ export async function runEpicStatusCommand(argv) {
             console.log(JSON.stringify(envelope));
         }
         else {
-            console.error(`Error: ${envelope.message}`);
+            console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         }
         return envelope.status >= 500 ? 2 : 1;
     }
@@ -1061,7 +1114,7 @@ export async function runConductorCli(argv) {
     }
     catch (error) {
         const envelope = toConductorErrorEnvelope(error);
-        console.error(`Error: ${envelope.message}`);
+        console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         return envelope.status >= 500 ? 2 : 1;
     }
 }

package/build/conductor/deny-enforcement-preflight.js

@@ -0,0 +1,96 @@
+/**
+ * Executor deny-enforcement preflight (TDD §7 / §11, R8).
+ *
+ * v2's permission model is "skip-permissions + a deterministic deny-layer": workers
+ * run `claude -p … --dangerously-skip-permissions` with a small stable deny set. But
+ * whether `permissions.deny` is actually enforced under `--dangerously-skip-permissions`
+ * is version-specific and must be PROBED, never assumed. This module exports the single
+ * reusable predicate the T3a executor's claim loop calls at startup/preflight before
+ * claiming any job: on a failed deny probe with no working fallback it returns
+ * `enforced: false`, and the executor must refuse to claim jobs (a fatal finding).
+ *
+ * This ticket (T9) defines the INTERFACE only; the claim loop that consumes it lands in
+ * T3a. The predicate is a thin wrapper over the shared `runDenyEnforcementCheck` — it
+ * never re-derives probe logic, never touches the wider probe registry, and never runs
+ * the advisory output-format / stream-json probes. It is exception-safe: any unexpected
+ * failure resolves to a fatal `enforced: false` result rather than throwing.
+ */
+import { resolveAgentSpec } from "../agent-registry.js";
+import { createProbeContext } from "../agent-capabilities/probe-context.js";
+import { createDefaultAgentCapabilitiesDeps } from "../agent-capabilities/default-deps.js";
+import { runDenyEnforcementCheck } from "../agent-capabilities/probes.js";
+/** Canonical refuse-to-claim directive included in every fatal/degraded-fatal result. */
+const REFUSE_TO_CLAIM_WARNING = "The executor claim loop MUST refuse to claim jobs until settings permissions.deny " +
+    "or the PreToolUse fallback enforces the deny layer.";
+/**
+ * Run the deny-enforcement preflight and map the shared deny-check outcome onto the
+ * standard inspection shape. Never throws — unexpected exceptions become a fatal
+ * `enforced: false` result. Always cleans up the probe context's temp dirs.
+ */
+export async function runDenyEnforcementPreflight(opts = {}) {
+    try {
+        const agent = resolveAgentSpec("claude");
+        if (!agent) {
+            return {
+                enforced: false,
+                layer: "none",
+                degraded: true,
+                warnings: [
+                    "Could not resolve the 'claude' agent spec for the deny-enforcement preflight.",
+                    REFUSE_TO_CLAIM_WARNING,
+                ],
+            };
+        }
+        const deps = opts.capabilityDeps ?? createDefaultAgentCapabilitiesDeps();
+        const { ctx, cleanup } = await createProbeContext(deps, agent, opts.timeoutMs);
+        try {
+            const { result, layer } = await runDenyEnforcementCheck(ctx, {
+                model: opts.model,
+                timeoutMs: opts.timeoutMs,
+            });
+            if (result.status === "pass" && layer === "settings-deny") {
+                return {
+                    enforced: true,
+                    layer: "settings-deny",
+                    degraded: false,
+                    warnings: [],
+                    status: result.status,
+                    detail: result.detail,
+                };
+            }
+            if (result.status === "pass" && layer === "pretooluse-hook") {
+                return {
+                    enforced: true,
+                    layer: "pretooluse-hook",
+                    degraded: true,
+                    warnings: [
+                        "settings permissions.deny was not enforced under --dangerously-skip-permissions; relying on PreToolUse fallback.",
+                    ],
+                    status: result.status,
+                    detail: result.detail,
+                };
+            }
+            // Any other outcome (fail / hang / spawn-error) — deny is not enforced.
+            return {
+                enforced: false,
+                layer: "none",
+                degraded: true,
+                warnings: [`Deny-layer enforcement probe did not pass: ${result.detail}`, REFUSE_TO_CLAIM_WARNING],
+                status: result.status,
+                detail: result.detail,
+            };
+        }
+        finally {
+            await cleanup();
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            enforced: false,
+            layer: "none",
+            degraded: true,
+            warnings: [`Deny-layer enforcement preflight failed unexpectedly: ${msg}`, REFUSE_TO_CLAIM_WARNING],
+        };
+    }
+}

package/build/conductor/doctor.js

@@ -8,8 +8,110 @@
  * migration, no event emission, and no scheduler unit creation.
  */
 import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
 import { doctorConductorLedger } from "./store.js";
 import { inspectConductorGitHooks } from "./git-hooks.js";
+import { resolveMcpShimInvocationForRuntime, resolvePackageRootFromModuleUrl, } from "../mcp-server-invocation.js";
+/**
+ * Explicit not-run state for the `deny_enforcement` section when the probe is
+ * skipped via `--no-deny-probe`. Enforcement is UNVERIFIED, so the state is
+ * fail-safe: `enforced: false` with `status: "skip"` distinguishing a deliberate
+ * skip from a probed FATAL failure.
+ */
+export function skippedDenyEnforcementResult() {
+    return {
+        enforced: false,
+        layer: "none",
+        degraded: true,
+        status: "skip",
+        detail: "deny-enforcement preflight skipped via --no-deny-probe (no agent spawned)",
+        warnings: [
+            "Deny-enforcement preflight was SKIPPED (--no-deny-probe): enforcement is UNVERIFIED " +
+                "on this host. Do not treat this report as evidence the deny layer works.",
+        ],
+    };
+}
+/**
+ * Default reader for the package.json text (BAPI-526). Resolves the package root
+ * from this module's URL and reads `<packageRoot>/package.json`. Throws internally
+ * when the root cannot be resolved so the caller degrades to `engines_node: null`.
+ */
+export async function defaultReadPackageJson() {
+    const packageRoot = resolvePackageRootFromModuleUrl(import.meta.url);
+    if (!packageRoot) {
+        throw new Error("unable to resolve package root for package.json");
+    }
+    return readFileSync(`${packageRoot}/package.json`, "utf8");
+}
+/**
+ * Parse package.json text and return `engines.node` when it is a string; `null`
+ * otherwise. Never throws on malformed JSON — returns `null`.
+ */
+export function readExpectedNodeEngine(packageJsonText) {
+    try {
+        const pkg = JSON.parse(packageJsonText);
+        const node = pkg.engines?.node;
+        return typeof node === "string" ? node : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the read-only native-ledger inspection (BAPI-526). Composes the ledger
+ * doctor's native-load result with the expected Node engine and the resolved MCP
+ * shim invocation. Never opens the ledger, never throws to callers, and never
+ * includes raw package paths, stack traces, or the absolute server entry path.
+ */
+export async function inspectNativeLedger(nativeLoad, deps = {}) {
+    const warnings = [];
+    // Expected Node engine (fail-soft to null on any read/parse failure).
+    let engines_node = null;
+    try {
+        const readPkg = deps.readPackageJson ?? defaultReadPackageJson;
+        engines_node = readExpectedNodeEngine(await readPkg());
+    }
+    catch {
+        engines_node = null;
+    }
+    // MCP shim invocation (resolvable absolute-build-path vs npm-channel fallback).
+    const invocation = deps.resolveMcpInvocation
+        ? deps.resolveMcpInvocation()
+        : resolveMcpShimInvocationForRuntime({
+            moduleUrl: import.meta.url,
+            nodeExecutable: "node",
+            argv1: process.argv[1],
+            fileExists: existsSync,
+        });
+    // Path-safe: expose only the node executable for the absolute form (never the
+    // server entry path), and null for the npm-channel fallback.
+    const mcp_shim_node = invocation.form === "absolute-build-path" ? invocation.nodeExecutable : null;
+    const binding_loads = nativeLoad.loads;
+    const failure_kind = nativeLoad.failure_kind;
+    if (nativeLoad.degraded && nativeLoad.warning) {
+        warnings.push(nativeLoad.warning);
+    }
+    if (invocation.form !== "absolute-build-path") {
+        warnings.push("Worker MCP registration would use the npm-channel fallback (no resolvable on-disk build entry); " +
+            "registration reliability depends on the package being published.");
+    }
+    if (engines_node === null) {
+        warnings.push("Could not read package.json engines.node; expected Node version is unknown.");
+    }
+    const degraded = nativeLoad.degraded || invocation.form !== "absolute-build-path" || engines_node === null;
+    return {
+        cli_node_version: process.version,
+        engines_node,
+        mcp_shim_node,
+        mcp_registration_form: invocation.form,
+        module: nativeLoad.module,
+        node_modules_abi: nativeLoad.node_modules_abi,
+        binding_loads,
+        failure_kind,
+        degraded,
+        warnings,
+    };
+}
 /**
  * Inspect the local schedule metadata store for a registered epic-tick schedule.
  * Strictly read-only: composes orchestrateScheduleList (read-only list path) and
@@ -175,21 +277,58 @@ export async function buildConductorDoctorReport(deps = {}) {
     const inspectHooks = deps.inspectHooks ?? inspectConductorGitHooks;
     const epicTick = await inspectEpicTickSchedule(deps.scheduleDeps, deps.orchestrateList);
     const mcp_profile = inspectMcpProfile(deps.env ?? process.env, epicTick);
+    // Resolve the ledger once so the native-load probe reflects the same report.
+    const ledger = await doctorLedger();
+    const native_ledger = await inspectNativeLedger(ledger.native_load, deps);
+    const deny_enforcement = deps.skipDenyProbe
+        ? skippedDenyEnforcementResult()
+        : await inspectDenyEnforcementSafe(deps.inspectDenyEnforcement);
     return {
-        ledger: await doctorLedger(),
+        ledger,
         git_hooks: inspectHooks(deps.hooksDeps),
         epic_tick: epicTick,
         mcp_profile,
         local_merge: inspectLocalMerge(deps.runCommand),
+        native_ledger,
+        deny_enforcement,
     };
 }
+/**
+ * Run the deny-enforcement inspector and convert any thrown exception into degraded
+ * report data — a deny-probe failure must never throw out of doctor. The underlying
+ * predicate is already exception-safe; this is defense-in-depth for an injected fake.
+ */
+async function inspectDenyEnforcementSafe(inspect) {
+    try {
+        let run = inspect;
+        if (!run) {
+            // Lazy import keeps the agent-capabilities graph out of doctor.ts's static
+            // module graph (see the import-site comment above).
+            const mod = await import("./deny-enforcement-preflight.js");
+            run = mod.runDenyEnforcementPreflight;
+        }
+        return await run();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            enforced: false,
+            layer: "none",
+            degraded: true,
+            warnings: [
+                `Deny-layer enforcement inspection failed: ${msg}`,
+                "The executor claim loop MUST refuse to claim jobs until the deny layer is enforced.",
+            ],
+        };
+    }
+}
 /**
  * Render the combined doctor report as human-readable text: ledger health,
  * git hooks section, and an Epic Supervisor Schedule section using semantic
  * status tags consistent with the git hooks section's visual hierarchy.
  */
 export function formatConductorDoctorReport(report) {
-    const { ledger, git_hooks, epic_tick, mcp_profile, local_merge } = report;
+    const { ledger, git_hooks, epic_tick, mcp_profile, local_merge, native_ledger, deny_enforcement } = report;
     const lines = [
         "Conductor ledger doctor",
         "───────────────────────",
@@ -270,5 +409,47 @@ export function formatConductorDoctorReport(report) {
         for (const w of local_merge.warnings)
             lines.push(`  - ${w}`);
     }
+    lines.push("");
+    lines.push("Native ledger module (required for conductor coordination)");
+    lines.push("─────────────────────────────────────────────────────────");
+    const nativeTag = native_ledger.binding_loads && !native_ledger.degraded ? "[OK]" : "[WARNING] degraded";
+    // Strictly diagnostic — reports the skew but never suggests an automatic
+    // install/rebuild/migration (BAPI-526 is detection only).
+    lines.push(`binding loads:         ${native_ledger.binding_loads} ${nativeTag}`);
+    lines.push(`module:                ${native_ledger.module}`);
+    lines.push(`CLI Node:              ${native_ledger.cli_node_version}`);
+    lines.push(`engines.node:          ${native_ledger.engines_node ?? "n/a"}`);
+    lines.push(`MCP shim Node:         ${native_ledger.mcp_shim_node ?? "n/a"}`);
+    lines.push(`NODE_MODULE_VERSION:   ${native_ledger.node_modules_abi}`);
+    lines.push(`registration form:     ${native_ledger.mcp_registration_form}`);
+    lines.push(`failure kind:          ${native_ledger.failure_kind}`);
+    lines.push(`degraded:              ${native_ledger.degraded}`);
+    if (native_ledger.warnings.length > 0) {
+        lines.push("native ledger warnings:");
+        for (const w of native_ledger.warnings)
+            lines.push(`  - ${w}`);
+    }
+    lines.push("");
+    lines.push("Deny-layer enforcement preflight (required for executor claim)");
+    lines.push("─────────────────────────────────────────────────────────────");
+    // OK when enforced by settings-deny (non-degraded); WARNING when relying on the
+    // PreToolUse fallback; SKIPPED when the probe was deliberately not run
+    // (--no-deny-probe, enforcement unverified); FATAL when nothing enforces — the
+    // executor must refuse to claim.
+    const denyTag = deny_enforcement.status === "skip"
+        ? "[SKIPPED] probe not run (--no-deny-probe) — enforcement unverified"
+        : !deny_enforcement.enforced
+            ? "[FATAL] deny not enforced — executor must refuse to claim jobs"
+            : deny_enforcement.degraded
+                ? "[WARNING] degraded — relying on PreToolUse fallback"
+                : "[OK]";
+    lines.push(`enforced:              ${deny_enforcement.enforced} ${denyTag}`);
+    lines.push(`layer:                 ${deny_enforcement.layer}`);
+    lines.push(`degraded:              ${deny_enforcement.degraded}`);
+    if (deny_enforcement.warnings.length > 0) {
+        lines.push("deny enforcement warnings:");
+        for (const w of deny_enforcement.warnings)
+            lines.push(`  - ${w}`);
+    }
     return lines.join("\n");
 }

package/build/conductor/epic-reconcile.js

@@ -78,7 +78,15 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
             deps.log(`[epic-reconcile] folded ${signal.signal_type} for ${signal.ticket_key} → ${signal.next_status}`);
             // BAPI-442: fire teardown + Jira transition strictly after merge.succeeded
             // CAS → done. Both are fail-open: errors are logged and never abort the pass.
-            if (signal.signal_type === "merge.succeeded") {
+            // BAPI-527: additionally require next_status === "done". Post-merge parse
+            // (parse-after-merge) folds a merge.succeeded signal to `parse_pending` while
+            // the repository re-index runs, and to `blocked` on permanent parse failure —
+            // teardown/Jira transition must NOT fire in either of those non-done folds, or
+            // the merged branch/worktree would be torn down (and Jira transitioned) before
+            // the ticket is truly done. They fire only once the ticket actually reaches
+            // `done` (either an immediate merge.succeeded fold when parse-after-merge is
+            // off, or the later parse-success fold that re-tags next_status back to "done").
+            if (signal.signal_type === "merge.succeeded" && signal.next_status === "done") {
                 if (supervisorConfig?.teardown_enabled && deps.teardownSeam) {
                     await deps.teardownSeam(observed.epic_key, signal.ticket_key).catch((e) => {
                         const safeMsg = e instanceof Error ? e.constructor.name : "teardown error";