@bridge_gpt/mcp-server 0.2.19 → 0.2.21

package/build/sfcc/writes-system-object.js

@@ -0,0 +1,348 @@
+/**
+ * SFCC system-object metadata write tools (BAPI-583).
+ *
+ * Live OCAPI write surface mirroring `reads-system-object.ts`. Implements six
+ * sandbox-only write operations:
+ *   system_object_attribute_definition_create — PUT   /system_object_definitions/{type}/attribute_definitions/{id}
+ *   system_object_attribute_definition_update — PATCH /system_object_definitions/{type}/attribute_definitions/{id}
+ *   system_object_attribute_group_create      — PUT   /system_object_definitions/{type}/attribute_groups/{id}
+ *   system_object_attribute_group_update      — PATCH /system_object_definitions/{type}/attribute_groups/{id}
+ *   system_object_attribute_assign_to_group   — PUT   /system_object_definitions/{type}/attribute_groups/{group}/attribute_definitions/{def}
+ *   custom_preference_definition_create        — PUT   /system_object_definitions/{SitePreferences|OrganizationPreferences}/attribute_definitions/{id}
+ *
+ * Every handler follows the BAPI-582 foundation write recipe: parse inputs →
+ * `rejectIfNotSandboxForWrite` → build a decoupled payload → `ocapiPut`/`ocapiPatch`
+ * → `formatOcapiWriteToolResult` (which echoes the OCAPI write-grant JSON on 403).
+ */
+import { z } from "zod";
+import { ocapiPut, ocapiPatch } from "./client.js";
+import { withSfccGate } from "./tool-wrapper.js";
+import { rejectIfNotSandboxForWrite } from "./write-guard.js";
+import { formatOcapiWriteToolResult } from "./write-result.js";
+import { objectAttributeDefinitionCreateBodySchema, objectAttributeDefinitionPatchBodySchema, attributeGroupPatchBodySchema, localizedStringSchema, SfccWritePayloadFault, buildObjectAttributeDefinitionCreatePayload, buildObjectAttributeDefinitionPatchPayload, buildAttributeGroupPutPayload, buildAttributeGroupPatchPayload, buildEmptyRelationPayload, } from "./writes-system-object-payloads.js";
+// ---------------------------------------------------------------------------
+// Annotations (destructive OCAPI writes against a developer sandbox)
+// ---------------------------------------------------------------------------
+const WRITE_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+function textResult(text) {
+    return { content: [{ type: "text", text }] };
+}
+/** Safe 400 envelope for a Zod validation failure — no stacks, no raw thrown strings. */
+function zodValidationEnvelope(err) {
+    return textResult(JSON.stringify({
+        error: "VALIDATION_ERROR",
+        status: 400,
+        message: "Invalid SFCC write tool input.",
+        issues: err.issues,
+    }));
+}
+/** Safe 400 envelope for a local payload-shape fault, in OCAPI-fault vocabulary. */
+function payloadFaultEnvelope(fault) {
+    return textResult(JSON.stringify({
+        error: "OCAPI_WRITE_ERROR",
+        status: fault.status,
+        fault: { type: fault.faultType, message: fault.message },
+    }));
+}
+/** Safe 500 envelope — never includes stacks, secrets, headers, or raw error text. */
+function unexpectedEnvelope() {
+    return textResult(JSON.stringify({
+        error: "INTERNAL_ERROR",
+        status: 500,
+        message: "Unexpected SFCC write tool failure",
+    }));
+}
+/** Map a pre-transport error (parse or payload-build) to its safe envelope. */
+function preTransportErrorEnvelope(err) {
+    if (err instanceof z.ZodError)
+        return zodValidationEnvelope(err);
+    if (err instanceof SfccWritePayloadFault)
+        return payloadFaultEnvelope(err);
+    return unexpectedEnvelope();
+}
+// ---------------------------------------------------------------------------
+// OCAPI path builders (every dynamic segment URL-encoded)
+// ---------------------------------------------------------------------------
+function encodedSegment(segment) {
+    return encodeURIComponent(segment);
+}
+function attributeDefinitionPath(objectType, attributeId) {
+    return `/system_object_definitions/${encodedSegment(objectType)}/attribute_definitions/${encodedSegment(attributeId)}`;
+}
+function attributeGroupPath(objectType, groupId) {
+    return `/system_object_definitions/${encodedSegment(objectType)}/attribute_groups/${encodedSegment(groupId)}`;
+}
+function attributeGroupAssignmentPath(objectType, groupId, attributeId) {
+    return (`/system_object_definitions/${encodedSegment(objectType)}` +
+        `/attribute_groups/${encodedSegment(groupId)}` +
+        `/attribute_definitions/${encodedSegment(attributeId)}`);
+}
+/** Map a preference scope to the OCAPI system object that backs preference attributes. */
+function preferenceObjectTypeForScope(scope) {
+    return scope === "site" ? "SitePreferences" : "OrganizationPreferences";
+}
+// ---------------------------------------------------------------------------
+// Input schemas
+// ---------------------------------------------------------------------------
+/** Optional sandbox instance context. Writes are sandbox-only (see write-guard). */
+const instanceSchema = z
+    .string()
+    .optional()
+    .describe("Sandbox-only: omit (defaults to sandbox) or pass \"sandbox\".");
+const createAttributeDefinitionInput = z.object({
+    object_type: z.string().describe("System object type, e.g. \"Product\"."),
+    attribute_id: z.string().describe("Attribute id (URL id); the body id must match it."),
+    definition: objectAttributeDefinitionCreateBodySchema.describe("OCAPI ObjectAttributeDefinition create body (requires value_type)."),
+    instance: instanceSchema,
+});
+const updateAttributeDefinitionInput = z.object({
+    object_type: z.string().describe("System object type."),
+    attribute_id: z.string().describe("Attribute id (URL id)."),
+    patch: objectAttributeDefinitionPatchBodySchema.describe("Partial ObjectAttributeDefinition body (>=1 field)."),
+    instance: instanceSchema,
+});
+const createAttributeGroupInput = z.object({
+    object_type: z.string().describe("System object type."),
+    group_id: z.string().describe("Attribute group id (URL id)."),
+    display_name: localizedStringSchema.describe("Localized group display name."),
+    internal: z.boolean().describe("Whether the group is internal (BM-only)."),
+    instance: instanceSchema,
+});
+const updateAttributeGroupInput = z.object({
+    object_type: z.string().describe("System object type."),
+    group_id: z.string().describe("Attribute group id (URL id)."),
+    patch: attributeGroupPatchBodySchema.describe("Partial group body (display_name and/or internal; >=1 field)."),
+    instance: instanceSchema,
+});
+const assignAttributeToGroupInput = z.object({
+    object_type: z.string().describe("System object type."),
+    group_id: z.string().describe("Attribute group id."),
+    attribute_id: z.string().describe("Attribute definition id to assign."),
+    instance: instanceSchema,
+});
+const createCustomPreferenceDefinitionInput = z.object({
+    preference_scope: z
+        .enum(["site", "organization"])
+        .describe("site → SitePreferences; organization → OrganizationPreferences."),
+    preference_id: z.string().describe("Preference (attribute) id."),
+    definition: objectAttributeDefinitionCreateBodySchema.describe("OCAPI ObjectAttributeDefinition create body (requires value_type). " +
+        "Set default_value for booleans (else they resolve to null)."),
+    instance: instanceSchema,
+});
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+function buildCreateAttributeDefinitionHandler(gateDeps) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        let path;
+        let body;
+        try {
+            const parsed = createAttributeDefinitionInput.parse(args);
+            const guard = rejectIfNotSandboxForWrite(parsed.instance);
+            if (guard)
+                return guard;
+            path = attributeDefinitionPath(parsed.object_type, parsed.attribute_id);
+            body = buildObjectAttributeDefinitionCreatePayload(parsed.attribute_id, parsed.definition);
+        }
+        catch (err) {
+            return preTransportErrorEnvelope(err);
+        }
+        try {
+            const result = await ocapiPut(path, body, credentials);
+            return formatOcapiWriteToolResult(result, "PUT", path);
+        }
+        catch {
+            return unexpectedEnvelope();
+        }
+    });
+}
+function buildUpdateAttributeDefinitionHandler(gateDeps) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        let path;
+        let body;
+        try {
+            const parsed = updateAttributeDefinitionInput.parse(args);
+            const guard = rejectIfNotSandboxForWrite(parsed.instance);
+            if (guard)
+                return guard;
+            path = attributeDefinitionPath(parsed.object_type, parsed.attribute_id);
+            body = buildObjectAttributeDefinitionPatchPayload(parsed.attribute_id, parsed.patch);
+        }
+        catch (err) {
+            return preTransportErrorEnvelope(err);
+        }
+        try {
+            // ocapiPatch performs the GET-then-If-Match round trip; 409/412 flow
+            // back through formatOcapiWriteToolResult rather than becoming generic errors.
+            const result = await ocapiPatch(path, body, credentials);
+            return formatOcapiWriteToolResult(result, "PATCH", path);
+        }
+        catch {
+            return unexpectedEnvelope();
+        }
+    });
+}
+function buildCreateAttributeGroupHandler(gateDeps) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        let path;
+        let body;
+        try {
+            const parsed = createAttributeGroupInput.parse(args);
+            const guard = rejectIfNotSandboxForWrite(parsed.instance);
+            if (guard)
+                return guard;
+            path = attributeGroupPath(parsed.object_type, parsed.group_id);
+            body = buildAttributeGroupPutPayload({
+                display_name: parsed.display_name,
+                internal: parsed.internal,
+            });
+        }
+        catch (err) {
+            return preTransportErrorEnvelope(err);
+        }
+        try {
+            const result = await ocapiPut(path, body, credentials);
+            return formatOcapiWriteToolResult(result, "PUT", path);
+        }
+        catch {
+            return unexpectedEnvelope();
+        }
+    });
+}
+function buildUpdateAttributeGroupHandler(gateDeps) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        let path;
+        let body;
+        try {
+            const parsed = updateAttributeGroupInput.parse(args);
+            const guard = rejectIfNotSandboxForWrite(parsed.instance);
+            if (guard)
+                return guard;
+            path = attributeGroupPath(parsed.object_type, parsed.group_id);
+            body = buildAttributeGroupPatchPayload(parsed.patch);
+        }
+        catch (err) {
+            return preTransportErrorEnvelope(err);
+        }
+        try {
+            const result = await ocapiPatch(path, body, credentials);
+            return formatOcapiWriteToolResult(result, "PATCH", path);
+        }
+        catch {
+            return unexpectedEnvelope();
+        }
+    });
+}
+function buildAssignAttributeToGroupHandler(gateDeps) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        let path;
+        try {
+            const parsed = assignAttributeToGroupInput.parse(args);
+            const guard = rejectIfNotSandboxForWrite(parsed.instance);
+            if (guard)
+                return guard;
+            path = attributeGroupAssignmentPath(parsed.object_type, parsed.group_id, parsed.attribute_id);
+        }
+        catch (err) {
+            return preTransportErrorEnvelope(err);
+        }
+        try {
+            const result = await ocapiPut(path, buildEmptyRelationPayload(), credentials);
+            return formatOcapiWriteToolResult(result, "PUT", path);
+        }
+        catch {
+            return unexpectedEnvelope();
+        }
+    });
+}
+function buildCreateCustomPreferenceDefinitionHandler(gateDeps) {
+    return withSfccGate(gateDeps, async (args, credentials) => {
+        let path;
+        let body;
+        try {
+            const parsed = createCustomPreferenceDefinitionInput.parse(args);
+            const guard = rejectIfNotSandboxForWrite(parsed.instance);
+            if (guard)
+                return guard;
+            const objectType = preferenceObjectTypeForScope(parsed.preference_scope);
+            path = attributeDefinitionPath(objectType, parsed.preference_id);
+            body = buildObjectAttributeDefinitionCreatePayload(parsed.preference_id, parsed.definition);
+        }
+        catch (err) {
+            return preTransportErrorEnvelope(err);
+        }
+        try {
+            const result = await ocapiPut(path, body, credentials);
+            return formatOcapiWriteToolResult(result, "PUT", path);
+        }
+        catch {
+            return unexpectedEnvelope();
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+/** Concrete write tool names registered by this module. */
+export const SYSTEM_OBJECT_WRITE_TOOL_NAMES = [
+    "system_object_attribute_definition_create",
+    "system_object_attribute_definition_update",
+    "system_object_attribute_group_create",
+    "system_object_attribute_group_update",
+    "system_object_attribute_assign_to_group",
+    "custom_preference_definition_create",
+];
+/**
+ * Register the six SFCC system-object write tools. Called from the write seam
+ * (`registerSfccWriteTools` in writes.ts) — no direct `register.ts`/`index.ts` edits.
+ */
+export function registerSystemObjectWriteTools(registerTool, deps) {
+    const { gateDeps } = deps;
+    registerTool("system_object_attribute_definition_create", {
+        description: "Create a system-object attribute definition (sandbox-only, destructive). " +
+            "PUT .../attribute_definitions/{id}; body id must equal URL id and system must be false. " +
+            "Returns 201. HTTP 403 echoes the OCAPI write-grant JSON.",
+        inputSchema: createAttributeDefinitionInput,
+        annotations: WRITE_ANNOTATIONS,
+    }, buildCreateAttributeDefinitionHandler(gateDeps));
+    registerTool("system_object_attribute_definition_update", {
+        description: "Update a system-object attribute definition (sandbox-only, destructive). " +
+            "PATCH .../attribute_definitions/{id} via the ETag GET-then-If-Match round trip. " +
+            "Returns 200; surfaces 409/412 on ETag conflicts. HTTP 403 echoes the write-grant JSON.",
+        inputSchema: updateAttributeDefinitionInput,
+        annotations: WRITE_ANNOTATIONS,
+    }, buildUpdateAttributeDefinitionHandler(gateDeps));
+    registerTool("system_object_attribute_group_create", {
+        description: "Create a system-object attribute group (sandbox-only, destructive). " +
+            "PUT .../attribute_groups/{id} with a minimal body (display_name + internal). " +
+            "HTTP 403 echoes the OCAPI write-grant JSON.",
+        inputSchema: createAttributeGroupInput,
+        annotations: WRITE_ANNOTATIONS,
+    }, buildCreateAttributeGroupHandler(gateDeps));
+    registerTool("system_object_attribute_group_update", {
+        description: "Update a system-object attribute group (sandbox-only, destructive). " +
+            "PATCH .../attribute_groups/{id} via the ETag round trip (display_name and/or internal). " +
+            "HTTP 403 echoes the OCAPI write-grant JSON.",
+        inputSchema: updateAttributeGroupInput,
+        annotations: WRITE_ANNOTATIONS,
+    }, buildUpdateAttributeGroupHandler(gateDeps));
+    registerTool("system_object_attribute_assign_to_group", {
+        description: "Assign an attribute definition to an attribute group (sandbox-only, destructive). " +
+            "PUT .../attribute_groups/{group}/attribute_definitions/{def} with an empty body. " +
+            "HTTP 403 echoes the OCAPI write-grant JSON.",
+        inputSchema: assignAttributeToGroupInput,
+        annotations: WRITE_ANNOTATIONS,
+    }, buildAssignAttributeToGroupHandler(gateDeps));
+    registerTool("custom_preference_definition_create", {
+        description: "Create a custom preference definition (sandbox-only, destructive). " +
+            "PUT .../{SitePreferences|OrganizationPreferences}/attribute_definitions/{id}. " +
+            "Booleans resolve to null unless default_value is set. HTTP 403 echoes the write-grant JSON.",
+        inputSchema: createCustomPreferenceDefinitionInput,
+        annotations: WRITE_ANNOTATIONS,
+    }, buildCreateCustomPreferenceDefinitionHandler(gateDeps));
+}

package/build/sfcc/writes.js

@@ -0,0 +1,66 @@
+/**
+ * SFCC write-tool registration aggregator (BAPI-581 / BAPI-582 foundation,
+ * populated by BAPI-584).
+ *
+ * This is the registration seam that write-surface tickets register through.
+ * `register.ts` wires this behind the existing `includeReadTools` SFCC gate, so
+ * the write tools become default-on with the reads without touching
+ * `register.ts` or `index.ts`.
+ *
+ * Each write handler follows the foundation recipe:
+ *   1. Parse inputs.
+ *   2. Call `rejectIfNotSandboxForWrite` (write-guard.ts) BEFORE payload
+ *      construction or any OCAPI mutation.
+ *   3. Build the SFCC payload in a tool-specific payload helper.
+ *   4. Call `ocapiPut` / `ocapiPatch` / `ocapiPatchDirect` (client.ts).
+ *   5. Route the result through `formatOcapiWriteToolResult` (write-result.ts).
+ */
+import { registerSystemObjectWriteTools, SYSTEM_OBJECT_WRITE_TOOL_NAMES, } from "./writes-system-object.js";
+import { registerSfccCustomObjectDefWriteTools, CUSTOM_OBJECT_DEF_WRITE_TOOL_NAMES, } from "./writes-custom-object-def.js";
+import { registerSitePreferenceWriteTools, SITE_PREFERENCE_WRITE_TOOL_NAMES, } from "./writes-site-preference.js";
+// ---------------------------------------------------------------------------
+// Tool name registry
+// ---------------------------------------------------------------------------
+/**
+ * Write tool names registered by this seam (centralized inventory). Extended by
+ * each write-surface ticket — BAPI-583 adds the six system-object write tools,
+ * BAPI-584 adds the custom-object attribute-definition and site-preference value
+ * write tools.
+ */
+export const SFCC_WRITE_TOOL_NAMES = [
+    ...SYSTEM_OBJECT_WRITE_TOOL_NAMES,
+    ...CUSTOM_OBJECT_DEF_WRITE_TOOL_NAMES,
+    ...SITE_PREFERENCE_WRITE_TOOL_NAMES,
+];
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+/**
+ * Register all SFCC write tools through the host's registerTool wrapper.
+ *
+ * Registration is delegated to per-surface write modules. Each write handler
+ * MUST:
+ *   1. Parse inputs.
+ *   2. Call `rejectIfNotSandboxForWrite` (write-guard.ts) BEFORE payload
+ *      construction or any OCAPI mutation.
+ *   3. Build the SFCC payload in a tool-specific payload helper.
+ *   4. Call `ocapiPut` or `ocapiPatch` (client.ts) for transport.
+ *   5. Route the result through `formatOcapiWriteToolResult` (write-result.ts).
+ *
+ * Each handler is additionally call-time gated by `withSfccGate` and
+ * sandbox-guarded, so registering them here (default-on with the reads) does
+ * not weaken the per-call safety model.
+ *
+ * BAPI-583 registers the system-object write surface here; BAPI-584 adds the
+ * custom-object attribute-definition and site-preference value write surfaces
+ * alongside it. Later write-surface tickets add their modules the same way,
+ * without touching `register.ts`/`index.ts`.
+ */
+export function registerSfccWriteTools(registerTool, deps) {
+    // System-object attribute/group definition writes (BAPI-583).
+    registerSystemObjectWriteTools(registerTool, { gateDeps: deps.gateDeps });
+    // Custom-object attribute-definition create/update (PUT / ETag-PATCH).
+    registerSfccCustomObjectDefWriteTools(registerTool, { gateDeps: deps.gateDeps });
+    // Site-preference value set (direct PATCH of a flat c_ map).
+    registerSitePreferenceWriteTools(registerTool, { gateDeps: deps.gateDeps });
+}

package/build/version.generated.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.19";
+export const VERSION = "0.2.21";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -27,8 +27,8 @@
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "postbuild": "node scripts/prepend-shebang.cjs",
     "start": "node build/index.js",
-    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js",
-    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js",
+    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/local-merge.static.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/job-runner.merge.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/estimate-epic.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js build/sfcc/ocapi-write-faults.test.js build/sfcc/write-guard.test.js build/sfcc/write-grants.test.js build/sfcc/write-result.test.js build/sfcc/writes.test.js build/sfcc/writes-system-object-payloads.test.js build/sfcc/writes-payloads.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index.review-rounds.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/attachment-upload.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js build/sfcc/writes-system-object.test.js build/sfcc/writes-custom-object-def.test.js build/sfcc/writes-site-preference.test.js",
+    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"
   },

package/pipelines/idea-to-ticket.json

@@ -62,6 +62,13 @@
       "instruction_file": "frame-goals-and-nfrs.md",
       "description": "Frame business goals, desired end-state, and non-functional requirements (documentary)"
     },
+    {
+      "id": "comp-analysis",
+      "type": "agent_task",
+      "instruction_file": "comp-analysis.md",
+      "description": "Analyze any design comp and map it to existing codebase components/templates/tokens/routes (gated, backend-safe)",
+      "on_error": "warn_and_continue"
+    },
     {
       "type": "agent_task",
       "instruction_file": "draft-and-critique.md",

package/pipelines/review-ticket.json

@@ -1,7 +1,7 @@
 {
   "name": "review-ticket",
-  "description": "Review a ticket with two rounds of analysis (initial + automatic second opinion by default), evaluate suggestions for accuracy, and produce a combined review-and-resolution document with decision trees. The automatic second-opinion step is skippable via --rounds=1 mode (skip_steps: [\"second-opinion-review\"]).",
-  "variables": ["ticket_key", "docs_dir", "base_branch", "base_sha", "no_refresh_base"],
+  "description": "Review a ticket, evaluate suggestions for accuracy, and produce a combined review-and-resolution document with decision trees. A single request_ticket_review step runs the backend's resolved difficulty-adaptive review policy, which internally runs any second-opinion rounds server-side. Pass --rounds=1|2 to forward an explicit round count that forces the review shape (1 = single pass, 2 = full second-opinion review); omit it to let the backend policy executor decide adaptively.",
+  "variables": ["ticket_key", "docs_dir", "base_branch", "base_sha", "no_refresh_base", "rounds"],
   "steps": [
     {
       "type": "mcp_call",
@@ -16,23 +16,10 @@
         "ticket_number": "{ticket_key}",
         "wait_for_result": true,
         "save_locally": true,
-        "provider": "{provider}"
+        "provider": "{provider}",
+        "rounds": "{rounds}"
       },
-      "description": "Generate combined clarify+critique review (initial)",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "second-opinion-review",
-      "tool": "request_ticket_review",
-      "params": {
-        "ticket_number": "{ticket_key}",
-        "second_opinion": "auto",
-        "wait_for_result": true,
-        "save_locally": true,
-        "provider": "{provider}"
-      },
-      "description": "Generate combined clarify+critique review (second opinion)",
+      "description": "Generate combined clarify+critique review. The backend runs the resolved difficulty-adaptive policy (including any second-opinion rounds) server-side; an explicit rounds value (1|2) forces the shape.",
       "on_error": "warn_and_continue"
     },
     {