@bridge_gpt/mcp-server 0.2.33 → 0.2.36

package/build/conductor/bridge-api-client.js

@@ -101,11 +101,38 @@ function boundedErrorPreview(text) {
         ? `${redacted.slice(0, CONDUCTOR_ERROR_PREVIEW_MAX)}…`
         : redacted;
 }
+/** Max number of FastAPI `loc` components rendered into a diagnostic path. */
+const CONDUCTOR_VALIDATION_LOC_MAX_PARTS = 8;
+/**
+ * Render a FastAPI validation item (`{ loc, msg }`) as `path: message`.
+ *
+ * Returns `undefined` for any malformed item so the caller falls through to the
+ * existing generic handling rather than emitting `[object Object]`.
+ */
+function formatValidationDetailItem(item) {
+    if (!item || typeof item !== "object")
+        return undefined;
+    const record = item;
+    const msg = record["msg"];
+    if (typeof msg !== "string" || !msg.trim())
+        return undefined;
+    const loc = record["loc"];
+    const parts = Array.isArray(loc)
+        ? loc.filter((part) => typeof part === "string" || typeof part === "number")
+        : [];
+    // Drop FastAPI's leading transport-only "body" component — the operator cares
+    // about `policy_json.job_timeout`, not where in the request it lived.
+    const scoped = parts[0] === "body" ? parts.slice(1) : parts;
+    const path = scoped.slice(0, CONDUCTOR_VALIDATION_LOC_MAX_PARTS).join(".");
+    return path ? `${path}: ${msg}` : msg;
+}
 /**
  * Extract sanitized diagnostics from a parsed backend error body. Recognizes the
  * FastAPI/backend shapes `{ detail: { error_code, message } }`,
- * `{ detail: "..." }`, and `{ error_code, message }`; any other shape yields a
- * bounded stringified preview. Never throws and never returns raw/unbounded text.
+ * `{ detail: "..." }`, `{ detail: [{ loc, msg, ... }] }` (FastAPI's native 422
+ * request-validation shape), and `{ error_code, message }`; any other shape
+ * yields a bounded stringified preview. Never throws and never returns
+ * raw/unbounded text.
  */
 export function extractSanitizedErrorDiagnostics(body) {
     if (typeof body === "string") {
@@ -119,7 +146,14 @@ export function extractSanitizedErrorDiagnostics(body) {
     const detail = record["detail"];
     let errorCode;
     let message;
-    if (detail && typeof detail === "object") {
+    if (Array.isArray(detail)) {
+        // FastAPI request-validation 422. Checked BEFORE the generic object branch
+        // because arrays are objects: without this the branch below would find no
+        // error_code/message and the operator would get an empty diagnostic for the
+        // one error class that names exactly which field they got wrong.
+        message = formatValidationDetailItem(detail[0]);
+    }
+    else if (detail && typeof detail === "object") {
         const d = detail;
         if (typeof d["error_code"] === "string")
             errorCode = d["error_code"];
@@ -951,6 +985,15 @@ export async function reconcileShadowMerge(access, request, fetchImpl = globalTh
  * authoritative commit-watermark verdict for one ready ticket. The caller treats
  * `covered`/`not_applicable` as dispatchable, `stale` as hold, and `failed` as a
  * terminal shadow failure (the backend has already persisted the blocked state).
+ *
+ * BAPI-678: `stale` now covers two backend situations, and deliberately does not
+ * distinguish them on the wire — ordinary unproven freshness, and a `failed`
+ * shadow lifecycle DOWNGRADED by the backend's `policy_json.shadow.warn_only`
+ * posture. Both mean exactly the same thing to this caller (hold, do not claim a
+ * dispatch key), which is why no new verdict was introduced. The backend also
+ * bounds the warn-only hold with its own stale deadline and parks the ticket if
+ * it expires, so a hold here is not unbounded even though nothing on this side
+ * tracks its age. See {@link ShadowFreshnessVerdict}.
  */
 export async function fetchShadowDispatchFreshness(access, request, fetchImpl = globalThis.fetch) {
     requireNonEmptyString(request.epicKey);
@@ -985,6 +1028,38 @@ export async function storeEpicPlan(access, request, fetchImpl = globalThis.fetc
     });
     return fetchConductorJsonPostWithTimeout(url, conductorPostHeaders(access), body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
 }
+/**
+ * PATCH one approved plan node's `ticket_spec` without re-storing or re-approving
+ * the plan (BAPI-722).
+ *
+ * This is how a ticket specification too large for Jira's 32,767-character
+ * description cap reaches the reviewer intact: it is stored on the approved plan
+ * node, which the reconciler already consults FIRST when resolving a spec-review
+ * prompt. Nothing else about the run changes — not the plan version, not the
+ * approval pointers, and not a single `epic_ticket_status` row — which is what
+ * makes it safe against a live epic.
+ *
+ * `expectedPlanHash` is the optimistic-concurrency token; a stale token on a real
+ * content change returns HTTP 409. The API key travels ONLY in the `X-API-Key`
+ * header, and neither the spec text nor any credential is ever incorporated into a
+ * thrown error message. Errors surface as a sanitized
+ * {@link ConductorBridgeApiError}.
+ */
+export async function updateApprovedPlanNodeTicketSpec(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicKey);
+    requireNonEmptyString(request.ticketKey);
+    requireNonEmptyString(request.expectedPlanHash);
+    requireNonEmptyString(request.ticketSpec);
+    const url = buildConductorJiraUrl(access.baseUrl, `${epicRunApiPath(request.epicKey)}/plan/nodes/` +
+        `${encodeURIComponent(request.ticketKey)}/ticket-spec`);
+    const body = JSON.stringify({
+        repo_name: access.repoName,
+        expected_plan_hash: request.expectedPlanHash,
+        ticket_spec: request.ticketSpec,
+    });
+    const parsed = await fetchConductorJsonPatchWithTimeout(url, conductorPostHeaders(access), body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parsed;
+}
 /**
  * Atomically approve a plan version. Bumps `epic_runs.approved_plan_hash` to
  * the named version's `plan_hash` in a single CAS write — never a
@@ -1169,3 +1244,177 @@ export async function transitionJiraStatus(access, ticketNumber, targetStatus =
         throw err;
     }
 }
+const READINESS_SOURCES = new Set(["epic", "project_default", "none"]);
+const ACTIONS_LEVELS = new Set(["write", "read", "none", "unknown"]);
+function readinessShapeError() {
+    // Deliberately carries NO field name, value, or payload excerpt: a malformed
+    // body is untrusted input and its contents must not reach output.
+    return new ConductorBridgeApiError("invalid-input", undefined, {
+        errorCode: "READINESS_SHAPE_INVALID",
+    });
+}
+function requireObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw readinessShapeError();
+    }
+    return value;
+}
+function requireBool(o, key) {
+    const v = o[key];
+    if (typeof v !== "boolean")
+        throw readinessShapeError();
+    return v;
+}
+function requireInt(o, key) {
+    const v = o[key];
+    if (typeof v !== "number" || !Number.isInteger(v))
+        throw readinessShapeError();
+    return v;
+}
+function requireNullableInt(o, key) {
+    const v = o[key];
+    if (v === null || v === undefined)
+        return null;
+    if (typeof v !== "number" || !Number.isInteger(v))
+        throw readinessShapeError();
+    return v;
+}
+function requireNullableString(o, key) {
+    const v = o[key];
+    if (v === null || v === undefined)
+        return null;
+    if (typeof v !== "string")
+        throw readinessShapeError();
+    return v;
+}
+function requireNullableBool(o, key) {
+    const v = o[key];
+    if (v === null || v === undefined)
+        return null;
+    if (typeof v !== "boolean")
+        throw readinessShapeError();
+    return v;
+}
+function requireEnum(o, key, allowed) {
+    const v = o[key];
+    if (typeof v !== "string" || !allowed.has(v))
+        throw readinessShapeError();
+    return v;
+}
+/**
+ * Validate a raw readiness body into the typed response, FAIL-CLOSED.
+ *
+ * Every field the composed doctor makes a safety decision on is checked for
+ * presence and exact type. This is not defensive nicety: a 200 whose body is
+ * missing `required_checks_empty`, or carries it as the string `"false"`, would
+ * otherwise be cast straight into an apparently-healthy report and the operator
+ * would be told a trivially-passing gate was fine.
+ */
+export function parseConductorReadinessResponse(body) {
+    const root = requireObject(body);
+    const repoName = root.repo_name;
+    if (typeof repoName !== "string" || repoName.length === 0)
+        throw readinessShapeError();
+    const sup = requireObject(root.supervisor);
+    const gh = requireObject(root.github);
+    const rec = requireObject(root.reconciler);
+    const exec = requireObject(root.executor);
+    const thr = requireObject(root.thresholds);
+    return {
+        repo_name: repoName,
+        supervisor: {
+            setup_present: requireBool(sup, "setup_present"),
+            setup_source: requireEnum(sup, "setup_source", READINESS_SOURCES),
+            setup_created_at: requireNullableString(sup, "setup_created_at"),
+            setup_updated_at: requireNullableString(sup, "setup_updated_at"),
+            config_present: requireBool(sup, "config_present"),
+            config_source: requireEnum(sup, "config_source", READINESS_SOURCES),
+            config_created_at: requireNullableString(sup, "config_created_at"),
+            config_updated_at: requireNullableString(sup, "config_updated_at"),
+            required_checks_count: requireInt(sup, "required_checks_count"),
+            required_checks_empty: requireBool(sup, "required_checks_empty"),
+            auto_merge_enabled: requireBool(sup, "auto_merge_enabled"),
+            merge_approval_required_set: requireBool(sup, "merge_approval_required_set"),
+        },
+        github: {
+            credentials_readable: requireBool(gh, "credentials_readable"),
+            owner_resolved: requireBool(gh, "owner_resolved"),
+            repo_id_resolved: requireBool(gh, "repo_id_resolved"),
+            installation_id_resolved: requireBool(gh, "installation_id_resolved"),
+            credentials_complete: requireBool(gh, "credentials_complete"),
+            actions_probe_succeeded: requireBool(gh, "actions_probe_succeeded"),
+            actions_permission_present: requireBool(gh, "actions_permission_present"),
+            actions_permission_level: requireEnum(gh, "actions_permission_level", ACTIONS_LEVELS),
+            actions_write: requireBool(gh, "actions_write"),
+        },
+        reconciler: {
+            liveness_readable: requireBool(rec, "liveness_readable"),
+            last_tick_at: requireNullableString(rec, "last_tick_at"),
+            last_tick_age_seconds: requireNullableInt(rec, "last_tick_age_seconds"),
+            stale: requireBool(rec, "stale"),
+            active_run_count: requireInt(rec, "active_run_count"),
+            expired_lease_count: requireInt(rec, "expired_lease_count"),
+        },
+        executor: {
+            liveness_readable: requireBool(exec, "liveness_readable"),
+            last_seen_at: requireNullableString(exec, "last_seen_at"),
+            last_seen_age_seconds: requireNullableInt(exec, "last_seen_age_seconds"),
+            ready: requireNullableBool(exec, "ready"),
+        },
+        thresholds: {
+            reconciler_stale_after_seconds: requireInt(thr, "reconciler_stale_after_seconds"),
+            executor_stale_after_seconds: requireInt(thr, "executor_stale_after_seconds"),
+        },
+    };
+}
+/**
+ * GET `/jira/epic-runs/conductor-readiness?repo_name=<repo>`.
+ *
+ * The API key travels ONLY in `X-API-Key`; `repo_name` is URL-encoded into the
+ * query string because the endpoint scopes on it. Fails closed on transport,
+ * auth, and shape errors alike.
+ */
+export async function fetchConductorReadiness(access, fetchImpl = globalThis.fetch) {
+    const url = buildConductorJiraUrl(access.baseUrl, `${EPIC_RUNS_API_PREFIX}/conductor-readiness`, {
+        repo_name: access.repoName,
+    });
+    const body = await fetchConductorJsonWithTimeout(url, conductorGetHeaders(access), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parseConductorReadinessResponse(body);
+}
+/** Validate a raw bootstrap body, fail-closed (see {@link parseConductorReadinessResponse}). */
+export function parseConductorSupervisorBootstrapResponse(body) {
+    const o = requireObject(body);
+    const repoName = o.repo_name;
+    if (typeof repoName !== "string" || repoName.length === 0)
+        throw readinessShapeError();
+    const names = o.audited_field_names;
+    if (!Array.isArray(names) || names.some((n) => typeof n !== "string")) {
+        throw readinessShapeError();
+    }
+    return {
+        repo_name: repoName,
+        setup_written: requireBool(o, "setup_written"),
+        config_written: requireBool(o, "config_written"),
+        setup_source: requireEnum(o, "setup_source", READINESS_SOURCES),
+        config_source: requireEnum(o, "config_source", READINESS_SOURCES),
+        setup_created_at: requireNullableString(o, "setup_created_at"),
+        setup_updated_at: requireNullableString(o, "setup_updated_at"),
+        config_created_at: requireNullableString(o, "config_created_at"),
+        config_updated_at: requireNullableString(o, "config_updated_at"),
+        required_checks_count: requireInt(o, "required_checks_count"),
+        audited_field_names: names,
+    };
+}
+/**
+ * POST `/jira/epic-runs/supervisor-bootstrap?repo_name=<repo>`.
+ *
+ * The ONLY write this client performs. Deliberately carries no `review_policy`
+ * field: repository-default review policy is owned by BAPI-694.
+ */
+export async function bootstrapConductorSupervisorDefaults(access, request, fetchImpl) {
+    const url = buildConductorJiraUrl(access.baseUrl, `${EPIC_RUNS_API_PREFIX}/supervisor-bootstrap`, {
+        repo_name: access.repoName,
+    });
+    const body = await fetchConductorJsonPostWithTimeout(url, conductorPostHeaders(access), JSON.stringify(request), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parseConductorSupervisorBootstrapResponse(body);
+}

package/build/conductor/deny-enforcement-preflight.js

@@ -47,6 +47,7 @@ export async function runDenyEnforcementPreflight(opts = {}) {
             const { result, layer } = await runDenyEnforcementCheck(ctx, {
                 model: opts.model,
                 timeoutMs: opts.timeoutMs,
+                permissionPosture: opts.permissionPosture,
             });
             if (result.status === "pass" && layer === "settings-deny") {
                 return {

package/build/conductor/done-gate.js

@@ -83,15 +83,49 @@ function parseCiChecksCondition(entry) {
     }
     return { type: REQUIRED_CI_CHECKS_GREEN, required_checks: normalized };
 }
-/** Valid review source values. */
-const VALID_REVIEW_SOURCES = new Set(["sticky_verdict", "native_review_decision", "min_approvals", "combination"]);
+/** Valid — i.e. CANONICAL — review source values (BAPI-689). */
+const VALID_REVIEW_SOURCES = new Set(["verdict_protocol", "native_review_decision", "min_approvals", "combination"]);
+/**
+ * Historical review-source spellings accepted on INPUT only.
+ *
+ * BAPI-689 unified three vocabularies onto one, but `done_gate_config` is
+ * free-form operator-authored JSONB that this module only ever reads — there is
+ * no migration that rewrites it. So already-stored configs keep naming the
+ * sticky-verdict source `sticky_verdict` (this module's own former spelling) or
+ * `claude_review_sticky` / `github_review_decision` (the former supervisor
+ * spellings), and they must stay readable.
+ *
+ * Mapping is applied at the parser seam and the CANONICAL value is what the
+ * parsed condition carries, so no alias survives into the config hash, the gate
+ * evaluator, or any serialized output.
+ */
+const REVIEW_SOURCE_ALIASES = Object.freeze({
+    sticky_verdict: "verdict_protocol",
+    claude_review_sticky: "verdict_protocol",
+    github_review_decision: "native_review_decision",
+});
+/**
+ * Canonicalize a raw stored review-source value.
+ *
+ * Returns the canonical spelling for a known alias, the value unchanged when it
+ * is already canonical, and the value unchanged when it is neither — so an
+ * unsupported spelling still reaches (and fails) `VALID_REVIEW_SOURCES` rather
+ * than being coerced into a default. Exact-match only: no case folding and no
+ * trimming, matching the strictness of every other field in this parser.
+ */
+function normalizeReviewSource(source) {
+    return REVIEW_SOURCE_ALIASES[source] ?? source;
+}
 /**
  * Parse and validate a single `review_state` condition entry.
  * Returns the normalized condition or `null` on any validation failure.
  */
 function parseReviewStateCondition(entry) {
-    const source = entry.source;
-    if (typeof source !== "string" || !VALID_REVIEW_SOURCES.has(source))
+    const rawSource = entry.source;
+    if (typeof rawSource !== "string")
+        return null;
+    const source = normalizeReviewSource(rawSource);
+    if (!VALID_REVIEW_SOURCES.has(source))
         return null;
     const condition = { type: REVIEW_STATE, source: source };
     if (entry.require_sticky_verdict !== undefined) {
@@ -425,7 +459,12 @@ export function evaluateReviewCondition(condition, snapshot) {
         return { passed: false, changesRequested: false, reason: "review snapshot unavailable" };
     }
     const source = condition.source;
-    if (source === "sticky_verdict") {
+    // BAPI-689: the condition's `source` is always CANONICAL here — every path to a
+    // `ReviewStateCondition` goes through `parseReviewStateCondition`, which maps
+    // the historical spellings before validating. `snapshot.sticky_verdict` is a
+    // different thing entirely (the parsed value OF the sticky comment) and keeps
+    // its name.
+    if (source === "verdict_protocol") {
         if (snapshot.sticky_verdict === "approved")
             return { passed: true, changesRequested: false, reason: "sticky verdict approved" };
         if (snapshot.sticky_verdict === "changes_requested")

package/build/conductor/epic-reconcile.js

@@ -171,6 +171,12 @@ export async function reconcileEpic(access, observed, plan, deps, supervisorConf
                 deps.log(`[epic-reconcile] shadow-freshness error for ${ticketKey}: ${safeDiagnosticMessage(err, "freshness error")}; holding`);
             }
             if (verdict === "stale") {
+                // BAPI-678: this covers ordinary unproven freshness AND the backend's
+                // warn-only downgrade of a `failed` shadow lifecycle. Identical handling
+                // is intentional — either way the watermark is unproven, so hold before
+                // claiming a dispatch key. The backend clocks the hold and parks the
+                // ticket if its own stale deadline expires, so "hold" is bounded there
+                // rather than repeating forever here.
                 deps.log(`[epic-reconcile] holding ${ticketKey}: shadow watermark stale`);
                 continue;
             }