@bridge_gpt/mcp-server 0.2.18 → 0.2.20

package/build/conductor/errors.js

@@ -61,6 +61,76 @@ export class ConductorStoreError extends Error {
         this.name = "ConductorStoreError";
     }
 }
+/**
+ * Raised when the frozen v1 `conductor epic-tick` entrypoint is invoked
+ * (BAPI-534, Epic Conductor v2 slice 0). The v1 local reconciler/ledger tick is
+ * frozen: Epic Conductor v2 replaces it with a server-side reconciler plus the
+ * local executor (`mcp-server executor`). The message points operators at the v2
+ * path and is path-free / secret-free.
+ */
+export class ConductorEpicTickV1FrozenError extends Error {
+    constructor() {
+        super("The v1 `conductor epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
+            "Conductor v2 replaces the local epic tick with a server-side reconciler " +
+            "plus the local executor — run `mcp-server executor` instead.");
+        this.name = "ConductorEpicTickV1FrozenError";
+    }
+}
+/**
+ * Raised (BAPI-527) when the worker-side ledger subprocess boundary cannot run.
+ *
+ * Worker-facing ledger operations (`check_messages`, `wait_for_done_gate` event
+ * emission) MUST execute through `conductor-bin.js` under the captured conductor
+ * Node (`CONDUCTOR_NODE_PATH`) so the worker Node never loads the `better-sqlite3`
+ * native binary. When that runtime is missing or invalid, this error makes the
+ * failure LOUD and structured rather than silently falling back to the worker
+ * Node. The carried `reason`/`envVar` are the ONLY diagnostic surface — both are
+ * fixed, non-secret, path-free tokens. No caught error, path, argv, stdout,
+ * stderr, or credential value is ever attached.
+ */
+export class ConductorLedgerSubprocessRuntimeError extends Error {
+    reason;
+    envVar;
+    constructor(reason, envVar) {
+        // Single-line, path-free, secret-free (the committed CLI-stderr invariant in
+        // security-regressions.test.ts requires it). Names only the reason token.
+        super(`Conductor worker ledger subprocess is unavailable (reason: ${reason}).`);
+        this.name = "ConductorLedgerSubprocessRuntimeError";
+        this.reason = reason;
+        this.envVar = envVar;
+    }
+}
+/**
+ * Structural guard for a native-module-load failure raised by the conductor
+ * store (BAPI-526). Detected structurally (by `name` + a valid `details` object)
+ * rather than by importing `ConductorNativeModuleLoadError` from `store.ts`, so
+ * `errors.ts` avoids a runtime import cycle with the store.
+ */
+export function isConductorNativeModuleLoadError(error) {
+    if (!(error instanceof Error))
+        return false;
+    if (error.name !== "ConductorNativeModuleLoadError")
+        return false;
+    const details = error.details;
+    if (!details || typeof details !== "object" || Array.isArray(details))
+        return false;
+    const d = details;
+    return (typeof d.node_version === "string" &&
+        typeof d.node_modules_abi === "string" &&
+        typeof d.module === "string");
+}
+/**
+ * Copy ONLY the three allowlisted native-load detail fields. Never spreads
+ * arbitrary properties from the error, so a secret/path smuggled onto the error
+ * object cannot round-trip into the client envelope.
+ */
+function nativeModuleDetailsEnvelope(details) {
+    return {
+        node_version: details.node_version,
+        node_modules_abi: details.node_modules_abi,
+        module: details.module,
+    };
+}
 /**
  * Heuristically detect SQLite busy/locked failures so they can be surfaced as a
  * retryable 503 rather than an opaque 500. Matches the `better-sqlite3` error
@@ -101,11 +171,37 @@ function isSqliteBusyError(error) {
  *     the raw error text, stack, and any secret material are discarded.
  */
 export function toConductorErrorEnvelope(error) {
+    // v1 epic-tick freeze (BAPI-534): the frozen entrypoint maps to a stable,
+    // named 400 pointing operators at Epic Conductor v2 (server-side reconciler +
+    // local executor). Checked first — it is a fail-loud guard, not a runtime fault.
+    if (error instanceof ConductorEpicTickV1FrozenError) {
+        return {
+            error: "EPIC_TICK_V1_FROZEN",
+            status: 400,
+            message: error.message,
+        };
+    }
+    // Native-module LOAD failure (BAPI-526): `better-sqlite3` is present but fails
+    // to load for this Node runtime (ABI/dlopen mismatch). Checked BEFORE the
+    // generic persistence-unavailable branch below (the native-load error subclasses
+    // it) so an ABI/dlopen failure surfaces as a distinct, machine-readable kind
+    // carrying node_version/ABI — never masked as INTERNAL_ERROR or the
+    // undifferentiated PERSISTENCE_UNAVAILABLE. `details` is a fixed three-field
+    // allowlist copied explicitly, never spread from the error object.
+    if (isConductorNativeModuleLoadError(error)) {
+        return {
+            error: "LEDGER_NATIVE_MODULE_LOAD_FAILED",
+            status: 500,
+            message: "Conductor ledger native module failed to load for this Node runtime.",
+            details: nativeModuleDetailsEnvelope(error.details),
+        };
+    }
     // Optional-native-binding degradation (BAPI-451): the conductor `store.ts`
     // throws ConductorPersistenceUnavailableError when `better-sqlite3` could not be
-    // loaded. Detected by name (not instanceof) to avoid an import cycle with
-    // store.ts. Surfaced as a retryable-shaped 503 with a fixed, secret-free message
-    // so the caller learns persistence is unavailable instead of getting an opaque 500.
+    // loaded (or is not installed). Detected by name (not instanceof) to avoid an
+    // import cycle with store.ts. Surfaced as a retryable-shaped 503 with a fixed,
+    // secret-free message so the caller learns persistence is unavailable instead of
+    // getting an opaque 500.
     if (error instanceof Error && error.name === "ConductorPersistenceUnavailableError") {
         return {
             error: "PERSISTENCE_UNAVAILABLE",
@@ -113,6 +209,22 @@ export function toConductorErrorEnvelope(error) {
             message: "Conductor persistence is unavailable (the optional better-sqlite3 native module is not loaded). Conductor coordination features are disabled; core tools are unaffected.",
         };
     }
+    // Worker-ledger subprocess runtime failure (BAPI-527): CONDUCTOR_NODE_PATH /
+    // BAPI_CONDUCTOR_CLI_FILE is missing or invalid so the worker cannot reach the
+    // local ledger through the captured conductor Node. Surfaced as a retryable-
+    // shaped 503 with a fixed, secret-free message plus a small non-secret details
+    // bag (env_var + stable reason). NOTHING path/secret-bearing is echoed. This is
+    // distinct from LEDGER_NATIVE_MODULE_LOAD_FAILED / PERSISTENCE_UNAVAILABLE,
+    // which cover conductor-owned processes that still load better-sqlite3 directly.
+    if (error instanceof ConductorLedgerSubprocessRuntimeError) {
+        return {
+            error: "LEDGER_SUBPROCESS_RUNTIME_UNAVAILABLE",
+            status: 503,
+            message: "Conductor worker ledger subprocess is unavailable; the worker Node cannot reach the local ledger. " +
+                "The dispatched conductor Node runtime is missing or invalid — conductor worker coordination is degraded; core tools are unaffected.",
+            details: { env_var: error.envVar, reason: error.reason },
+        };
+    }
     if (error instanceof ConductorValidationError) {
         // Validation messages are conductor-authored and name the offending field,
         // never its value — but redact defensively so an adversarial/secret-bearing

package/build/conductor/event-accessors.js

@@ -161,6 +161,9 @@ const EVENT_PARSERS = {
     "spec_review.passed": parseSpecReview,
     "spec_review.changes_requested": parseSpecReview,
     "parse.triggered": parseEmpty,
+    // BAPI-527: parse-after-merge terminal markers (details-less typed payload).
+    "parse.succeeded": parseEmpty,
+    "parse.failed": parseEmpty,
 };
 // ---------------------------------------------------------------------------
 // Public accessors
@@ -193,20 +196,35 @@ export function getHeadSha(event) {
     return normalizeEventHeadSha(details.head_sha);
 }
 /**
- * Resolve the immutable {@link MergeActionIdentity} from a worker-scoped `gate.met`
- * event. Returns `null` unless the event is a `gate.met` carrying a complete PR
- * binding (repo, pr_number, head_sha, gate_name) and a non-empty `worker_id`.
- * Run-level or incomplete events yield `null`. Preserves the historical
- * `required_checks` dual path (top-level then nested `ci_check_status`) and never
- * throws. Branch-name fields, if present, are ignored.
+ * Read and normalize a PR number from the CANONICAL `event.data.details.pr_number`
+ * path only (BAPI-525). Returns a positive integer PR number or `null` for
+ * missing/non-object details or a malformed value. Fail-closed. Used by the
+ * dispatched-backstop's local-first PR binding resolver to bind a ticket's PR from
+ * ledger events (e.g. `gate.met`) that carry both `pr_number` and `head_sha`,
+ * before falling back to a `gh` lookup.
+ */
+export function getPrNumber(event) {
+    const details = getRawEventDetails(event);
+    if (!details)
+        return null;
+    return normalizePrNumber(details.pr_number);
+}
+/**
+ * Resolve the immutable {@link MergeActionIdentity} from a PR-bound `gate.met`
+ * event. The true merge identity is `(repo, pr_number, head_sha, gate_name)`;
+ * `worker_id` is attribution metadata only and is NOT required for identity
+ * extraction (BAPI-525 Change A). Returns `null` unless the event is a `gate.met`
+ * carrying a complete PR binding (repo, pr_number, head_sha, gate_name) — an
+ * incomplete PR binding remains fail-closed regardless of `worker_id`. A
+ * worker_id-less `gate.met` produced by the autonomous git-hook chain therefore
+ * yields the SAME non-null identity (and byte-identical `action_key`) as its
+ * worker-stamped twin. Preserves the historical `required_checks` dual path
+ * (top-level then nested `ci_check_status`) and never throws. Branch-name fields,
+ * if present, are ignored.
  */
 export function getMergeIdentity(event) {
     if (event.type !== "gate.met")
         return null;
-    // Worker scope is required — a run-level gate.met never binds a specific worker.
-    if (typeof event.worker_id !== "string" || event.worker_id.trim().length === 0) {
-        return null;
-    }
     const details = getEventDetails(event, "gate.met");
     if (details === null)
         return null;