@bridge_gpt/mcp-server 0.2.18 → 0.2.20

package/build/conductor/pr-ci-producer.js

@@ -23,6 +23,11 @@ async function _fetchGateConfigDefault(access) {
 }
 import { resolvePrHeadBinding } from "./pr-discovery.js";
 import { emitConductorEventIfNew } from "./producer-ledger.js";
+// In-process ledger writer — the DEFAULT emit sink for conductor-OWNED paths
+// (the CLI/supervisor/epic runtimes that legitimately own the better-sqlite3
+// load). The worker `wait_for_done_gate` MCP path injects a CLI-subprocess emitter
+// instead (BAPI-527) so the worker Node never loads the native binary.
+import { emitConductorEvent as emitConductorEventInProcess } from "./store.js";
 const PRODUCER_OBSERVED_VIA = "pr-ci-producer";
 /** Bounded wait constants, consistent with the existing wait_for_event pattern. */
 export const WAIT_FOR_GATE_TIMEOUT_MAX_MS = 120_000;
@@ -124,7 +129,15 @@ function defaultSleep(ms) {
  * resolved exactly once by the caller.
  */
 async function observeWithResolved(binding, access, gateConfig, deps) {
-    const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
+    // The event-WRITE sink defaults to the in-process store; the worker gate path
+    // injects a CLI-subprocess emitter (BAPI-527). When a caller supplies its own
+    // `emitIfNew` (e.g. unit tests / conductor-owned callers), that fully overrides
+    // this and the injected write sink is not consulted.
+    const emitConductorEventFn = deps.emitConductorEvent ?? emitConductorEventInProcess;
+    const emitIfNew = deps.emitIfNew ??
+        ((input, dimensions) => emitConductorEventIfNew(input, dimensions, {
+            emitEvent: emitConductorEventFn,
+        }));
     const pollCi = deps.pollCi ?? pollCiChecksForCommit;
     const now = deps.now ?? (() => new Date().toISOString());
     // Resolve run_id/worker_id for attribution. Env takes precedence; fall back
@@ -193,7 +206,9 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
     let reviewSnapshot = null;
     try {
         const reviewObservation = await observeReviewWithResolved(binding, access, gateConfig, {
-            emitIfNew: deps.emitIfNew ?? emitConductorEventIfNew,
+            // Reuse the resolved `emitIfNew` so review-state events emitted alongside CI
+            // route through the SAME (possibly CLI-subprocess) write sink (BAPI-527).
+            emitIfNew,
             env: deps.env,
         });
         reviewSnapshot = reviewObservation.snapshot;

package/build/conductor/producer-ledger.js

@@ -37,7 +37,7 @@ export function makeStableProducerEventId(dedupeKey) {
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 /** Heuristically detect a SQLite duplicate-id / UNIQUE constraint failure. */
-function isDuplicateConstraintError(error) {
+export function isDuplicateConstraintError(error) {
     if (!error || typeof error !== "object")
         return false;
     const code = error.code;

package/build/conductor/store.js

@@ -38,6 +38,68 @@ export class ConductorPersistenceUnavailableError extends Error {
         this.name = "ConductorPersistenceUnavailableError";
     }
 }
+/** The native module whose load status this store owns. */
+const LEDGER_NATIVE_MODULE_NAME = "better-sqlite3";
+/**
+ * Thrown when `better-sqlite3` is present but fails to LOAD for this Node runtime
+ * (ABI/`NODE_MODULE_VERSION` mismatch or a generic `dlopen` failure) — distinct
+ * from "module simply not installed", which stays on the base
+ * {@link ConductorPersistenceUnavailableError} (503) path. Subclassing the base
+ * keeps existing `instanceof`/name-based degradation working while carrying the
+ * structured, secret-free {@link ConductorNativeModuleLoadDetails}. The raw
+ * caught error, stack, path, and message are deliberately NOT stored on the
+ * public instance.
+ */
+export class ConductorNativeModuleLoadError extends ConductorPersistenceUnavailableError {
+    details;
+    failureKind;
+    constructor(failureKind, details) {
+        super("Conductor ledger native module failed to load for this Node runtime.");
+        this.name = "ConductorNativeModuleLoadError";
+        this.failureKind = failureKind;
+        this.details = details;
+    }
+}
+/** Build the allowlisted runtime details for the CURRENT process. */
+export function buildNativeModuleLoadDetails() {
+    return {
+        node_version: process.version,
+        node_modules_abi: process.versions.modules ?? "unknown",
+        module: LEDGER_NATIVE_MODULE_NAME,
+    };
+}
+/**
+ * Classify a caught `better-sqlite3` load failure. Inspects ONLY the error `code`
+ * and `message` locally; the raw text never leaves this helper.
+ *
+ *   - `MODULE_NOT_FOUND` / `ERR_MODULE_NOT_FOUND` -> base
+ *     {@link ConductorPersistenceUnavailableError} ("not installed", 503).
+ *   - `NODE_MODULE_VERSION` / "compiled against a different Node.js version" /
+ *     "module version mismatch" -> native-load `abi_mismatch`.
+ *   - `ERR_DLOPEN_FAILED` / generic `dlopen` -> native-load `dlopen_failed`.
+ *   - Anything else -> base {@link ConductorPersistenceUnavailableError}.
+ */
+export function classifyDatabaseModuleLoadFailure(error) {
+    const code = error && typeof error === "object" ? error.code : undefined;
+    const rawMessage = error && typeof error === "object" && typeof error.message === "string"
+        ? (error.message)
+        : "";
+    const lowered = rawMessage.toLowerCase();
+    if (code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND") {
+        return new ConductorPersistenceUnavailableError();
+    }
+    const isAbiMismatch = lowered.includes("node_module_version") ||
+        lowered.includes("compiled against a different node.js version") ||
+        lowered.includes("module version mismatch");
+    if (isAbiMismatch) {
+        return new ConductorNativeModuleLoadError("abi_mismatch", buildNativeModuleLoadDetails());
+    }
+    const isDlopen = code === "ERR_DLOPEN_FAILED" || lowered.includes("dlopen");
+    if (isDlopen) {
+        return new ConductorNativeModuleLoadError("dlopen_failed", buildNativeModuleLoadDetails());
+    }
+    return new ConductorPersistenceUnavailableError();
+}
 /**
  * Cached, concurrency-safe async loader for the optional `better-sqlite3` module.
  *
@@ -50,13 +112,21 @@ export class ConductorPersistenceUnavailableError extends Error {
  * warning is emitted exactly once and every subsequent call throws
  * {@link ConductorPersistenceUnavailableError} immediately, without re-attempting the
  * failing import on every Conductor operation.
+ *
+ * BAPI-526: the caught error is CLASSIFIED (not swallowed) into a TYPED failure —
+ * ABI/dlopen mismatches become {@link ConductorNativeModuleLoadError} carrying
+ * `node_version`/`node_modules_abi`, while "module not installed" stays the base
+ * {@link ConductorPersistenceUnavailableError}. That typed failure is cached and
+ * re-thrown on every later call so the classification is never lost.
  */
 let databaseModulePromise = null;
-let dbLoadDegraded = false;
+let dbLoadFailure = null;
+let dbLoadDiagnosticEmitted = false;
 async function getDatabaseModule() {
-    // Cached degraded state: never re-attempt a known-failing native import.
-    if (dbLoadDegraded) {
-        throw new ConductorPersistenceUnavailableError();
+    // Cached typed failure: never re-attempt a known-failing native import, and
+    // preserve the ABI/dlopen classification across every subsequent call.
+    if (dbLoadFailure) {
+        throw dbLoadFailure;
     }
     if (databaseModulePromise)
         return databaseModulePromise;
@@ -67,13 +137,25 @@ async function getDatabaseModule() {
             const ctor = (mod.default ?? mod);
             return ctor;
         }
-        catch {
-            if (!dbLoadDegraded) {
-                dbLoadDegraded = true;
-                console.error("[conductor] Conductor persistence is unavailable: the optional 'better-sqlite3' native module could not be loaded. " +
+        catch (err) {
+            const classified = classifyDatabaseModuleLoadFailure(err);
+            dbLoadFailure = classified;
+            // Drop the rejected promise so the typed `dbLoadFailure` above is the sole
+            // cached state (the rejected promise itself must not be the only record).
+            databaseModulePromise = null;
+            if (!dbLoadDiagnosticEmitted) {
+                dbLoadDiagnosticEmitted = true;
+                // Fixed, path-free, secret-free diagnostic: module name, current Node
+                // version, current ABI, and coarse failure kind ONLY. Never the raw
+                // dlopen path, stack, or caught message.
+                const kind = classified instanceof ConductorNativeModuleLoadError
+                    ? classified.failureKind
+                    : "unavailable";
+                console.error(`[conductor] ${LEDGER_NATIVE_MODULE_NAME} native module could not be loaded ` +
+                    `(node=${process.version} abi=${process.versions.modules ?? "unknown"} kind=${kind}). ` +
                     "Conductor coordination features are disabled for this session; core MCP tools are unaffected.");
             }
-            throw new ConductorPersistenceUnavailableError();
+            throw classified;
         }
     })();
     return databaseModulePromise;
@@ -183,11 +265,15 @@ export function resolveConductorStoreConfig(env = process.env) {
  * CHECK vocabulary. Bumped to 7 because the durable parse-after-merge fold adds
  * the `parse.triggered` event type to the same `events.type` CHECK vocabulary
  * (replacing the in-memory parse-wait map so stateless epic-tick invocations can
- * fold a merged ticket to `done`). Older ledgers stamped at a lower version are
- * rebuilt by {@link migrateConductorSchemaIfNeeded} so their CHECK clause accepts
- * the current taxonomy.
+ * fold a merged ticket to `done`). Bumped to 8 in BAPI-527 because the durable
+ * parse-after-merge TERMINAL fold adds the `parse.succeeded` and `parse.failed`
+ * event types to the same `events.type` CHECK vocabulary (so the stateless
+ * epic-tick can fold a merged ticket to `done` on terminal parse success and
+ * `blocked` on permanent parse failure directly from the ledger). Older ledgers
+ * stamped at a lower version are rebuilt by {@link migrateConductorSchemaIfNeeded}
+ * so their CHECK clause accepts the current taxonomy.
  */
-export const CURRENT_CONDUCTOR_SCHEMA_VERSION = 7;
+export const CURRENT_CONDUCTOR_SCHEMA_VERSION = 8;
 /** Render the taxonomy `CHECK (type IN (...))` clause from the single source of truth. */
 function buildTypeCheckClause() {
     const list = SEMANTIC_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
@@ -327,15 +413,15 @@ export function migrateConductorSchemaIfNeeded(db) {
         return;
     }
     const migrate = db.transaction(() => {
-        // Scratch table named for the current schema version (v4, BAPI-398) so the
-        // migration rebuild never reads as a stale pre-merge-taxonomy artifact.
-        db.exec(buildEventsTableSql("events_migrated_v5"));
-        db.exec(`INSERT INTO events_migrated_v5
+        // Scratch table named for the current schema version (v8, BAPI-527) so the
+        // migration rebuild never reads as a stale pre-parse-terminal-taxonomy artifact.
+        db.exec(buildEventsTableSql("events_migrated_v8"));
+        db.exec(`INSERT INTO events_migrated_v8
          (seq, id, source, type, subject, run_id, worker_id, producer, schema_version, time, data_json, confidence, observed_via, created_at)
        SELECT seq, id, source, type, subject, run_id, worker_id, producer, schema_version, time, data_json, confidence, observed_via, created_at
        FROM events`);
         db.exec("DROP TABLE events");
-        db.exec("ALTER TABLE events_migrated_v5 RENAME TO events");
+        db.exec("ALTER TABLE events_migrated_v8 RENAME TO events");
         db.exec(buildEventsIndexesSql());
         // Ensure auxiliary tables and their relay indexes exist on older ledgers too.
         db.exec(buildAuxiliaryTablesSql());
@@ -818,6 +904,56 @@ export async function upsertSupervisorProjection(input, config = resolveConducto
  * and network-home degradation. Never creates the DB, inserts a diagnostic
  * event, or mutates WAL/schema state.
  */
+/**
+ * Read-only probe of whether the ledger native binding actually loads for this
+ * Node runtime (BAPI-526). Reuses the lazy loader so it reflects the REAL load
+ * outcome, and NEVER opens the SQLite database, runs migrations, creates files,
+ * or emits events. On success reports `loads: true`; on a native-load failure
+ * reports the coarse `failure_kind` and marks the host degraded. All returned
+ * fields are secret-free and path-free.
+ */
+export async function inspectConductorLedgerNativeModuleLoad() {
+    const details = buildNativeModuleLoadDetails();
+    try {
+        await getDatabaseModule();
+        return {
+            module: details.module,
+            node_version: details.node_version,
+            node_modules_abi: details.node_modules_abi,
+            loads: true,
+            failure_kind: "none",
+            degraded: false,
+            warning: null,
+        };
+    }
+    catch (err) {
+        if (err instanceof ConductorNativeModuleLoadError) {
+            return {
+                ...err.details,
+                loads: false,
+                failure_kind: err.failureKind,
+                degraded: true,
+                warning: "better-sqlite3 failed to load for this Node runtime; conductor ledger operations are degraded.",
+            };
+        }
+        if (err instanceof ConductorPersistenceUnavailableError) {
+            return {
+                ...details,
+                loads: false,
+                failure_kind: "module_not_found",
+                degraded: true,
+                warning: "better-sqlite3 is not installed; conductor ledger operations are unavailable.",
+            };
+        }
+        return {
+            ...details,
+            loads: false,
+            failure_kind: "unknown",
+            degraded: true,
+            warning: "better-sqlite3 could not be loaded; conductor ledger operations are degraded.",
+        };
+    }
+}
 export async function doctorConductorLedger(config = resolveConductorStoreConfig()) {
     const health = getConductorPathHealth();
     const network = detectNetworkMountedHome();
@@ -825,6 +961,12 @@ export async function doctorConductorLedger(config = resolveConductorStoreConfig
     if (network.network_mounted && network.warning) {
         warnings.push(network.warning);
     }
+    // Read-only native-binding load probe (BAPI-526). Reflects the real lazy-loader
+    // outcome; never opens/creates/migrates the ledger.
+    const native_load = await inspectConductorLedgerNativeModuleLoad();
+    if (native_load.degraded && native_load.warning) {
+        warnings.push(native_load.warning);
+    }
     let schemaPresent = false;
     let journalMode = null;
     let eventCount = null;
@@ -873,6 +1015,7 @@ export async function doctorConductorLedger(config = resolveConductorStoreConfig
         message_relay: {
             message_cooldown_ms: config.message_cooldown_ms,
         },
+        native_load,
         degraded: network.network_mounted,
         warnings,
     };

package/build/conductor/supervisor-merge.js

@@ -1,9 +1,15 @@
 /**
  * Supervisor merge pipeline wrapper (Conductor C6, BAPI-398).
  *
- * Processes an eligible worker-scoped `gate.met` event by calling the API-owned
- * merge decision/execution endpoint and recording the returned `merge.*` ledger
- * events into the LOCAL conductor ledger. This module:
+ * Processes an eligible PR-bound `gate.met` event by calling the API-owned merge
+ * decision/execution endpoint and recording the returned `merge.*` ledger events
+ * into the LOCAL conductor ledger. The merge decision depends ONLY on the PR/gate
+ * identity `(repo, pr_number, head_sha, gate)` — `worker_id` is attribution
+ * metadata that is stamped onto the emitted `merge.*` events for audit but never
+ * gates the merge (BAPI-525 Change A). When the source `gate.met` lacks a
+ * `worker_id` (e.g. the autonomous git-hook chain), attribution is resolved from
+ * durable dispatch state via an optional `resolveWorkerIdForGateEvent` seam. This
+ * module:
  *
  *   - never performs a provider merge locally and never handles VCS write
  *     credentials (no `gh`, no GITHUB_TOKEN, no installation token, no shell-out),
@@ -52,6 +58,24 @@ function mapApiErrorReason(error) {
     }
     return "api_network";
 }
+/**
+ * Resolve the worker attribution stamped onto emitted `merge.*` ledger events for
+ * a `gate.met`. Precedence: (1) a non-empty `event.worker_id`, (2) the durable
+ * attribution seam, (3) `null`. Attribution is audit-only and is never required
+ * for the merge decision (BAPI-525 Change A).
+ */
+function resolveAttributionWorkerId(event, identity, resolve) {
+    if (typeof event.worker_id === "string" && event.worker_id.trim().length > 0) {
+        return event.worker_id.trim();
+    }
+    if (resolve) {
+        const resolved = resolve(event, identity);
+        if (typeof resolved === "string" && resolved.trim().length > 0) {
+            return resolved.trim();
+        }
+    }
+    return null;
+}
 /**
  * Process an eligible `gate.met` event end-to-end: terminal-success short-circuit,
  * API merge call, ordered ledger recording, and sanitized error handling. Never
@@ -68,6 +92,9 @@ export async function processGateMetMerge(access, event, deps = {}) {
         return { processed: false, reason: "ineligible" };
     }
     const actionKey = identity.action_key;
+    // Attribution only — resolved from the event or durable dispatch state, never a
+    // merge gate (BAPI-525 Change A). A null value is tolerated end-to-end.
+    const attributionWorkerId = resolveAttributionWorkerId(event, identity, deps.resolveWorkerIdForGateEvent);
     // Terminal-success short-circuit BEFORE any API call (idempotent across restart).
     if (await checkTerminal(actionKey)) {
         return { processed: false, reason: "already_succeeded" };
@@ -92,7 +119,7 @@ export async function processGateMetMerge(access, event, deps = {}) {
             reason,
             details: baseDetails,
             run_id: event.run_id ?? null,
-            worker_id: event.worker_id ?? null,
+            worker_id: attributionWorkerId,
             summary: `merge.failed ${reason}`,
         }, { emitEvent: deps.emitEvent });
         return { processed: true, outcome: "api_error", reason };
@@ -119,7 +146,7 @@ export async function processGateMetMerge(access, event, deps = {}) {
             reason: ledgerEvent.reason ?? null,
             details: ledgerEvent.details ?? baseDetails,
             run_id: event.run_id ?? null,
-            worker_id: event.worker_id ?? null,
+            worker_id: attributionWorkerId,
         }, { emitEvent: deps.emitEvent });
         emitted.push({ type: ledgerEvent.type, emitted: result.emitted });
     }

package/build/conductor/taxonomy.js

@@ -51,6 +51,14 @@ export const SEMANTIC_EVENT_TYPES = [
     // post-merge repository re-index, so the (stateless) reconcile loop can fold a
     // merged ticket to `done` from the ledger instead of an in-memory wait map.
     "parse.triggered",
+    // BAPI-527: durable parse-after-merge TERMINAL markers. Emitted by epic-tick
+    // once the durable `/jira/parse-status` surface reports a terminal outcome for a
+    // triggered post-merge parse: `parse.succeeded` lets the merge.succeeded signal
+    // proceed to `done`; `parse.failed` folds the ticket to `blocked` (and escalates).
+    // Payloads are compact (summary/status/reason/details with epic_key + ticket_key
+    // + bounded parse error metadata) — never subprocess stdout/stderr/stacks/commands.
+    "parse.succeeded",
+    "parse.failed",
 ];
 /**
  * Type guard: returns `true` only when `value` is one of the exact taxonomy

package/build/conductor/tools.js

@@ -11,9 +11,14 @@
 import { z } from "zod";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
 import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
-import { emitConductorEvent, pollConductorEvents, waitForConductorEvent, getSupervisorSnapshot, sendWorkerMessage, checkWorkerMessages, } from "./store.js";
+import { emitConductorEvent, pollConductorEvents, waitForConductorEvent, getSupervisorSnapshot, sendWorkerMessage, } from "./store.js";
 import { normalizePrNumber, normalizeSha } from "./git-ci-types.js";
 import { waitForDoneGate, resolveDispatchRunIdForBinding } from "./pr-ci-producer.js";
+// BAPI-527: worker-facing ledger operations run through the conductor CLI
+// subprocess (under the captured conductor Node), NOT the in-process SQLite store,
+// so the worker Node never loads the `better-sqlite3` native binary. `store.ts`'s
+// `checkWorkerMessages` is intentionally NOT imported here anymore.
+import { checkWorkerMessagesViaCli, emitConductorEventIfNewViaCli } from "./worker-ledger-cli.js";
 import { resolveConductorBridgeApiAccess, fetchEpicRunState, ConductorBridgeApiError } from "./bridge-api-client.js";
 /** Build a Zod enum from the semantic taxonomy so arbitrary types are rejected up front. */
 export function buildEventTypeZodEnum() {
@@ -37,7 +42,10 @@ function jsonResult(value) {
 /**
  * Wrap a tool handler so any thrown value becomes a sanitized structured JSON
  * error envelope (validation -> 400, store-busy -> 503, otherwise 500). Raw
- * input data, stack traces, and secret material are never echoed back.
+ * input data, stack traces, and secret material are never echoed back. Any
+ * allowlisted structured `details` on the envelope (e.g. the BAPI-526
+ * LEDGER_NATIVE_MODULE_LOAD_FAILED node_version/ABI/module fields) is preserved
+ * through {@link jsonResult}'s pretty serialization unchanged.
  */
 export function withConductorToolErrorHandling(handler) {
     return async (args) => {
@@ -249,7 +257,17 @@ function registerWaitForDoneGateTool(registerTool) {
             timeoutMs: args.timeout_ms,
             pollIntervalMs: args.poll_interval_ms,
             worktreePath: args.worktree_path,
-        }, { resolveRunId: resolveDispatchRunIdForBinding });
+        }, {
+            resolveRunId: resolveDispatchRunIdForBinding,
+            // BAPI-527: route the gate's ENTIRE dedup+emit through the conductor CLI
+            // subprocess. Injecting `emitIfNew` (not just the write sink) replaces the
+            // in-process `emitConductorEventIfNew`, whose `eventAlreadyExists` poll
+            // pre-check would load better-sqlite3 in the worker Node. The dedupe key +
+            // deterministic id are derived purely and the id is forwarded to the CLI,
+            // so dedup happens server-side on the events.id UNIQUE constraint — the
+            // worker path performs NO in-process ledger read or write.
+            emitIfNew: (input, dimensions) => emitConductorEventIfNewViaCli(input, dimensions),
+        });
         return jsonResult({
             gate_met: result.gate_met,
             timed_out: result.timed_out,
@@ -338,9 +356,13 @@ function registerCheckMessagesTool(registerTool) {
         if (runId.trim().length === 0 || workerId.trim().length === 0) {
             throw new ConductorValidationError("Conductor worker identity is unavailable: provide run_id + worker_id, or set BAPI_CONDUCTOR_RUN_ID and BAPI_CONDUCTOR_WORKER_ID.");
         }
-        const result = await checkWorkerMessages({
-            run_id: runId,
-            worker_id: workerId,
+        // BAPI-527: read+ack through the conductor CLI subprocess (captured
+        // conductor Node), NOT the in-process store, so the worker Node never loads
+        // better-sqlite3. A missing/invalid CONDUCTOR_NODE_PATH surfaces as the
+        // typed LEDGER_SUBPROCESS_RUNTIME_UNAVAILABLE envelope via the wrapper below.
+        const result = await checkWorkerMessagesViaCli({
+            runId,
+            workerId,
             limit: args.limit,
         });
         return jsonResult(result);